Harper James is a UK full-service commercial law firm advising businesses on the laws of England and Wales. For businesses operating online, compliance with the Online Safety Act 2023 begins with identifying whether the service falls within the Act and which duties apply.
The Act primarily covers providers of user-to-user services and search services with a connection to the United Kingdom. A service may be in scope where users can upload, share, discover or search content, although the specific duties depend on the service’s design, user base and functionality. Businesses should document the basis for their assessment, including the service type, UK users, age profile, content risks and any relevant exemptions.
In-scope providers must assess risks associated with illegal content and, where relevant, risks to children. The assessment should consider how content is created, shared, recommended and moderated. Controls may include content moderation processes, reporting and complaints routes, user terms, account restrictions, age assurance, search safeguards and escalation procedures. The appropriate measures depend on the identified risks and the provider’s legal duties. Businesses should assign ownership for each control and retain evidence of decisions, testing and review.
Compliance is an ongoing operational process rather than a one-off policy exercise. A practical programme should include a current risk assessment, documented policies, staff training, incident records, complaints data and periodic reviews of moderation and safety measures. Businesses should also monitor relevant Ofcom guidance and codes of practice, which explain how certain statutory duties can be met. Records should show how the organisation identified risks, selected controls and responded when those controls failed or required adjustment.
Ofcom can require information from regulated providers and has enforcement powers under the Act. Businesses should therefore establish a process for responding to information requests, preserving relevant records and coordinating legal, compliance, technical and communications teams. The first practical step is a written scope assessment, followed by a gap analysis against the duties that apply to the service. This creates a defensible compliance plan and identifies which measures require immediate implementation, further testing or specialist review.