TRW & Co · Technology, data and AI
Online Safety Act: Duties for Online Services
The Online Safety Act requires user-to-user services, search services and pornography providers with UK links to assess and reduce the risk of illegal content and harm to children. Illegal content duties have applied since March 2025 and child safety duties since July 2025, and Ofcom is enforcing both. This guide explains scope, the core duties, categorised services, fees and penalties.
Key pointThere is no size threshold: any service with a significant number of UK users or a UK target market is in scope, wherever it is based, and Ofcom's first fines have targeted smaller providers that failed to put effective age checks in place.
At a glance
Three service types
The Act covers user-to-user services, search services and providers that publish pornographic content, including services based outside the UK that have links with the UK.
Core duties in force
Illegal content codes took effect on 17 March 2025 and the protection of children codes on 25 July 2025, so Ofcom can now enforce both sets of duties.
Categorisation register published
Ofcom published its register of categorised services on 10 July 2026, triggering transparency reporting and further duties for the largest user-to-user and search services.
Penalties up to 10%
Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and seek court-approved business disruption measures in serious cases.
Fees now payable
Providers above the qualifying worldwide revenue threshold had to notify Ofcom by April 2026, with the first annual fees due by March 2027.
Swipe or scroll →
The Online Safety Act: the short answer
The Online Safety Act 2023 requires providers of user-to-user services, search services and services that publish pornographic content to assess and manage the risk of harm to people in the UK. As of October 2026, the core duties are fully in force: illegal content duties since March 2025, child safety duties since July 2025, and Ofcom has been enforcing both, including with fines. The largest platforms now face additional duties following Ofcom's register of categorised services, published in July 2026.
The Act reaches services based outside the UK if they have links with the UK, such as a significant number of UK users or the UK as a target market. Penalties can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Which services are in scope?
The Online Safety Act 2023 received Royal Assent on 26 October 2023. Its duties apply to three broad types of service:
- User-to-user services – any service that lets users generate, upload or share content that other users may encounter, or interact with each other. This includes social media, video-sharing platforms, forums, dating apps, online gaming with chat, messaging services and consumer file-sharing or cloud storage.
- Search services – general search engines and services that include a search engine.
- Pornography providers – services that publish or display pornographic content themselves, which must use highly effective age assurance to stop children encountering it.
The government's explainer confirms that the Act applies to services outside the UK if they have links with the UK: a significant number of UK users, the UK as a target market, or the service is capable of being used in the UK and there is a material risk of significant harm to UK users. Size is no defence. Small forums and start-ups are in scope if they meet these tests, although the measures Ofcom expects scale with size and risk.
What is exempt
Some services fall outside the regime, including email, SMS and MMS services, one-to-one live voice calls, internal business tools, and services where users can only comment on or review the provider's own content, such as product reviews on a retailer's site. The exemptions are narrow and depend on the actual functionality, so an assessment against the Act's schedules is worth recording.
The core duties: illegal content and children
Illegal content duties
Every in-scope service must carry out a suitable and sufficient illegal content risk assessment, covering priority offences such as terrorism, child sexual exploitation and abuse, fraud, harassment and intimate image abuse. Providers must then take proportionate steps to mitigate the risks, operate systems to swiftly take down illegal content when they become aware of it, offer accessible reporting and complaints routes, and set out their approach in their terms of service.
The first assessments were due by 16 March 2025 and Ofcom's illegal content codes took effect on 17 March 2025. Following the codes' recommended measures is a "safe harbour": a provider that does so is treated as complying with the relevant duty. Providers can choose other measures but must show they are effective.
Child safety duties
Every user-to-user and search service had to complete a children's access assessment by 16 April 2025. Services likely to be accessed by children then had to complete a children's risk assessment by 24 July 2025, and the protection of children codes took effect on 25 July 2025.
The central requirement is to prevent children from encountering the most harmful content, such as pornography and content promoting suicide, self-harm or eating disorders, and to protect them from other harmful content. In practice that usually means highly effective age assurance for services that allow such content, safer recommender feeds for children and better reporting tools. Our article on age assurance under online safety law explains the methods Ofcom accepts.
New criminal offences for individuals
Separately from the duties on platforms, the Online Safety Act created new criminal offences that apply to individual users, which came into force in early 2024. They include sending false communications intended to cause non-trivial harm, threatening communications, encouraging or assisting serious self-harm, sending flashing images to people with epilepsy, and cyberflashing. These offences matter to platforms too, because content amounting to them can be illegal content that services must assess and act on.
Cyberflashing and encouraging serious self-harm are being treated as new priority offences, and Ofcom consulted in 2026 on how its codes should reflect them. Providers should expect the list of illegal harms they must assess to grow over time.
| Date | Milestone | Who it affects |
|---|---|---|
| 16 March 2025 | Illegal content risk assessments due | All in-scope services |
| 17 March 2025 | Illegal content codes in force; enforcement begins | All in-scope services |
| 16 April 2025 | Children's access assessments due | User-to-user and search services |
| 25 July 2025 | Protection of children codes in force | Services likely to be accessed by children |
| 7 April 2026 | Duty to report detected child sexual exploitation and abuse content to the National Crime Agency begins | Regulated user-to-user services (not yet applied to search) |
| 10 July 2026 | Ofcom publishes register of categorised services | Category 1, 2A and 2B services |
| October and November 2026 | Category 1 and 2A services provide risk assessment records, then publish summaries | Category 1 and 2A services |
| By March 2027 | First annual fees payable | Fee-liable providers |
Categorised services and additional duties
The Act imposes further duties on the largest and riskiest services. Thresholds are set in secondary legislation by reference to UK user numbers and functionality, such as content recommender systems, resharing and direct messaging. Category 1 covers the largest user-to-user services, Category 2A the largest search services and Category 2B certain user-to-user services with direct messaging.
Ofcom published its register of categorised services on 10 July 2026. All categorised services face transparency reporting, with the first reports expected in 2027 once Ofcom issues notices. Category 1 and 2A services must provide Ofcom with up-to-date risk assessment records by October 2026 and publish summaries by November 2026. Further duties, including user empowerment tools for adults, protections for news publisher and journalistic content, and fraudulent advertising duties, depend on codes Ofcom consulted on in 2026. A provider that disagrees with its categorisation has a short window to appeal to the Upper Tribunal.
How to comply: a step-by-step programme
For a provider newly in scope, or one reviewing its position, the following steps reflect the structure of Ofcom's guidance and codes.
- Confirm scope. Decide whether the service is user-to-user, search or a pornography provider, whether any exemption applies and whether it has UK links. Record the analysis.
- Carry out the illegal content risk assessment. Use Ofcom's risk profiles and evidence on your user base, features and history to assess each kind of priority illegal harm.
- Carry out the children's access assessment. Decide whether children can access the service and, if so, whether it is likely to be accessed by them. If yes, complete a children's risk assessment.
- Implement the codes or alternatives. Adopt the measures in Ofcom's codes that apply to your size and risk level, or document alternative measures and why they are effective.
- Update terms, reporting and complaints. Make terms of service clear about how users are protected, and provide easy reporting and complaints routes with prompt handling.
- Name accountable people. Assign a senior individual responsible for online safety compliance and train moderation and product teams.
- Prepare for fees and information requests. Check whether your qualifying worldwide revenue triggers fee notification, and be ready to answer Ofcom's statutory information notices accurately and on time.
- Review regularly. Update risk assessments before significant changes to the service, such as new features, and keep them under periodic review in line with Ofcom's guidance.
Ofcom's enforcement powers and penalties
Ofcom has wide information-gathering powers, can require skilled persons' reports and can open investigations. Where it finds a breach, it can issue a confirmation decision requiring remedial steps and impose a penalty of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. In the most serious cases, Ofcom can apply to the courts for business disruption measures requiring payment providers, advertisers or internet service providers to withdraw services or block access in the UK.
Senior managers can face criminal liability for failing to ensure compliance with information notices, and in some circumstances for failures to comply with enforcement notices on child safety duties. Ofcom has used its powers: in February 2026 it fined a pornography provider £800,000 for failing to introduce effective age checks, with a further penalty for ignoring information requests.
Fees are a separate obligation. Providers whose qualifying worldwide revenue meets the threshold set by regulations must notify Ofcom and pay an annual fee to fund the regime; the first notification window closed in April 2026. Ofcom's fees and penalties statement explains how qualifying worldwide revenue is calculated.
Information notices are where many providers first meet Ofcom, and they carry their own sanctions. Treat every notice as a legal deadline: route it to a named owner, check the answers against your risk assessment records, and take advice before responding if anything is unclear. Inaccurate or late responses can lead to penalties even if the underlying safety measures are sound.
Illustrative scenario: a growing community app
This scenario is illustrative only and does not describe any real client or matter.
A start-up based outside the UK runs a hobby community app with group chat, image sharing and a recommended content feed. Around a fifth of its users are in the UK, and it has never considered the Online Safety Act.
The app is a user-to-user service with a significant number of UK users, so it is in scope. It needs an illegal content risk assessment covering, for example, grooming risk in chat and intimate image abuse in shared images, and measures such as effective moderation, reporting and blocking tools. Because children can sign up and are likely to use it, it needs a children's risk assessment and protections, probably including age assurance and safer default settings for younger users.
If the start-up completes and records those assessments, aligns with Ofcom's codes for a service of its size and keeps reviewing risk as features change, it is well placed to answer any Ofcom enquiry. Ignoring the regime because it is small and foreign-based would leave it exposed to information notices and penalties.
Common mistakes under the Online Safety Act
Assuming small or overseas services are out of scope
The Act has no general size threshold and applies to services outside the UK that have UK links. A niche forum or overseas app with a significant UK user base can be in scope. Ofcom's codes scale the expected measures by size and risk, so small services face lighter requirements, but they still need to complete and record risk assessments and meet the core duties on illegal content and, where relevant, children.
Treating the risk assessment as a one-off document
Risk assessments must be kept up to date and revisited before significant changes to the service, such as adding direct messaging, live streaming or generative AI features. Ofcom can request the records, and Category 1 and 2A services must now supply them and publish summaries. A stale assessment that does not reflect the current product is a common weakness and undermines any reliance on the safe harbour in the codes.
Weak age assurance
Self-declaration of age and simple tick-boxes do not meet the standard of highly effective age assurance that Ofcom requires where children must be prevented from encountering the most harmful content. Ofcom's early enforcement has focused heavily on age checks, particularly for pornography services. Providers should choose methods Ofcom recognises, test them, and consider privacy obligations under data protection law when processing age data.
Overlooking generative AI features
Generative AI chatbots and image tools built into user-to-user or search services can bring content they generate into scope, because users may encounter it and share it. Providers adding AI features should update their risk assessments, consider illegal and harmful content risks from AI outputs, and apply moderation and reporting to them. Our guide to AI regulation in the UK explains how other laws apply to the same features.
Cross-border angle: the UK, the EU and beyond
Many platforms must comply with the Online Safety Act and the EU Digital Services Act at the same time. The regimes overlap in aims but differ in structure: the UK regime is built around risk assessments and Ofcom's codes of practice, while the EU regime centres on notice-and-action, transparency and systemic risk obligations for very large platforms. A combined programme with jurisdiction-specific modules is usually the most efficient approach.
For providers based in Bangladesh, South Asia, the Gulf or Singapore with UK users, the key question is UK links. If the service has a significant number of UK users or targets the UK, Ofcom can act regardless of where the company sits. We help overseas providers assess scope, build proportionate compliance and engage with Ofcom, working with our digital regulation team and technology lawyers.
What to do next: a checklist
- Document whether your service is in scope and why, including UK links and exemptions.
- Complete or refresh illegal content, children's access and children's risk assessments.
- Map your measures against Ofcom's codes and record any alternatives.
- Review age assurance, recommender settings and default protections for children.
- Update terms of service, reporting and complaints processes.
- Name a senior accountable person and set up a process for Ofcom information notices.
- Check whether you are fee-liable and whether you appear on Ofcom's categorisation register.
- Reassess before launching new features, especially messaging, live streaming and generative AI.
We advise platforms, start-ups and investors on Online Safety Act scope, risk assessments, Ofcom investigations and related data protection and media issues, and on the interaction with AI regulation in the UK. Where a decision needs challenging, our public law team can help. Contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, by email at info@trw.co or on +880 1779 127165.
Frequently asked questions
01Who does the Online Safety Act apply to?
It applies to user-to-user services, which let users share content or interact, such as social media, forums, messaging, gaming chat and dating apps; to search services; and to providers that publish pornographic content. Services based outside the UK are covered if they have links with the UK, such as a significant number of UK users or the UK as a target market. Some services are exempt, including email, SMS and services where users can only comment on the provider's own content.
02What are the illegal content duties?
Every in-scope service must carry out and keep up to date an illegal content risk assessment, take proportionate measures to mitigate the risks, swiftly remove illegal content when it becomes aware of it, provide reporting and complaints routes and explain its approach in its terms of service. Ofcom's illegal content codes took effect on 17 March 2025. Following the recommended measures in the codes is treated as compliance with the relevant duties.
03Do I need age verification under the Online Safety Act?
It depends on your service. Pornography providers must use highly effective age assurance to prevent children from accessing their content. User-to-user and search services likely to be accessed by children must prevent children from encountering the most harmful content, which often requires highly effective age assurance where such content is allowed. Self-declaration does not meet the standard. Ofcom has issued guidance on acceptable methods and has fined providers that failed to introduce age checks.
04What are the penalties for breaching the Online Safety Act?
Ofcom can impose penalties of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. It can also require remedial action and, with the court's approval, impose business disruption measures that require payment providers, advertisers or internet service providers to stop working with a service or block access in the UK. Senior managers can face criminal liability in certain cases, such as failing to ensure compliance with information notices.
05What is a categorised service?
Categorised services are the largest or highest-risk services that meet thresholds set in secondary legislation, based on UK user numbers and features such as recommender systems, resharing and direct messaging. Category 1 covers large user-to-user services, Category 2A large search services and Category 2B certain user-to-user services with direct messaging. Ofcom published its register on 10 July 2026. Categorised services face transparency reporting and, depending on category, additional duties.
06Does the Online Safety Act apply to small websites and start-ups?
Yes, if they are user-to-user or search services with UK links. There is no general size exemption. Ofcom's codes scale the recommended measures by the size of the service and its risk level, so a small low-risk forum is expected to do much less than a large social network. Small providers must still complete and record risk assessments, operate reporting and takedown processes and, where children are likely to use the service, put protections in place.
Sources and official materials
- Online Safety Act 2023 — Full text of the Act
- Online Safety Act: explainer — Government summary of scope, duties and enforcement
- Ofcom: important dates for online safety compliance — Ofcom timeline for duties, codes, categorisation and fees
- Ofcom: online safety fees and penalties statement — Qualifying worldwide revenue and the fees regime
- Ofcom fines porn company £800k for failing to introduce age checks — Example of Ofcom enforcement, February 2026
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.