How to comply with the Online Safety Act, without a legal team
The Online Safety Act is hundreds of pages, and every guide seems to assume you have a compliance department. You do not. This walks you through what compliance actually means for a small service, in the order to tackle it - so you can stop dreading it and start doing it.
Step 1
Work out if you are in scope
The Act applies to user-to-user services - anywhere people can share or post to each other - that have links to the UK. What matters is whether you control the space users post in. If you run your own site, app or game, you are likely the provider and carry the duties. If you only run a room inside someone else's platform, the platform usually carries them. The quickest way to be sure is the free scoping check.
Step 2
Do your risk assessments
If you are in scope, you must carry out a suitable and sufficient illegal-content risk assessment, and a children's access assessment to decide whether children are likely to use your service. If they are, you also do a children's risk assessment. A risk assessment looks at each kind of harm and rates how likely it is on your service - negligible, low, medium or high - and records your reasoning.
Step 3
Put safety measures in place
Based on what your risk assessments find, put proportionate measures in place: an easy way for users to report illegal content, a complaints process, a clear approach to moderation, and acting on illegal content once you are aware of it. If children can access your service, add the child-safety protections your risk assessment points to, such as safer defaults for child accounts.
Step 4
Keep records and name someone accountable
Write down what you did and when. Name a person who is accountable for compliance. The standard is taking reasonable, documented steps - being able to show your working matters as much as the decisions themselves.
Step 5
Watch what is coming
The regime is still growing. Children's codes are in force, and under-16 restrictions are expected to be enforced from spring 2027. Build in a habit of reviewing your assessments when the rules - or your own service - change.
The stakes
What if I get it wrong?
Penalties at the top end are serious - up to 18 million pounds or 10 percent of qualifying worldwide revenue, whichever is higher - but enforcement is proportionate and risk-based, aimed at serious or uncooperative cases rather than small operators acting in good faith. The point of this guide is to help you act in good faith and show it.
Your next step
See exactly which duties apply to you
The free scoping check takes about three minutes and gives you a clear verdict, plus the duties that follow from it.
See exactly which duties apply to you - freeKeep reading