The Compliance Hit
Australia's proposed Digital Duty of Care regime could force hundreds of thousands of small business websites into annual compliance cycles. The draft bill requires covered online services to complete written risk assessments at least yearly, reassess after material changes, retain records for six years, and hand them to the eSafety Commissioner within 30 days on request.
COSBOA warns the scope could capture ordinary business websites: hairdressers, cafes, tradies. The government says low-risk services should face minimal obligations, but final exemptions are not locked in. The bill landed in Parliament in September 2026. Obligations for small operators remain unclear.
The Numbers
Government impact analysis estimates $1.408 million in additional regulatory costs per year across the Australian economy over ten years. That is total economy-wide cost, not per-business. Individual compliance bills depend on scope, service complexity, and what the final regulations require. COSBOA has not published small-business cost estimates and is calling for the government to do so.
Maximum civil penalty: $109.2 million for corporations under the draft's 60,000 penalty unit cap. The government has discussed lowering some remedial penalties.
The Market Opportunity
This creates demand for compliance infrastructure. Australian cybersecurity, GRC, legal, audit, and web consulting providers are likely beneficiaries. Small businesses in scope will need risk assessment templates, documentation software, compliance advisory, content moderation tools, and potentially independent assurance.
Two-tier opportunity: enterprise platforms with existing compliance budgets versus a much larger small-business segment likely to seek low-cost, packaged products if they stay in scope. No public data yet on specific vendors, funding, or sales team expansion tied to this policy.
What Sales Teams Should Know
If you sell compliance, GRC, cybersecurity, or web services into ANZ SMB, watch this bill. Scope uncertainty means no firm TAM yet, but small business groups are flagging material impact. Final regulations and exemptions will determine whether this is a narrow enterprise play or a broad SMB compliance event. Legislative timeline: draft introduced September 2026, passage and implementation dates TBD.
COSBOA CEO Skye Cappuccio to SmartCompany: the number of businesses needing annual audits could hit hundreds of thousands. Government position: low-risk services should face minimal burden. Gap between those positions is the whole market.