The UK Online Safety Act requires regulated online services to assess illegal and harmful content risks and take proportionate steps to prevent, remove or limit access to that content. Practitioners should map in-scope services, document risk assessments, enforce age-appropriate protections, and maintain moderation, reporting and escalation processes that can be evidenced to the regulator.
What the Online Safety Act is trying to achieve
The Act is a platform safety law, not a content quality rule. Its purpose is to make regulated services take responsibility for foreseeable harm on their services, especially where scale, recommendation systems, user-to-user features, search, or messaging can amplify illegal content or content harmful to children.
That shift matters because the law does not ask whether a service can perfectly eliminate harm. It asks whether the service has identified the risks it creates and put proportionate controls around them. For practitioners, that usually means scope analysis, service-level risk assessment, control design, and a defensible record of why the chosen measures are appropriate.
How compliance works in practice
Compliance is built around duties that vary by service type and risk. A service has to understand what user-generated or discovery-driven features it offers, what audiences it reaches, and how harmful content could be encountered, recommended, or spread. The compliance burden is therefore tied to product design and operating model, not just legal review.
In practice, the main tasks are to classify the in-scope service, assess illegal content and child safety risks, select mitigations that fit the service model, and operate them consistently. For some services that means stronger moderation or recommendation changes; for others it means age assurance, friction, reporting tools, user controls, or governance over third-party moderation workflows.
Evidence is central. A team should be able to show risk assessments, policy decisions, moderation thresholds, escalation paths, complaint handling, and the rationale for why access restrictions or content limits are proportional. Without that audit trail, even a well-meaning control set can be hard to defend to the regulator.
Why the Act changes product and governance decisions
The Act pushes safety decisions upstream into design, operations, and accountability. That is why age-appropriate protections, moderation workflows, and reporting channels are not treated as optional add-ons. They become part of how the service proves it has reduced foreseeable exposure rather than simply reacted after harm appears.
For larger or more complex services, the hardest issue is usually not identifying a single control. It is aligning product teams, trust and safety, legal, and operations around one risk model. If risk ownership is fragmented, controls become inconsistent: one surface is moderated, another is not, and the service cannot explain the gap clearly.
That is also where documentation discipline matters. The Act rewards services that can demonstrate how decisions were made, not just that a policy exists. In other words, governance quality is part of compliance quality, especially when service architecture, user age mix, or content flows change over time.
Risk and Threat Considerations
Services face two broad failure modes: unmanaged harmful content exposure and weak control implementation. If a platform underestimates how content is surfaced, shared, or recommended, harm can scale quickly across many users before moderation catches up. If age checks, reporting, or escalation paths are inconsistent, the service may have controls on paper but not in operation.
Failure mechanism: Harmful content becomes reachable through discovery, recommendation, reposting, or private interaction paths that were not fully covered in the risk assessment or control design, leaving the service unable to demonstrate proportionate mitigation.
Impact: Exposure can increase rapidly, especially for child users or vulnerable users, and the organisation may face enforcement, remediation cost, reputational damage, and the need to redesign core product flows under regulatory pressure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | The Act requires service-specific scope and harm context to drive controls. |
| ID.RA-01 — Risk Identification | Risk assessments are central to identifying harmful-content exposure paths. | |
| PR.AT-01 — Awareness and Training | Moderation and escalation processes depend on trained operational decision-makers. | |
| Recommendation — Define service scope, audiences, and harm context before selecting safety controls. Identify content, feature, and audience risks that create illegal or harmful exposure. Train moderators and operators on escalation thresholds and evidence handling. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | Age assurance and user safety controls may involve sensitive personal data handling. |
| A.5.37 — Documented operating procedures | The Act depends on evidenceable moderation, reporting, and escalation procedures. | |
| Recommendation — Minimise and govern sensitive data used for age assurance and safety controls. Document and maintain the operating procedures used for safety enforcement. | ||
Practitioner Guidance
What to prioritise: Start with service mapping and risk assessment quality. If you cannot clearly describe where illegal or harmful content can enter, be amplified, or be reported, your downstream controls will be uneven and difficult to justify.
What to verify: Check that moderation, escalation, and age-appropriate protections are operating as designed, not just documented. The useful test is whether you can produce evidence showing how the control works on real traffic, real complaints, and real exceptions.
What practitioners underestimate: The Act is often treated as a legal compliance exercise, but the operational challenge is product governance. The organisations that struggle most are usually the ones that rely on policy statements without building durable review, monitoring, and change-control around the product itself.
Practitioner takeaway: The decisive question is not whether a service has a safety policy, but whether it can prove that its actual product behaviour, moderation model, and escalation process reduce foreseeable harm proportionately over time.