UK Online Safety Act: Duties, Ofcom Codes and What Security Teams Must Do

The UK Online Safety Act 2023 turns content harms into a regulated risk management duty, and most of the work it creates lands on the systems, identities and evidence that security and platform teams already own. The Act applies to user-to-user services (anywhere users can share content other users encounter) and search services with links to the UK, whether or not the provider is based in the UK, and Ofcom is the regulator. This guide explains who is covered, the core duties in Part 3 of the Act, the Ofcom codes and deadlines as they stood when this page was checked on 8 November 2026, the penalty and fees regime, and a practical compliance sequence. It is written for security leaders, compliance and trust and safety managers, and engineers who have to make the duties work in production. Two narrower topics have their own pages: see the Age Assurance Guide for age checks and the UK Online Safety Act Fraud Duties Guide for scam content and fraudulent advertising.

Key takeaways

• Risk assessment is the engine. Every in-scope service must keep a suitable and sufficient illegal content risk assessment under section 9, update it before significant design changes, and repeat the exercise for children where children are likely to access the service.
• Illegal content duties have been enforceable since 17 March 2025. Risk assessments were due by 16 March 2025, and the children's safety measures had to be in place from 25 July 2025.
• Size changes the duty set, not the starting point. All services carry the illegal content duties; only services on Ofcom's register of categorised services (Category 1, 2A and 2B, register published July 2026) take on additional duties, several of which are still being consulted on.
• Highly effective age assurance is a hard requirement in places. Section 12(6) requires age checks that are highly effective where a service allows primary priority content such as pornography, and Ofcom names which methods qualify.
• Penalties are revenue based and personal. Fines reach the greater of £18 million or 10% of qualifying worldwide revenue, senior managers can face criminal liability in defined cases, and large providers now pay annual fees.

Scope: who and what is covered

The Act regulates three kinds of service. Part 3 covers user-to-user services (social media, forums, messaging, marketplaces, gaming with chat, file sharing, dating) and search services. Part 5 covers services that publish their own pornographic content. Scope turns on links with the UK, not on where the provider is incorporated, so overseas services with UK users are in scope. The government explainer lists the priority illegal content categories, including child sexual abuse, fraud, terrorism and extreme pornography.

Categorised services

The Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025 (SI 2025/226) set the thresholds, and Ofcom keeps the register.

Ofcom also keeps a separate list of emerging Category 1 services that reach at least 75% of a Category 1 user threshold and meet the functionality conditions. They carry no additional duties yet. A provider can ask Ofcom to remove a service from the register at any time with evidence of a relevant change.

Key obligations

Illegal content duties (all services)

• Risk assessment (section 9): assess the user base, the risk of users encountering each kind of priority illegal content separately, the risk of the service being used to commit or facilitate a priority offence, the role of algorithms and functionalities, and how design, business model, governance and proactive technology raise or reduce risk (section 9(5)(a) to (h)). Repeat it before any significant change to design or operation (section 9(4)).
• Safety duties (section 10): use proportionate measures to prevent users encountering priority illegal content, mitigate the risk of the service being used for priority offences, minimise how long priority illegal content is present and swiftly take down illegal content once aware of it (section 10(2) and (3)).
• Intimate image takedown: since 29 June 2026 section 10(3A), inserted by the Crime and Policing Act 2026, requires reported intimate image content, and content identified as the same or substantially the same, to be taken down as soon as reasonably practicable and no later than 48 hours after the report, subject to the exceptions in section 10(3B).
• Areas of measures (section 10(4)): regulatory compliance and risk management, design of functionalities and algorithms, terms of use, user access including blocking, content moderation, user controls, user support, and staff policies and practices.
• Terms of service (section 10(5) to (8)): explain how users are protected, describe any proactive technology (its kind, when it is used and how it works), and apply the terms consistently.
• CSEA reporting: Ofcom states that the duty to report child sexual exploitation and abuse content to the National Crime Agency came into force on 7 April 2026 for user-to-user services, with search services to follow.

Children's duties (services likely to be accessed by children)

• Children's access assessment: the government explainer gives 16 April 2025 as the deadline for completing it.
• Children's risk assessment and safety duties (section 12): prevent children of any age from encountering primary priority content (pornography, and content promoting self-harm, eating disorders or suicide) and give age-appropriate protection from priority content such as bullying, hateful content, serious violence, dangerous stunts and harmful substances.
• Highly effective age assurance (section 12(4) to (6)): age verification or estimation must be "highly effective at correctly determining whether or not a particular user is a child" wherever the service does not prohibit primary priority content for all users. Ofcom lists open banking, photo-ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation as capable; self-declaration, debit card payment and contractual restrictions are not.

Additional duties for categorised services

Category 1 services must offer all adult UK users the option to verify their identity, by a process of any kind that need not require documents, and explain it in their terms (section 64). Category 1 terms of service must also summarise their latest risk assessment findings (sections 10(9) and 12(14)). Ofcom's July 2026 consultation covers fraudulent advertising, terms of service, complaints, user empowerment, user identity verification, news publisher, journalistic and democratic content duties, so treat detailed measures for these as pending.

How Ofcom's codes work

Ofcom's codes of practice recommend specific measures. A provider that follows the recommended measures is treated as complying with the related duty; a provider that chooses other measures must be able to show they achieve the same outcome and record why. For security teams this means the codes act as the control baseline, much as a benchmark does for configuration.

Timeline and current status

Status as checked on 8 November 2026. Dates move, so re-check Ofcom's roadmap before relying on a future date.

legislation.gov.uk shows further amendments made by the Crime and Policing Act 2026 that were not yet applied to the published text when checked, so read the current consolidated version before quoting wording.

Enforcement and penalties

• Fines: Schedule 13 paragraph 4(1) sets the maximum at the greater of £18 million or 10% of qualifying worldwide revenue for the most recent complete accounting period.
• Senior manager liability: the government explainer states that senior managers can face criminal action if they fail to ensure compliance with Ofcom information requests, and, where at fault, if the provider fails to comply with enforcement notices about specific child safety duties or child sexual abuse and exploitation.
• Business disruption: in the most extreme cases, and with court agreement, Ofcom can require payment providers, advertisers and internet service providers to stop working with a service.
• Fees: providers with qualifying worldwide revenue at or above £250 million pay annual fees unless UK referable revenue is below £10 million; 2026/27 is the first charging year, based on calendar year 2024 revenue. Ofcom gives an indicative tariff of 0.02% to 0.03%.
• Enforcement programmes: Ofcom runs targeted programmes, including one on age assurance, and uses information notices to request risk assessment records. Missing or thin records are the easiest failing for a regulator to prove.

What it means for AI agents and non-human identities

The Act is technology neutral, so a generative AI feature that lets users share content with other users, or a chatbot that searches the web, can bring a service into scope. Ofcom's register lists a generative AI search feature under Category 2A, which shows the regulator applies the categories to AI products. Four practical consequences follow.

• AI features are significant changes: adding a chatbot, an AI image generator or agent-driven posting to a user-to-user service is a design change that triggers a fresh risk assessment under section 9(4) and, where children use the service, under the children's duties. See the AI Risk Assessment Guide.
• Bots are users of the service: automated accounts that post scam content, spam or abuse at scale are a risk factor your assessment must address. Bot detection and sign-up controls are evidence of proportionate measures. See the Bot Management Guide and the Fake Account Creation and Sign-up Fraud Guide.
• Moderation pipelines run on machine credentials: hash matching, classifiers and reporting integrations use service accounts and API keys with access to the most sensitive content a platform holds, including child abuse material queues and identity documents from age checks. Scope, rotate and log those credentials as privileged non-human identities. See the Agent Identity and Access Guide.
• Proactive technology must be disclosed: sections 10(7) and 12(12) require terms of service to describe automated detection tools. Keep an inventory of every model and agent used for compliance, with its owner, purpose and accuracy testing.

Age checks and identity verification create new stores of identity data, so data protection law applies alongside the Act. See the UK GDPR and Data Protection Act 2018 Guide.

Compliance steps

1. Map services and features. List every product surface where users share content or where search results appear, including AI features, embedded chat and community areas. Decide which are in scope and record the reasoning.
2. Check categorisation. Compare average monthly active UK users and functionality against SI 2025/226 and the Ofcom register. Plan as if categorised if you sit on the emerging Category 1 list.
3. Refresh the illegal content risk assessment. Work through each priority offence separately, score likelihood and impact against Ofcom's risk profiles, and tie each finding to a code measure or a documented alternative.
4. Run the children's access and risk assessments. Where children are likely to access the service, decide which content must be blocked behind highly effective age assurance and test the chosen method against Ofcom's criteria.
5. Build the takedown and reporting machinery. Measure time to takedown, add the 48-hour intimate image workflow, connect CSEA reporting to the NCA, and keep complaint and appeal routes easy to find.
6. Harden the identity layer. Protect moderator and admin consoles with phishing-resistant MFA, restrict access to sensitive queues, and secure the service accounts behind classifiers, hash matching and age assurance vendors. See the Account Takeover Prevention Guide.
7. Update terms of service. Describe the protections and every proactive technology used, and publish risk assessment summaries if you are Category 1 or 2A.
8. Keep the evidence pack. Store assessments, decisions, metrics and test results so they can be produced quickly in response to an Ofcom information notice. See the Trust and Safety Operations guide for running the function day to day.

Measuring it

Framework mapping

Practitioner checklist

• Record every in-scope service and feature, with the reasoning, and re-check after each launch.
• Confirm category status against SI 2025/226 and Ofcom's register, including the emerging Category 1 list.
• Hold a current illegal content risk assessment that treats each priority offence separately.
• Re-assess before significant changes, including new AI features and agent integrations.
• Complete children's access and risk assessments and test age assurance against Ofcom's list of capable methods.
• Track takedown times and meet the 48-hour limit for reported intimate image content.
• Disclose proactive technology in terms of service and keep its accuracy testing on file.
• Treat moderation, hash matching and age assurance integrations as privileged non-human identities.
• Check fees notification obligations each year against the £250 million threshold.
• Assign an owner to track Ofcom's final statements on additional duties, and check Ofcom's current timetable.

Standards and references

• legislation.gov.uk: Online Safety Act 2023, section 9 (illegal content risk assessment duties)
• legislation.gov.uk: Online Safety Act 2023, section 10 (safety duties about illegal content)
• legislation.gov.uk: Online Safety Act 2023, section 12 (safety duties protecting children)
• legislation.gov.uk: Online Safety Act 2023, Schedule 13 (penalties)
• Ofcom: An update on online safety implementation plans
• Ofcom: Register of categorised services and list of emerging Category 1 services
• Ofcom: Age assurance duties under the Online Safety Act
• GOV.UK: Online Safety Act explainer

Related NHI Mgmt Group resources: Age Assurance Guide · UK Online Safety Act Fraud Duties Guide · Trust and Safety Operations · Bot Management Guide. This guide summarises the UK Online Safety Act 2023 and Ofcom's published codes and timetable as checked on 8 November 2026 and is not legal advice.