Understanding your obligations under the Online Safety Act

The Online Safety Act 2023 received Royal Assent in October 2023, and Ofcom has been rolling out its regulatory framework in phases since. For businesses that operate websites, apps, or platforms with any form of user-generated content or interaction, the obligations are now live and enforceable.

Who is affected

The Act applies to any service that allows users to post content, send messages, or interact with each other online. This includes obvious platforms like social media, but also extends to business websites with comment sections, forums, review functionality, or community features. If your website has a contact form that displays submissions publicly, or a blog with comments enabled, you may have obligations.

What you need to do

The core requirement is to conduct a risk assessment of your service — identifying what types of harmful content could appear and what measures you have in place to address them. For most small businesses, this is a proportionate exercise: documenting your moderation process, having a clear complaints procedure, and ensuring illegal content is removed promptly.

Practical steps

Review your website for any user-facing content features. If comments are enabled on your blog, decide whether they are adding value — and if not, disable them. Ensure your terms of use cover acceptable behaviour. If you operate any form of marketplace or community, seek specific legal advice on your Ofcom obligations.

The penalties for non-compliance are significant, and Ofcom has indicated it will focus initial enforcement on businesses that have made no effort to comply rather than those making good-faith attempts.