Do software and SaaS need to comply with Basic Online Safety Expectations + industry codes?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to software and SaaS whatever their structure or size. The deciding fact: Industry: Software & SaaS.
The obligation in brief
Comply with Basic Online Safety Expectations + industry codes. Under section 45 of the Online Safety Act 2021 the Minister determines Basic Online Safety Expectations for social media services, relevant electronic services and designated internet services. They expect providers to take reasonable steps so that all Australian end-users can use the service safely, children's best interests are a primary consideration, features such as encrypted services, anonymous accounts, generative AI and recommender systems can be used safely, unlawful and harmful material is minimised, users can report and complain, and terms of use are enforced.
Trigger: Providing a covered service to Australian end-users; a legal duty arises when eSafety gives the provider a periodic or non-periodic reporting notice or makes a reporting determination covering its class of service.
Why software & saas get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 32 of those industries the answer for "Comply with Basic Online Safety Expectations + industry codes" is no. Software & SaaS is one of the 3 where the answer is different: yes.
The deciding fact for software and SaaS: Industry: Software & SaaS.
About the industry: Tech companies — captured by Privacy Act, Online Safety Act, AI Voluntary Standard, and SOCI if critical-infrastructure-aligned.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires industry: Software & SaaS / Telecommunications carriers / CSPs / Media & publishing).
Answer by business structure and size
Each cell is the engine's outcome for a business in software & saas with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
What the obligation requires
- When due
- As specified in the notice: periodic reports cover intervals of 6 to 24 months and are due no earlier than 28 days after the end of each interval (s 49(3)-(4)); one-off reports by the date in a non-periodic notice.
- Evidence to keep
- Responses to eSafety reporting notices; records of the reasonable steps taken against each Expectation and why they are reasonable; safety risk assessments across design, development and deployment; default privacy and safety settings for services used by children; age assurance measures; user reporting and complaints data; published transparency reports.
- Maximum penalty
- Failing to comply with a periodic or non-periodic reporting notice (or a reporting determination) is a civil penalty contravention: 500 penalty units ($182,000) per contravention (Online Safety Act 2021 ss 50, 53, 57 and 60). eSafety may instead issue a formal warning, and may publish a statement where a provider does not answer an information request
- Regulator
- See source
- Jurisdiction
- Commonwealth (national)
Other obligations where software & saas differ from the norm
Questions
- Do software and SaaS need to comply with Basic Online Safety Expectations + industry codes?
- Yes. This obligation applies to software and SaaS whatever their structure or size. The deciding fact: Industry: Software & SaaS.
- Is the answer the same for every industry?
- No. For 32 of the 35 industries Rules Mate maps, the answer is no. Software & SaaS is one of 3 industries with a different answer.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.