Who must comply with Basic Online Safety Expectations + industry codes?

Social media services, app distribution services, and other captured providers must meet the BOSE and industry codes.

Under section 45 of the Online Safety Act 2021 the Minister determines Basic Online Safety Expectations for social media services, relevant electronic services and designated internet services. They expect providers to take reasonable steps so that all Australian end-users can use the service safely, children's best interests are a primary consideration, features such as encrypted services, anonymous accounts, generative AI and recommender systems can be used safely, unlawful and harmful material is minimised, users can report and complain, and terms of use are enforced. The Expectations themselves are not enforceable in court (s 45(4)); the enforceable part is reporting. eSafety can require periodic or one-off reports on how a provider meets them (ss 49 and 56) or make reporting determinations for classes of services, and can publish statements about a provider's performance. Separate registered industry codes and standards impose binding duties.

Applies when the business has industry: Software & SaaS / Telecommunications carriers / CSPs / Media & publishing.

How the regulator frames it: Providers of social media services, relevant electronic services (such as messaging and online gaming services) and designated internet services (apps and websites) used by Australian end-users. Reporting duties arise only for a provider given a notice, or covered by a determination, by the eSafety Commissioner.

What triggers it: Providing a covered service to Australian end-users; a legal duty arises when eSafety gives the provider a periodic or non-periodic reporting notice or makes a reporting determination covering its class of service.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (3 of 35: yes; 32 of 35: no).

Structure does not change the answer in the 3 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 3 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in software & saas with 6–19 employees, turnover $1M–$3M: applies. Industry: Software & SaaS.
• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires industry: Software & SaaS / Telecommunications carriers / CSPs / Media & publishing.

When due

As specified in the notice: periodic reports cover intervals of 6 to 24 months and are due no earlier than 28 days after the end of each interval (s 49(3)-(4)); one-off reports by the date in a non-periodic notice.

Frequency

Ongoing

Evidence to keep

Responses to eSafety reporting notices; records of the reasonable steps taken against each Expectation and why they are reasonable; safety risk assessments across design, development and deployment; default privacy and safety settings for services used by children; age assurance measures; user reporting and complaints data; published transparency reports.

Status

Current

Priority

High

Maximum penalty: Failing to comply with a periodic or non-periodic reporting notice (or a reporting determination) is a civil penalty contravention: 500 penalty units ($182,000) per contravention (Online Safety Act 2021 ss 50, 53, 57 and 60). eSafety may instead issue a formal warning, and may publish a statement where a provider does not answer an information request.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• eSafety v Telegram (BOSE notice) (2024): Messaging platforms must engage with eSafety transparency requests — silence equals infringement.
• eSafety v X Corp (BOSE notice) (2023): BOSE non-compliance attracts immediate infringement notices. Foreign tech parents are not exempt — substituted-service mechanisms work.

If this obligation applies to you, so does this one: the engine uses the same rule for each.

• Comply with online safety industry codes (Phase 1 + 2)

Rules Mate tracks 2 published obligations tagged "online safety", 1 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Online Safety Act 2021: Federal online safety regime.

• Online Safety Act 2021

Free tools that help with this obligation:

• Compliance calendar builder