Comply with the Online Safety Act from scratch

Before taking any compliance action, understand how the Act works, who it applies to, and what Ofcom expects. The OSA creates different duties for different platform categories, so understanding the framework helps you identify exactly what applies to your service.

The OSA creates three categories of regulated service based on UK user numbers and platform features. Your category determines which duties apply beyond the baseline illegal content obligations that all services share. Services below all thresholds still have illegal content duties.

Every regulated service must assess how it could be used to commit or facilitate priority illegal content offences. This written assessment must be retained for Ofcom inspection and reviewed annually or when your service changes significantly.

All regulated services must assess whether children are likely to access the service. Until you complete this assessment, your service is treated as if children can access it, triggering the full set of children's safety duties.

If children are likely to access your service, you must conduct a separate children's risk assessment, implement age assurance, and apply children's safety duties. These are among the most detailed and scrutinised obligations under the Act.

Your risk assessment findings must translate into proportionate content moderation systems. Ofcom's codes of practice set out recommended measures based on your service type, size, and risk profile.

Your terms of service must clearly state what content is prohibited, how policies are enforced, and how users can report content and complain. Selective or inconsistent enforcement is itself a contravention.

If your children's access assessment concluded that children are likely to access your service, you must implement age assurance. The method you choose must be proportionate and privacy-preserving, and pornography services require robust age verification.

There is no general duty to register with Ofcom. Services whose qualifying worldwide revenue meets the threshold must notify Ofcom and pay annual fees. Check Ofcom's online safety fees page for the current notification window.

Use the compliance checklist to confirm you have addressed every major obligation. The OSA requires ongoing review: risk assessments must be updated annually, and terms of service must be applied consistently.