Australian AI Governance Briefing: Week Ending 13 September 2026

Online safety dominated the week. On Thursday 10 September Parliament passed the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026, which received Royal Assent on Friday 11 September. The Act lets the eSafety Commissioner compel documents rather than information alone, extends her reach to third parties including age assurance providers and app stores, adds compulsory examination powers carrying penalties of up to $364,000 and 12 months imprisonment, and doubles the maximum civil penalty for systemic breaches of the minimum age obligations from $49.5 million to $99 million.

Two days earlier, on Tuesday 8 September, the Prime Minister and the Minister for Communications released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026. The draft extends duty of care obligations across digital services — including online games, apps and AI chatbots — requires platforms to offer users over 16 a choice between an algorithmic feed and a follow-only feed, gives eSafety power to issue removal notices for nudify apps and websites, and carries penalties of up to $109.2 million. Feedback closes at 12pm on 22 September 2026.

The age assurance requirements inside the App Distribution Services Code became enforceable on Wednesday 9 September, and a Sydney prosecution over an alleged AI-generated scraper reached a listing at the Downing Centre.

The week in review

Parliament passes expanded eSafety enforcement powers for the social media minimum age

The Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 passed Parliament on Thursday 10 September 2026 and received Royal Assent on Friday 11 September 2026. The bill was introduced on 29 June 2026, passed the House of Representatives on 1 July 2026 and was referred to the Senate Environment and Communications Legislation Committee, which recommended it be passed without amendment. Senate second reading debate took place on Tuesday 8 September.

The Act amends the Online Safety Act 2021 to expand the eSafety Commissioner’s information-gathering powers in relation to the social media minimum age framework. The Commissioner can compel the production of documents rather than information alone, and can require information and documents from third parties, including age assurance providers and app distribution services. Government amendments moved in the Senate added compulsory examination powers: individuals can be summonsed and examined under oath, with non-compliance attracting fines of up to $364,000 and imprisonment of up to 12 months.

Maximum civil penalties for systemic breaches of the minimum age obligations double from $49.5 million to $99 million. The Government announced that increase on 28 June 2026, framing it alongside the new evidence-gathering powers as a response to platforms self-reporting their own compliance.

The Coalition voted against the bill, which passed with Greens and crossbench support including Senator David Pocock. Shadow Minister for Communications Sarah Henderson said the examination powers had been dropped on the Senate at the eleventh hour without proper scrutiny. Nationals Senator Matt Canavan also opposed the bill. Minister for Communications Anika Wells said on Thursday that Australian families would not forget the senators and members who sold them out.

The new powers land on live investigations. The minimum age obligation took effect on 10 December 2025, and eSafety’s March 2026 compliance report covering the first three months of the regime was informed by compulsory information-gathering notices given to the ten age-restricted platforms.

Primary sources: Parliament of Australia — Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 | Prime Minister — Stronger powers and double the penalties for world-leading social media law | Senate Hansard, 8 September 2026 | eSafety — Social media age restrictions

Government releases the Digital Duty of Care exposure draft, covering AI chatbots and generative AI services

On Tuesday 8 September 2026 the Prime Minister and the Minister for Communications released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 for targeted consultation. The draft would place an onus on digital service providers to maintain a safe online environment and to meet minimum standards for the features and tools they use. The Government is seeking feedback from digital platforms, industry bodies, civil society organisations and advocates, with legislation to be introduced to Parliament this year. Feedback closes at 12pm on 22 September 2026, should be sent to [email protected], and is limited to five pages.

The measure announced as “My Feed, My Way” would require social media platforms to send new and existing users a notification offering a choice over their default feed. Users can opt in to a default feed containing personalised content recommended by the algorithm, or opt out and see the friends and creators they follow. The Minister said platforms would be required to give users over 16 that choice when they open the app, and to respect it.

The draft reaches well beyond social media. Digital services including online games, apps and AI chatbots would be required to protect under-18s from design features with negative behavioural impacts, such as addictive features or features affecting a young person’s self-esteem. Those services would also be required to protect under-18s from harmful content including material that promotes, encourages or accelerates eating disorders, material promoting hostile ideas about women and gender equality, pornography, material glorifying crime or life-endangering stunts, and material causing serious mental health distress including abuse and bullying.

The draft laws would give eSafety the power to issue removal notices for nudify apps or websites and would streamline the child cyberbullying and adult cyber abuse schemes. Digital platforms would be required to document the measures taken to address identified risks of harm to Australian users and to ensure those measures remain effective over time. The draft also provides for approved researchers, such as those at Australian universities, to access digital service providers’ data for online safety research. Failure to comply with the duty of care could attract penalties of up to $109.2 million, with the eSafety Commissioner responsible for compliance and enforcement.

The Department has noted that it may use AI tools to support the consultation, including to identify abusive or offensive language and to summarise feedback, and that those activities may generate or infer new personal information about respondents.

Primary sources: Prime Minister — My Feed, My Way | Department of Infrastructure — Online Safety Amendment (Digital Duty of Care) Bill 2026 exposure draft | Department of Infrastructure — Exposure draft publication and feedback details | Mallesons — Digital Duty of Care: Australia’s latest move on online safety

App distribution age assurance obligations become enforceable

The age assurance requirements inside the App Distribution Services Code became enforceable on Wednesday 9 September 2026, six months after the code came into effect on 9 March 2026. App stores operating in Australia must implement appropriate age assurance before permitting users to download or purchase apps rated 18+, must ensure apps are appropriately rated, must present rating information clearly, and must hold procedures to reconsider and change ratings.

The code is one of nine Age-Restricted Material Codes registered under the Online Safety Act. Six of them, covering app distribution platforms, equipment providers, social media services, relevant electronic services and designated internet services, were registered on 9 September 2025 and came into effect on 9 March 2026, with some measures commencing later. The codes are technology-neutral on method. Where eSafety issues a direction to comply and that direction is breached, civil penalties of up to $49.5 million may apply.

The same code family requires designated internet services, including high-risk generative AI platforms, to put appropriate age assurance measures in place. Age assurance requirements for logged-in users of search engine services took effect earlier, on 27 June 2026.

Primary sources: eSafety — FAQ on access to online porn and other adult content | eSafety — Register of online safety codes and standards

Prosecutors allege generative AI was used to build a scraper in NSW courts data breach case

A Sydney court heard on Wednesday 9 September 2026 that Christopher John Duff, 40, allegedly used ChatGPT to code and deploy Python scraper scripts designed to bulk download data from the NSW Online Registry. Mr Duff has pleaded not guilty to four counts of accessing restricted data held in a computer. The charges followed the Department of Communities and Justice’s discovery of a data breach, with cybercrime detectives investigating alleged unauthorised access to 8,769 restricted documents on the department’s online registry website. The registry is accessible to court users with an authorised login.

Police prosecutor Sergeant Andrew Maldigri told the Downing Centre Local Court that the crux of the allegation is the use of ChatGPT to build the scraper. Prosecutors will seek to rely on ChatGPT conversations and forensic expert testimony, which is believed to be among the first times this has occurred in an Australian prosecution. The court heard Mr Duff was assisting a friend involved in bankruptcy proceedings. Defence counsel Daniel McMahon estimated the proposed exhibit material ran to 10,000 or more pages and told the judge there may not be a dispute, in general terms, that his client was responsible for some of the alleged conduct.

Primary sources: ABC News — Prosecutors allege man used AI to ‘scrape’ court website, then asked ChatGPT for legal help

UNSW ties a large ChatGPT Edu rollout to new assessment rules

UNSW Sydney confirmed during the week that it will introduce new academic policy measures addressing academic integrity as it expands its rollout of OpenAI’s ChatGPT Edu. The assistant is being made available to 80,000 students and staff, following a limited rollout to 10,000 fixed-term and permanent staff that began late last year. OpenAI described the arrangement as a strategic collaboration, and its technology will also be incorporated into teaching materials.

A UNSW spokesperson said the rollout would be accompanied by an “assessment transformation” setting new AI modes, dividing assessments into three categories — “can”, “can’t” and “must” — to give students clear directions on when to use the technology, and that guidance on academic integrity expectations would be revised. The university said it does not regard technological tools such as AI watermarking as sufficiently reliable on their own to identify misconduct or cheating, and that detection tools and watermarking will not be relied upon in isolation.

Primary sources: iTnews — UNSW reveals new measures to deal with AI cheating

Stories

Parliament passes expanded eSafety enforcement powers and doubles social media minimum age penalties

The Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Bill 2026 passed Parliament on 10 September 2026 and received Royal Assent on 11 September 2026. The Act allows the eSafety Commissioner to compel documents rather than information alone, extends information-gathering powers to third parties including age assurance providers and app distribution services, and adds compulsory examination powers with fines of up to $364,000 and imprisonment of up to 12 months for non-compliance. Maximum civil penalties for systemic breaches of the minimum age obligations double from $49.5 million to $99 million. The Coalition voted against the bill, which passed with Greens and crossbench support.

Source: aph.gov.au

Government releases Digital Duty of Care exposure draft covering AI chatbots, with feedback closing 22 September

The Prime Minister and the Minister for Communications released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 on 8 September 2026 for targeted consultation. The draft would require digital service providers to maintain a safe online environment, extends obligations to online games, apps and AI chatbots to protect under-18s from harmful design features and content, and includes the “My Feed, My Way” requirement that platforms offer users over 16 a choice between an algorithmic feed and one showing only accounts they follow. It would also let eSafety issue removal notices for nudify apps and websites, and carries penalties of up to $109.2 million. Feedback closes at 12pm on 22 September 2026 and is limited to five pages.

Source: pm.gov.au

App store age assurance requirements become enforceable

The age assurance requirements inside the App Distribution Services Code became enforceable on 9 September 2026, six months after the code came into effect. App stores operating in Australia must implement appropriate age assurance before permitting users to download or purchase apps rated 18+, ensure apps are appropriately rated, present rating information clearly, and maintain procedures to reconsider ratings. Where eSafety issues a direction to comply and that direction is breached, civil penalties of up to $49.5 million may apply. The same code family requires designated internet services, including high-risk generative AI platforms, to apply appropriate age assurance.

Source: esafety.gov.au

Prosecution over NSW courts data breach turns on alleged AI-generated scraper code

A Sydney court heard on 9 September 2026 that Christopher John Duff, 40, allegedly used ChatGPT to code and deploy Python scraper scripts to bulk download data from the NSW Online Registry, in a case concerning alleged unauthorised access to 8,769 restricted documents. Mr Duff has pleaded not guilty to four counts of accessing restricted data held in a computer. Prosecutors will seek to rely on ChatGPT conversations and forensic expert testimony, believed to be among the first instances of this in an Australian prosecution. The matter was listed at the Downing Centre Local Court.

Source: abc.net.au

UNSW expands ChatGPT Edu to 80,000 users and sets new assessment AI modes

UNSW Sydney confirmed it will introduce new academic policy measures on academic integrity as it expands OpenAI’s ChatGPT Edu to 80,000 students and staff, following a limited rollout to 10,000 staff that began late last year. The measures include an “assessment transformation” dividing assessments into “can”, “can’t” and “must” AI modes, together with revised guidance on academic integrity expectations. The university said AI watermarking and detection tools are not sufficiently reliable on their own to identify misconduct and will not be relied upon in isolation.

Source: itnews.com.au

---

This briefing was researched and written with AI assistance.