Who must comply with online safety industry codes (Phase 1 + 2)?

Eight industry sections covered by binding codes under the Online Safety Act 2021.

The Online Safety Codes and Standards, registered or determined under the industry codes and standards provisions (ss 140-150) of the Online Safety Act 2021 and enforced by the eSafety Commissioner, were developed in two phases. The Unlawful Material Codes and Standards (six codes and two standards) deal with class 1A and 1B material such as child sexual exploitation and pro-terror material. The Age-Restricted Material Codes (nine codes) deal with class 1C and class 2 material such as online pornography that is inappropriate for children: three codes took effect on 27 December 2025 and six on 9 March 2026. Providers must apply the code or standard for each online industry section they participate in, which can mean several for one business, and report on compliance measures as the instrument requires. eSafety keeps a public register of codes and standards and publishes regulatory guidance, updated in September 2026 after a Federal Court judgment.

Applies when the business has industry: Software & SaaS / Telecommunications carriers / CSPs / Media & publishing.

How the regulator frames it: Participants in each online industry section: social media services, app distribution services, hosting services, internet carriage services, equipment providers and search engine services (Unlawful Material Codes); relevant electronic services and designated internet services (Unlawful Material Standards); and, for age-restricted material, hosting, carriage, search, app distribution, equipment, social media (core and messaging features), relevant electronic and designated internet services.

What triggers it: Providing an online service or equipment in an industry section covered by a registered code or a determined standard.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (3 of 35: yes; 32 of 35: no).

Structure does not change the answer in the 3 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 3 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in software & saas with 6–19 employees, turnover $1M–$3M: applies. Industry: Software & SaaS.
• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires industry: Software & SaaS / Telecommunications carriers / CSPs / Media & publishing.

When due

Continuously from each instrument's commencement (Age-Restricted Material Codes: 27 December 2025 for hosting, carriage and search; 9 March 2026 for the other six sections), with compliance reporting and communication with eSafety as each code or standard specifies.

Frequency

Ongoing

Evidence to keep

Assessment of which industry sections and which code or standard apply to each service; documented compliance measures for class 1A, 1B, 1C and class 2 material; compliance reports provided to eSafety; records of responses to eSafety directions and formal warnings.

Status

Current

Priority

Critical

Maximum penalty: Failing to comply with an eSafety direction to comply with a registered industry code (s 143(2)), or failing to comply with an industry standard (s 146(1)), carries a civil penalty of up to 30,000 penalty units, $10.92M, enforceable under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014 (Online Safety Act 2021 s 162). eSafety can also issue formal warnings for code or standard breaches (ss 144, 147)

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

If this obligation applies to you, so does this one: the engine uses the same rule for each.

• Comply with Basic Online Safety Expectations + industry codes

Rules Mate tracks 2 published obligations tagged "online safety", 1 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is an ongoing duty.

Regulated by eSafety Commissioner.

eSafety: Online safety regulator. Administers the Online Safety Act including image-based abuse, cyberbullying, illegal/harmful content, and Basic Online Safety Expectations.

• eSafety Commissioner

Online Safety Act 2021: Federal online safety regime.

• Online Safety Act 2021

Free tools that help with this obligation:

• Compliance calendar builder