In terms of communications provision, it's not that much different to CALEA in the US or equivalents in other countries. The troubling section is in section 317C that defines what a "designated communications provider" and "eligible activities" are.

The worrying items are 3-6 that basically say anyone who provides software/hardware or develops that software/hardware is part of either used for providing communications or "an electronic service" are subject to the notices.

So, are you a software house developing an app? You're providing an electronic service by running the app and its servers? You're liable under this law to assist as is "feasible".

Same if you develop software used by another "electronic service". So, writing some open source software? The library used by another app? You have to assist under one of these notices.

The only get out clause is 317ZG which says that a provider is not required to develop anything that introduces a "systemic" vulnerability. But I'm sure lawyers will have a fun time defining "systemic".