- What the Bill says
- A service that generates material using artificial intelligence is one of the nine types of online service (section 25B). There is no size threshold and no exception for chatbots supplied by a vendor.
- Our reading
- An AI chatbot on a small business website is likely covered, and it is the highest-risk feature most small sites have. A scripted chat menu or live chat with staff is not an AI service.
- Not yet decided
- How the duty is shared between a business and its chatbot vendor, and what eSafety will expect a small business to do about a chatbot.
Does the duty apply to my chatbot if a vendor supplies it?
Likely yes, for both of you. The vendor may be responsible for the chatbot as an AI service. You still provide the website it sits on. The Bill does not divide the duty between the two.
Ask your vendor in writing who controls the bot day to day and what safety settings it has.
Why is a chatbot treated as higher risk?
A chatbot can say something harmful to anyone who types into it, including a child, on any topic. A page of fixed text cannot.
The Bill's list of material harmful to children also includes material that simulates emotional intimacy and fosters a child's dependence on it in place of human relationships. That item was added during the House of Representatives debate, and it sits in the general list.
What safeguards manage the risk from a chatbot?
Timing: as at 14 November 2026 the Bill is not law, and none of this is required. These are the practices that manage the risk. They are worth knowing now and would matter if the Bill passes.
- Keep it on topic. Limit it to your products, bookings and opening hours.
- Turn on the vendor's safety filters.
- Have it refuse harmful requests and direct the person to your staff or an appropriate support service.
- Offer a way to reach a person.
- Test it before launch. Try to push it off topic, and keep a record of what it said.
- Hold the vendor account in your business's name, so you control the settings.
What about a scripted chat widget with no AI?
On our reading, a live chat or a fixed menu of answers is not a service that generates material using AI. It is still part of your website, so it belongs in your website's risk assessment.
Do today's rules already apply to chatbots?
Some do. eSafety's current industry codes already deal with some chatbot features, and they apply now. Check eSafety's guidance for your type of service.
What should I do before adding a chatbot?
Today, nothing in this Bill stops you adding one. Once the duty starts, the order would matter: an updated risk assessment would be needed before any significant change that could add new risks, and adding a chatbot is the clearest example. If you are choosing a chatbot now, pick one with safety settings you control, so you are not replacing it later. See the rule on changes.
Sources
Last updated 14 November 2026