Business guidance

Technology & Digital

Age verification for online services

The Online Safety Act 2023 requires online services to use age verification or age assurance to protect children from harmful content, and pornography services must stop children reaching it. Ofcom regulates the content duties and the Information Commission (formerly the ICO) the data protection side, including its Children's Code, so age checks must also respect privacy.

Technology & Digital

AI Regulation Framework

The UK has no single AI law: regulators such as the Information Commission (formerly the ICO), FCA, CMA and Ofcom apply five shared principles in their own areas. Since 5 February 2026, people subject to significant automated decisions have the right to human intervention, to give their view and to contest the decision.

Technology & Digital

App store and digital platform regulation

The Digital Markets, Competition and Consumers Act 2024 lets the CMA designate large digital platforms with Strategic Market Status where they have entrenched market power and turnover above £25 billion globally or £1 billion in the UK. A designation lasts 5 years and brings conduct requirements, such as trading on fair terms.

Technology & Digital

Children's safety duties under the Online Safety Act

If children are likely to access your online service, the Online Safety Act's children's safety duties apply on top of the illegal content duties. Assess risks to children by age group, and protect them from content that is legal for adults but harmful to them, such as self-harm or eating disorder material.

Technology & Digital

Conduct a children's access assessment

Every regulated online service must assess under section 37 of the Online Safety Act whether children, meaning anyone under 18, are likely to access it. Unless you can show children are effectively prevented from accessing it, assume they can. If children are likely to use the service, the full children's safety duties apply.

Technology & Digital

Conduct an illegal content risk assessment

Every user-to-user and search service regulated by the Online Safety Act must carry out a suitable and sufficient illegal content risk assessment, covering each kind of priority illegal content in Schedule 7. Map your features, users and existing safety measures, record the assessment, and update it before any significant change to your service.

Technology & Digital

Consumer rights compliance for digital content sellers

Your legal obligations under the Consumer Rights Act 2015 and Consumer Contracts Regulations 2013 when selling software, apps, games, music, video, e-books, or other digital content to consumers.

Technology & Digital

Cryptoasset Business Regulation

Regulatory requirements for cryptoasset businesses in the UK - how token classification determines whether you need full FCA authorisation or Money Laundering Regulations registration only.

Technology & Digital

Cyber Essentials Certification

Government-backed scheme helping organisations guard against common cyber attacks. Required for many government contracts involving handling of sensitive information.

Technology & Digital

Data processing, hosting and web portal rules

Most small hosting and data-processing businesses are outside the NIS Regulations and the Online Safety Act. NIS applies only to cloud, search and marketplace services with 50 or more staff or over €10 million turnover. The Online Safety Act applies if your users can share content with each other.

Technology & Digital

E-commerce regulations for online selling

Legal requirements for selling online - including consumer contracts, pre-contract information, cancellation rights, and digital content regulations.

Technology & Digital

Electronic Communications Code

Rights and obligations for communications network operators to install and maintain electronic communications apparatus on public and private land.

Technology & Digital

Export Control (Dual-Use Technology)

You need a licence to export goods, software or technology on the UK Strategic Export Control Lists, including transfers by email or remote access from abroad. Unlisted items can still need one if you suspect a military or WMD end use, and exporting without a licence can mean up to 10 years in prison.

Technology & Digital

General Authorisation for Electronic Communications Services

Any provider of electronic communications services or networks in the UK operates under a general authorisation regime. No individual licence required, but providers must comply with general conditions.

Technology & Digital

Get written authorisation before testing a computer system

Accessing or interfering with a computer system without the consent of whoever controls it is a criminal offence under the Computer Misuse Act 1990, however good your intentions. Before any penetration test, vulnerability scan or bug bounty work, get the owner's written permission and stay within it.

Technology & Digital

Implement age assurance on your platform

If children are likely to access your service, the Online Safety Act requires effective age assurance, and services publishing pornography must use highly effective age verification or estimation so children cannot normally encounter it. Choose methods that suit your risks, check providers carefully, and collect no more personal data than you need.

Technology & Digital

Meet your telecommunications regulatory duties

You must notify Ofcom before you start providing a public electronic communications network or service, and then follow its General Conditions. Radio transmitters need a spectrum licence unless they use a licence-exempt band, and you must take the required security measures.

Technology & Digital

Notify Ofcom and pay Online Safety Act fees

Ofcom funds its online safety work through annual fees from regulated services, based on qualifying worldwide revenue. Check whether your user-to-user or search service is in scope and which category it falls into, then work out whether your revenue makes you liable to notify Ofcom and pay fees.

Technology & Digital

Print and periodical publishing rules

If you publish books, newspapers, journals or directories — in print or online — three duties apply on top of the rules every publisher shares: you must deposit copies of what you publish with the legal deposit libraries, meet consumer subscription and cancellation rules, and (for directories and mailing lists) handle personal data lawfully.

Technology & Digital

Privacy and Electronic Communications Regulations

PECR sits alongside UK GDPR and gives specific privacy rights relating to electronic communications, including marketing calls, emails, texts, cookies, and traffic data.

Technology & Digital

Protecting Your Software Intellectual Property

Your source code is protected by copyright automatically, at no cost. A patent, lasting up to 20 years, is available only where software makes a technical contribution, which is a high bar in the UK, and registering trademarks protects your brand and product names.

Technology & Digital

Radio Equipment Regulations

Equipment that intentionally transmits or receives radio waves for communication or radio determination must comply with Radio Equipment Regulations, including IoT devices, WiFi equipment, and Bluetooth products.

Technology & Digital

Rules for news agencies and information services

Copying other publishers' content for media monitoring, press clipping or aggregation needs their permission. A news agency owns the copyright in what it creates and licenses it to subscribers, and joining a press regulator is voluntary.

Technology & Digital

Set up content moderation to meet Online Safety Act requirements

Every service regulated by the Online Safety Act must have proportionate systems to stop users encountering illegal content, and to protect children where they are likely to use it. Base your moderation on your illegal content risk assessment, combining automated tools, trained human moderators, easy user reporting and records of every decision.

Technology & Digital

Software and AI as medical devices (SaMD/AIaMD)

Software with a medical purpose, such as diagnosing, monitoring or treating disease, is a medical device in its own right and must be registered with the MHRA before going on the Great Britain market. Many such products are Class I now, but most are expected to move to at least Class IIa.

Technology & Digital

Software and video-game publishing rules

Video games that are not exempt must be classified before supply, and supplying an unrated game is a criminal offence. Your software is protected by copyright automatically, and a game with chat or user uploads may have Online Safety Act duties.

Technology & Digital

Software licensing compliance

Understand your legal obligations when using, developing, or distributing software - including open source licensing, commercial agreements, and intellectual property protection.

Technology & Digital

Write terms of service that meet Online Safety Act requirements

Under the Online Safety Act 2023, your terms of service must explain clearly how you deal with illegal and harmful content, and you must apply them consistently. Set out prohibited content, enforcement action, how to report content and how to complain. Ofcom can act if your terms do not match your moderation in practice.

Tax & Finance

Check if you need to register for VAT

You must register for VAT when your taxable turnover passes the registration threshold in any rolling 12 months, or when you expect it to pass the threshold within the next 30 days alone. Under the first test, register within 30 days of the end of the month. Late registration brings penalties and backdated VAT.

Compliance & Legal

File your confirmation statement

File a confirmation statement every 12 months, within 14 days after your review period ends. Filing late is a criminal offence for the company and its officers.

Premises & Operations

Meet your business waste duty of care

Every business that produces, stores or disposes of waste has a duty of care under section 34 of the Environmental Protection Act 1990, and stays responsible after it hands the waste on. Use only registered waste carriers, complete waste transfer notes correctly, and follow the stricter rules for hazardous waste.

Compliance & Legal

Verify your identity for Companies House as a director or PSC

Yes, if you are an individual director or PSC of a UK company, or an individual director of an overseas company registered in the UK. Corporate directors and officers of corporate PSCs are not yet required to verify. The transition for existing directors and PSCs ends on 17 November 2026.