Daily Junction.mobi portalTechnology · April 5, 2026 · Liam Chen · 5 min
The UK Online Safety Act places new duties on services that host user content or let people interact. Here is who it applies to, the core obligations, and the role of the regulator, Ofcom — at a general, plain-English level.
If your business runs a website where users can post, comment, upload or message each other, the UK's Online Safety Act may place legal duties on you — and not only if you are a household-name platform. The law is one of the most significant pieces of internet regulation the UK has introduced, and a common misconception is that it only concerns the big social networks. This guide explains, in plain English, who it applies to, the core obligations it creates, and the role of the regulator, Ofcom.
This article is general information, not legal advice. The duties under the Online Safety Act depend on the specifics of each service. For decisions about your own obligations, consult Ofcom's official guidance or take professional advice.
The Online Safety Act is UK law designed to make online services safer for users, and especially for children, by requiring certain providers to take responsibility for the content and activity their services enable. Rather than dictating exactly what content is allowed, the law focuses on the systems and processes a service has in place to manage risk.
The headline idea is a shift from "publish and react" to "assess and prevent": in-scope services are expected to understand the risks on their platform and design their service to reduce them.
This is where many businesses are caught off guard. The Act applies, broadly, to two kinds of service:
Two points matter for ordinary businesses:
If your site has any user-interaction feature, the safe first step is to check whether you are covered rather than assume you are not.
The precise obligations vary by the type and size of service, but in general terms they cluster around a few themes.
| Duty area | What it broadly involves |
|---|---|
| Risk assessment | Identifying the risks of harm on your service |
| Illegal content | Systems to prevent, detect and remove illegal content |
| Protecting children | Extra measures where children are likely to access the service |
| Transparency & reporting | Clear terms, reporting routes and (for larger services) reporting duties |
In practice that means in-scope providers are generally expected to:
The emphasis throughout is on having sensible, proportionate processes — not on achieving the impossible standard of a perfectly clean platform overnight.
The Act is enforced by Ofcom, the UK's independent communications regulator. Ofcom's role is central, and it works in several ways:
Because Ofcom's codes and guidance define what compliance actually looks like in detail, they — together with GOV.UK — are the authoritative sources to check. This article points you to the framework; Ofcom provides the specifics.
For most organisations, a sensible, proportionate response looks like this:
This sits alongside other UK digital rules a business may already deal with, such as cookie consent under PECR and the broader DMCC Act governing digital markets, consumers and competition. Treating compliance as a connected discipline, rather than a series of one-off scrambles, is part of building compliance as a competitive advantage. It also helps to understand the wider direction of platform regulation, including how AI assistants and tools in business increasingly intersect with content and safety expectations.
Industry commentators have published practical overviews aimed at smaller organisations trying to make sense of the law. London consultancy CM Beyer, for instance, offers a plain-English explainer on understanding your obligations under the Online Safety Act — a helpful orientation, though it is not a substitute for Ofcom's official guidance.
The UK Online Safety Act places real duties on services that host user content or let people interact, and its reach extends well beyond the big platforms to forums, comment sections and many ordinary business websites. The core obligations are about assessing risk, managing illegal content, and protecting children — all in proportion to a service's size and risk profile. Ofcom is the regulator, setting the codes and wielding the enforcement powers. Because the detail depends on your specific service, treat this as a starting map and rely on Ofcom and GOV.UK for the authoritative route — and on professional advice for decisions about your own duties.
![[View image]](/img/uk-online-safety-act.jpg){kind=link}