Media Release | Online safety needs qualified assessors, not just a ‘box-ticking exercise’: ACS

10 November 2026 - For Immediate Release

Companies that breach the proposed Digital Duty of Care could face penalties of up to $109.2 million, with the duty potentially extending to small businesses that provide websites, apps or generative AI services. But an online safety risk assessment is only as good as the person doing it, the Australian Computer Society (ACS) told a Senate inquiry today.

Appearing before the Senate Environment and Communications Legislation Committee at Parliament House, ACS called for a stronger Digital Duty of Care Bill to give Australians confidence that online services are taking effective steps to minimise harm.

ACS Policy Advisor Casey Tonkin said: "Risk assessments should be done by people who can show they have the skills for the job. Otherwise, it becomes a box-ticking exercise."

ACS outlined four recommendations to help ensure the proposed duty delivers meaningful protection.

1. Demonstrated professional competency. Require people conducting risk assessments to demonstrate the skills needed for the work, using internationally recognised frameworks such as the Skills Framework for the Information Age (SFIA).
2. Clear senior accountability. Require providers of critical systems to appoint a senior accountable officer who resides in Australia and is appropriately qualified to assess risks arising from the service.
3. Independent scrutiny. Require independent checks of services that pose high or systemic risks and operate AI-enabled, algorithmic and recommender systems.
4. Workforce readiness. Use the 12-month transition period to build the assessor workforce so smaller businesses have access to qualified assessors. This would lift standards across the whole supply chain and doesn't land as another compliance cost.

ACS said independent checks were especially important for AI and recommender systems. Assessors should examine how those systems work and test whether the safeguards reduce harm in practice.

ACS CEO Dr Prins Ralston said: "Every business needs access to qualified cyber advice. Small businesses often have the least room in their budgets for specialist help, and they can least afford to get an assessment wrong. They're the most likely to end up with a box-ticking assessment by default.

"When a small supplier misses a risk in a service that other businesses rely on, the consequences can reach those businesses and the people they serve.

"Let's not forget that while small businesses operate on a smaller scale than large corporations, they're still part of other organisations' supply chains. If a small supplier's assessment misses a risk, it can leave everyone who relies on its services exposed," said Ralston.

ACS has called for the skills of technology professionals to be verified against recognised standards where their work affects the safety of Australians online. ACS already assesses ICT professionals against SFIA as a designated assessing authority for skilled migration and operates a statutory Professional Standards Scheme.

ENDS

Further information

Troy Steer
Director of Member Engagement & Public Affairs
M - 0417 173 740
E - [email protected]

About ACS

The Australian Computer Society (ACS) is the professional body for Australia's technology profession. Since 1966, we have championed a trusted, skilled, and world-class profession, representing 42,000 members across business, government and education, with branches in every Australian state and territory. Our work strengthens Australia's digital sovereignty, responsible AI adoption, cyber resilience, workforce capability and digital trust. We set professional standards, accredit education, certify practitioners and advocate for the skills and capabilities Australia needs. ACS is committed to advancing the profession and ensuring technology serves Australia's national interests and delivers lasting public value.

About Cyberpath

CyberPath is a Commonwealth grant-funded cyber professionalisation pilot led by ACS which brings together industry, government and education to standardise career and education pathways, skills requirements and recognition frameworks for cyber security.