How a safety proposal becomes a rule

Policy travels in documents.

Carnegie-associated duty-of-care work, collaboration with Reset and citations in Australia’s statutory review connect a developed model to official consideration. Funding and commissioned work sustain parts of this policy infrastructure. Later funding, however, cannot be assigned authorship of an earlier idea.

The Australian draft narrows one requested power.

Reset sought vetted research access including third-sector organisations. The 8 September 2026 exposure draft instead specifies Australian-university employment and approval under prospective rules. That is a meaningful narrowing of eligibility.

The proposed duty divides authority among a legislative framework, ministerial rules and eSafety. Its adult-consent provision limits what the duty requires; it does not create a universal adult veto. The text examined here does not establish universal identification.

Age assurance is a method question as well as a power question.

Ofcom’s acceptance of email-based age estimation followed technical evidence, including AVPA input. Accepting a method does not certify a vendor or award a procurement contract. Who supplies evidence, who chooses the threshold and who sells a service are distinct roles.

A regulator can take one recommendation and leave another.

Ofcom attributes a crisis notice-indicator change to Full Fact’s submission and earlier meeting questions. It also considered Check My Ads’ crisis-revenue request without recommending specific monetisation practices in that measure.

These decisions show influence and limits at the same time. They are a firmer basis for analysis than assuming either that consultation means control or that formal regulatory independence means nobody influenced the outcome.