The short version
- The Act covers “user-to-user” and search services with links to the UK. Schedule 1 lists the exemptions. They include comments and reviews on a provider’s own content, email and internal business tools.
- For services in scope, the core duties are already live. They are an illegal content risk assessment, safety measures from 17 March 2025, a children’s access assessment and children’s safety duties from 25 July 2025.
- Ofcom publishes a free scope checker and a step-by-step toolkit. Start there and keep written records. Take legal advice if your position is unclear.
Ask most business owners who the Online Safety Act is for and they will name the big social networks. The law is drafted more widely than that. It regulates online services by what they let users do. The size of the company behind them does not matter. Ofcom’s compliance guide says providers are legally responsible for keeping UK users safe even when they are based outside the UK.
That does not mean every company website is caught. Plenty are not regulated at all. Several everyday features are exempt. The useful question for a UK business is narrower. Does anything you run online let one user see content created by another user? This article sets out what the Act and Ofcom’s published guidance say. It is analysis and it is not legal advice. It cannot tell you whether your own service complies.
Who the Act covers
The Act received Royal Assent on 26 October 2023. Section 4 regulates two main kinds of service. They are user-to-user services and search services. The government’s explainer describes the first group as services that let users post content online or interact with each other. It gives social media, cloud storage, video sharing platforms, forums, dating services and messaging services as examples.
A service is only regulated if it has links with the UK. Under section 4 that means one of three things. It has a significant number of UK users. Or the UK is one of its target markets. Or it can be used here and there are reasonable grounds to believe its content presents a material risk of significant harm to people in the UK. On that wording, a British company selling to British customers should assume the UK link is there.
In practice, the features to look at are the ones where your customers talk to each other and not just to you. Examples are a community forum, member profiles, a marketplace where sellers post their own listings, group chat inside an app and a shared file area. Those are my examples and not an Ofcom list. Whether any one of them brings a service into scope depends on the detail.
What is exempt
Schedule 1 to the Act lists the exemptions. The ones most relevant to an ordinary business are:
- Email, SMS and MMS. A service is exempt where these are the only user-generated content it enables. The same goes for one-to-one live voice calls.
- Limited functionality services. A service is exempt where users can only do three things. They can post comments or reviews on content published by the provider itself. They can share those comments elsewhere. They can react with things like a “like” button or a star rating. That description fits the comment box under a company blog post and the reviews on a product page.
- Internal business services. A tool is exempt if it is an internal resource for a business and provided by that business. It must also be open only to a closed group such as staff and authorised contractors. An intranet is the obvious example.
Each exemption has conditions and they are drafted tightly. A review section that also lets customers message each other privately does more than the limited functionality paragraph describes. Read the schedule itself or run Ofcom’s checker before relying on any of them.
What Ofcom has required so far
For services that are in scope, the main duties are already in force. Ofcom’s page of compliance dates, last updated on 24 August 2026, sets out the sequence.
| Date | What was required |
|---|---|
| 16 March 2025 | Deadline for existing services to complete an illegal content risk assessment. |
| 17 March 2025 | Illegal content Codes of Practice in force. Services must comply with the illegal content safety duties. |
| 16 April 2025 | Deadline for user-to-user and search services to complete a children’s access assessment. |
| 24 and 25 July 2025 | Children’s risk assessment due for services likely to be accessed by children. Protection of Children Codes in force the following day. |
| 7 April 2026 | User-to-user services must report detected, previously unreported child sexual exploitation and abuse content to the National Crime Agency. |
| July 2026 | Ofcom publishes its register of categorised services. |
The register matters to a small business mostly as reassurance. The extra duties for “categorised” services begin at thresholds measured in millions. Category 1 starts above 7 million monthly active UK users, for services with a content recommender system and resharing. Category 2A covers search engines above the same figure. Ofcom’s timetable also shows that the fees regime applies only to providers above a revenue threshold.
New services do not sit outside the timetable. Ofcom’s illegal content duties page says a provider has three months from launching an in-scope service to complete its risk assessment. It must carry out a fresh one before making a significant change. Ofcom recommends reviewing the assessment at least once a year. It also says reviews must now cover two newly added priority offences. The first is encouraging or assisting serious self-harm. The second is cyberflashing.
What the duties look like for a small, low-risk service
Ofcom’s risk assessment guidance uses four steps. First, understand the 18 kinds of priority illegal content. Second, assess how likely each is on your service and how serious the impact would be. Third, decide on safety measures and put them in place. Fourth, report, review and update. You must keep a written record. Ofcom says you do not need to send it to the regulator unless it asks or unless you provide a categorised service.
The measures scale with risk. Ofcom calls a service “low risk” if it is low or negligible risk for every kind of priority illegal content. It says the minimum number of measures then apply. Some apply to everyone. They include naming an individual who is accountable for online safety compliance and keeping terms of service clear and accessible. Services must also let people report illegal content easily and operate a complaints procedure. For a small service with no board, Ofcom says reporting to a senior manager with responsibility for online safety is enough.
Enforcement so far
Ofcom’s compliance guide puts the maximum penalty at £18 million or 10% of qualifying worldwide revenue, whichever is greater. Its implementation update, published in May 2026, says it had opened investigations into nearly 100 services since the duties began. One example came on 12 February 2026. Ofcom fined Kick Online Entertainment SA £800,000 for failing to put age checks in front of pornographic content. It also fined the company £30,000 for failing to respond to an information request.
The same update describes Ofcom’s compliance focus for 2026 as child protection, illegal hate and terror content and intimate image abuse. My reading is that the regulator’s attention is on services where the potential for harm is greatest. That is an observation about priorities. It is not a safe harbour. The duties apply to every in-scope service whether or not anyone is looking.
What to do now
- List every feature across your websites and apps where one user can see something another user wrote, uploaded or shared.
- Run that list through Ofcom’s scope checker and keep a note of the result.
- If a service looks to be in scope, work through Ofcom’s illegal content toolkit. Write the risk assessment down and name the person accountable for it.
- Complete a children’s access assessment and record the outcome.
- Make sure users have an easy way to report illegal content and to complain. Make sure your terms say how you handle both.
- Put an annual review in the diary. Reassess before launching or changing any community feature.
- Take legal advice if the checker result is unclear or the service carries real risk.
This article is analysis of published sources as at 2 October 2026. It is not legal advice and does not say whether any particular service is or is not compliant.
Sources
All sources were opened and checked on 2 October 2026. Corrections are handled as set out in the editorial standards.
- Online Safety Act 2023, section 4 (legislation.gov.uk)
https://www.legislation.gov.uk/ukpga/2023/50/section/4 - Online Safety Act 2023, Schedule 1: exempt services (legislation.gov.uk)
https://www.legislation.gov.uk/ukpga/2023/50/schedule/1 - Online Safety Act: explainer (GOV.UK, Department for Science, Innovation and Technology)
https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer - Online Safety Act compliance guide for providers of online services (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/guide-for-services - Check if the Online Safety Act applies to you (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/check - Illegal content duties under the Online Safety Act (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/illegal-content-duties-under-the-online-safety-act - Check how to comply with the illegal content rules: digital toolkit (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/check-how-to-comply-with-the-illegal-content-rules - Important dates for Online Safety compliance (Ofcom, updated 24 August 2026)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/important-dates-for-online-safety-compliance - Ofcom’s approach to implementing the Online Safety Act (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/roadmap-to-regulation - Register of categorised services and list of emerging Category 1 services (Ofcom)
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/register-of-categorised-services-and-list-emerging-category-1-services - Ofcom fines porn company £800,000 for failing to introduce age checks (Ofcom, 12 February 2026)
https://www.ofcom.org.uk/online-safety/protecting-children/ofcom-fines-porn-company-800k-for-failing-to-introduce-age-checks