New online safety law lets tech giants mark their own homework, ACS warns

15 Oct 2026 | Statement by Dr Prins Ralston, CEO, Australian Computer Society

The Digital Duty of Care Bill introduced into Parliament today makes platforms, apps, games and AI chatbots assess their own risks to Australians, however it sets no standard for the people doing that work, ACS says.

ACS CEO Dr Prins Ralston said that gap will decide whether the law works.

"The Minister says tech companies are live testing their products on Australians. She's right. But under this Bill, the same companies write the safety report on themselves.

"So who writes it? Do they understand how a recommender system or a chatbot behaves? Has anyone tested whether the new algorithm off switch does what it says? The Bill doesn't set a standard for any of that.

"The Government has dealt with two big concerns today, with news and entertainment exempt and Parliament now deciding any new harms. Good. But a $109 million fine means nothing if nobody competent has looked under the bonnet.

"You can't fine, sack or deregister an algorithm but you can hold a person to account. Every one of these assessments needs a named professional behind it who knows the technology and answers for the result.

"You can't wire a house in this country without a licence. You can't audit a company's books without being registered. The Minister says this Bill brings tech into line with every other industry. We should apply the same standard to the people doing the checking.

"The eSafety Commissioner has said herself that her office is up against companies with far more money and power. A clear standard for who can do these assessments is one of the cheapest ways to even that up.

"The good news is none of this needs inventing. The standards exist and our profession uses them every day. Parliament just needs to write them in."

ACS' four key recommendations:

  1. A competency bar: Anyone doing or reviewing a risk assessment must show they can do it, measured against recognised standards such as SFIA. A certificate alone doesn't mean a company has met its duty.
  2. A named senior officer: Someone with the technical authority to require fixes, while accountability remains with the company.
  3. Independent checks for high-risk AI and algorithmic systems: eSafety shouldn't have to take a platform's word for it.
  4. Use the 12-month transition before the core requirements come into effect: Build the assessor workforce now, so smaller, lower-risk services aren't caught in a bottleneck.

"This isn't about making every small business hire a compliance team," Dr Ralston said.

"It's about the big, high-risk systems getting checked by people who know what they're looking at."

ACS will make a submission to the Senate inquiry and is ready to give evidence. It has offered to bring together working technology professionals to help eSafety set the standard before the new rules start.

"We may not build every platform Australians use, but we can be much clearer about the standards we expect of them, and much better at checking they're being met."

ENDS

 

Further information

Troy Steer
Director of Corporate Affairs and Public Policy
M: 0417 173 740
E: troy.steer@acs.org.au

 

About ACS

The Australian Computer Society (ACS) is the professional body for Australia’s technology profession. Since 1966, we have championed a trusted, skilled, and world-class profession, representing 42,000 members across business, government and education, with branches in every Australian state and territory.

Our work strengthens Australia’s digital sovereignty, responsible AI adoption, cyber resilience, workforce capability and digital trust. We set professional standards, accredit education, certify practitioners and advocate for the skills and capabilities Australia needs. ACS is committed to advancing the profession and ensuring technology serves Australia’s national interests and delivers lasting public value.