The UK Online Safety Act is UK legislation that places safety duties on in-scope online services, with a particular focus on illegal content, child safety, and risk management. Organisations need to assess whether their services are in scope, complete risk assessments, implement appropriate controls, and keep evidence of their decisions and governance.
What the Online Safety Act changes for digital services
The UK online safety act shifts online safety from a voluntary trust-and-safety posture to a legal duty of care for in-scope services. That means organisations must decide whether the service is covered, identify harmful content or conduct risks, and show that governance decisions were made deliberately and consistently.
For many organisations, the first material question is scope, because obligations differ depending on the service type, user base, and features. A clear scope analysis prevents teams from overbuilding controls in low-risk areas or underestimating duties on products that combine user-generated content, messaging, discovery, or child-facing functionality.
Core duties and governance expectations
The Act is not just about content takedown. It also drives formal risk assessment, documented decision-making, escalation paths, and accountability for how safety choices are made and reviewed over time. In practice, that creates an evidence trail that regulators can test against actual service design and operations.
Governance matters because the same service can present different risks across features, user cohorts, and content surfaces. Organisations therefore need a repeatable method for setting ownership, approving mitigations, and revisiting those choices when product behaviour, recommendation logic, or moderation workflows change.
Controls, assessment, and evidence
Most compliance failures happen when organisations treat the law as a policy exercise rather than an operating model. Controls need to map to real service behaviour, such as moderation workflows, age assurance, user reporting, ranking signals, abuse handling, and record retention for safety decisions.
Evidence quality is especially important. Teams should be able to show what risks were identified, what mitigations were chosen, why those controls were proportionate, and how effectiveness was reviewed. Without that record, even well-intentioned safeguards can be difficult to defend if challenged by regulators or auditors.
For a practical starting point on related UK regulatory context, see Global Cybersecurity Regulatory Map, which helps place UK obligations alongside other regional cyber rules.
Why the Act is operationally difficult
The hard part is that safety duties sit across product, legal, trust and safety, engineering, and compliance functions. That means risk ownership can fragment unless the organisation defines who approves scope calls, who signs off mitigations, and who keeps the evidence current when the product changes.
Where age-related protections are relevant, the control problem becomes even more technical, because organisations must balance effectiveness, privacy, and user experience while resisting circumvention. NCSC guidance is often useful here, especially when the service design needs to align legal duties with implementation realities; NCSC UK Advice and Guidance is a useful reference point for broader operational practice.
Risk and Threat Considerations
The main risk is not only regulatory penalty, but also systematic exposure if harmful content, abuse, or child-safety controls are poorly scoped or inconsistently enforced. Services that lack clear governance can end up with weak moderation, incomplete reporting, or controls that look good on paper but fail under real traffic and abuse patterns.
Failure mechanism: Mis-scoped services, weak evidence, or inconsistent mitigation decisions create gaps that allow harmful content or conduct to persist while the organisation cannot prove reasonable safety measures were in place.
Impact: This can lead to enforcement action, forced redesign, loss of user trust, and avoidable exposure for children or other vulnerable users.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | The Act imposes statutory duties that must be identified and tracked. |
| A.5.36 — Compliance with policies, rules and standards for information security | The Act requires evidence that internal controls follow stated safety governance. | |
| Recommendation — Maintain a register of Online Safety Act obligations and review it whenever the service changes. Verify that moderation, risk assessment, and approval workflows follow documented safety policy. | ||
| NIST CSF 2.0 | GV.OC-03 — Legal and regulatory requirements are understood and communicated | The Act requires organisations to understand and communicate duties to relevant owners. |
| GV.RM-01 — Risk management strategy is established and agreed to by organizational stakeholders | The Act depends on formal risk assessment and proportionate control selection. | |
| PR.AT-01 — Personnel are provided cybersecurity awareness and training | Operational enforcement of safety duties depends on staff understanding their role. | |
| Recommendation — Map Online Safety Act obligations to accountable owners and communicate them across the business. Define a risk strategy for in-scope services and align safety mitigations to that strategy. Train product, moderation, and compliance teams on their responsibilities under the Act. | ||
Practitioner Guidance
Why practitioners should care: The Act creates an accountability problem as much as a compliance problem. Teams should treat scope decisions, risk assessments, and mitigation approvals as durable artefacts, not one-time paperwork.
Governance implication: Assign a clear owner for service scope, a separate owner for safety control design, and a review process that revalidates both whenever the product, audience, or content model changes.
Practitioner takeaway: If you cannot explain why a control exists, who approved it, and how it is reviewed, the organisation is not yet operating to the standard the Act expects.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org