- Status
- Amended (in force with amendments)
- Penalty ceiling
- Imprisonment 18 of 125 obligations carry an unlimited fine. 26 carry different penalties and 81 have no criminal penalty — flagged in the list below.
Does it bind you?
Business-side roles with duties under this instrument.
Plus 40 duties on the regulator, Crown ministers and public bodies — folded into the section list below.
Other Acts binding the same actors
If a role above is yours, these are the other instruments that most often bind it.
Any Person — also bound by 2340 other Acts
Director or Officer — also bound by 429 other Acts
Data Controller — also bound by 35 other Acts
What it requires
Sections creating concrete business duties or carrying penalties, grouped as the instrument is structured. Titles link to the source text — blue means you’re leaving for legislation.gov.uk.
Introduction
0 of 2 sections shown2 other sections in this Part — procedural and definitional
Key definitions
0 of 3 sections shown3 other sections in this Part — procedural and definitional
Providers of regulated user-to-user services and regulated search services: duties of care
19 of 58 sections shown- Assess and mitigate risks for user-to-user online servicesAny Person
- Carry out and maintain illegal content risk assessmentsAny Person
- Prevent and remove illegal content on your online serviceAny Person
- Assess and report risks to children on your online serviceAny Person
- Protect children from harmful online content and update terms of serviceAny Person
- Assess user empowerment for Category 1 online servicesAny Person
- Provide adult user empowerment and content control featuresAny Person
- Comply with search service duties of careAny Person
- Assess illegal content risks for your search serviceAny Person
- Carry out and maintain children’s risk assessments for search servicesAny Person
- Protect children from harmful content in search servicesAny Person
Fine up to £18,000,000
- Assess if children are likely to access your online serviceAny Person
- Commit fraud or related financial offencesAny Person
Unlimited fine
Other duties (1) — Crown / regulator
- Ofcom must issue codes of practice for online safety dutiesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must publish and update Online Safety codes of practiceStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom and courts must consider codes of practice in legal proceedingsStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must provide guidance on user empowerment and content dutiesStatutory regulator
Other duties (1) — Crown / regulator
- OFCOM must publish guidance on content harmful to childrenStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must review and report on content harmful to childrenStatutory regulator
39 other sections in this Part — procedural and definitional
Other duties of providers of regulated user-to-user services and regulated search services
8 of 15 sections shownOther duties (1) — Crown / regulator
- Ofcom must provide guidance on user identity verificationStatutory regulator
- Report Child Sexual Exploitation and Abuse (CSEA) content to the NCAAny Person
- Only moderate or ban users in line with your published terms of serviceAny Person
- Maintain transparent terms of service and complaint proceduresAny Person
Other duties (1) — Crown / regulator
- Ofcom must provide guidance for Category 1 online service providersStatutory regulator
- Establish procedures for deceased child users' data requestsAny Person
- Produce and publish annual online safety transparency reportsAny Person
Other duties (1) — Crown / regulator
- Ofcom must publish guidance on transparency reporting requirementsStatutory regulator
7 other sections in this Part — procedural and definitional
Duties of providers of regulated services: certain pornographic content
3 of 4 sections shown- Protect UK users from pornographic content on your internet serviceAny Person
- Use effective age verification for pornographic contentAny Person
Other duties (1) — Crown / regulator
- Ofcom must provide guidance on age verification for pornographic contentStatutory regulator
1 other section in this Part — procedural and definitional
Duties of providers of regulated services: fees
1 of 8 sections shownOther duties (1) — Crown / regulator
- Secretary of State must issue and publish guidance on Ofcom feesCrown / Minister / Government department
7 other sections in this Part — procedural and definitional
OFCOM's powers and duties in relation to regulated services
73 of 77 sections shownOther duties (1) — Crown / regulator
- Ofcom must establish and publish a register of high-risk online servicesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must maintain and update the register of regulated online servicesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must identify and list 'emerging' Category 1 servicesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must maintain a register of risks and risk profiles for online servicesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must provide guidance on carrying out risk assessmentsStatutory regulator
- Name a senior manager in response to an Ofcom information noticeAny Person
- Cooperate with and pay for 'skilled person' reportsAny Person
- Cooperate fully with Ofcom investigationsAny Person
- Fail to comply with an information noticeAny Person
- Fail to comply with information notice or provide false/encrypted informationAny Person
2 years imprisonment · amended 5 times (opens in a new tab)
- Senior manager failing to prevent information offenceAny Person
- Fail to comply with audit noticeAny Person
- Fail to comply with Ofcom audit notice or supply false informationAny Person
- Obstruct, fail to comply or give false information to regulatorAny Person
- Obstruct or fail to comply with Ofcom information powersAny Person
- Commit an information offence under the Online Safety ActAny Person
- Fail to comply with Ofcom information requirements (serious offences)Any Person
2 years imprisonment · amended 4 times (opens in a new tab)
Other duties (1) — Crown / regulator
- Ofcom must protect intelligence service information from disclosureStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must issue a warning notice before ordering content technology useStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must include required content in technology notices under section 121Statutory regulator
Other duties (1) — Crown / regulator
- Ofcom must provide guidance on its Online Safety Act functionsStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must publish annual reports on online safety functions and technologyStatutory regulator
- Fail to comply with Ofcom confirmation decisionAny Person
Unlimited fine · amended 2 times (opens in a new tab)
- Fail to comply with Ofcom notice on terrorism or child sexual abuse contentAny Person
- Fail to comply with OFCOM notice under the Online Safety ActAny Person
Unlimited fine · amended 2 times (opens in a new tab)
Other duties (1) — Crown / regulator
- Ofcom must provide detailed reasons and rights when proposing or issuing finesStatutory regulator
- Breach of online safety or information dutiesAny Person
Unlimited fine · amended 2 times (opens in a new tab)
- Fail to comply with OFCOM enforcement action (business disruption order context)Any Person
Other duties (1) — Crown / regulator
- Ofcom must publish details of enforcement actions taken against businessesStatutory regulator
- Fail to comply with an enforcement publication noticeAny Person
Other duties (1) — Crown / regulator
- Ofcom must publish guidance on online safety enforcementStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must establish an advisory committee on disinformationStatutory regulator
amended 2 times
Other duties (1) — Crown / regulator
- Ofcom must report on freedom of expression and privacy protectionsStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must publish annual transparency reports on online safetyStatutory regulator
Other duties (1) — Crown / regulator
- OFCOM must report on online providers' reporting and complaints proceduresStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must report on children's safety and age assurance in app storesStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom may report on platform safety following a death investigationStatutory regulator
4 other sections in this Part — procedural and definitional
Appeals and super-complaints
5 of 5 sections shownOther duties (1) — Crown / regulator
- Secretary of State must set out super-complaint proceduresCrown / Minister / Government department
Other duties (1) — Crown / regulator
- Ofcom must provide guidance on the super-complaints processStatutory regulator
Secretary of State's functions in relation to regulated services
7 of 7 sections shownCommunications offences
13 of 13 sections shown- Send a false communication causing harmAny Person
- Send false online message intending harmAny Person
51 weeks imprisonment · amended 2 times (opens in a new tab)
- Send threatening communicationsAny Person
- Send threatening message (death or serious harm)Any Person
5 years imprisonment · amended 2 times (opens in a new tab)
- Send or display flashing images that could cause seizuresAny Person
- Send or show flashing images to harm someone with epilepsyAny Person
5 years imprisonment · amended 2 times (opens in a new tab)
- Encourage or assist serious self-harmAny Person
5 years imprisonment · amended 2 times (opens in a new tab)
- Corporate officer liability for online safety offencesDirector or Officer
- Officer liable for corporate online‑safety offencesDirector or Officer
- Send intimate genital image causing alarm or for sexual gratificationAny Person
- Send non-consensual explicit images or videosAny Person
Unlimited fine · amended 2 times (opens in a new tab)
- Share or threaten to share intimate images without consentAny Person
2 years imprisonment · amended 2 times (opens in a new tab)
Supplementary and general
37 of 37 sections shownOther duties (1) — Crown / regulator
- Ofcom must provide guidance on identifying illegal contentStatutory regulator
Other duties (1) — Crown / regulator
- Ofcom must publish first online safety guidance within 18 monthsStatutory regulator
- Liability for online safety fines for non-corporate providersAny Person
Unlimited fine · amended 2 times (opens in a new tab)
- Joint personal liability for online safety breachesAny Person
Unlimited fine · amended 2 times (opens in a new tab)
- Fail to comply with an Ofcom confirmation decisionAny Person
2 years imprisonment · amended 4 times (opens in a new tab)
- Corporate officers liable for company's Online Safety Act offencesDirector or Officer
- Personal liability for directors and officers for company safety breachesDirector or Officer
Unlimited fine · amended 4 times (opens in a new tab)
- Liability for unincorporated providers and their officersDirector or Officer
2 years imprisonment · amended 4 times (opens in a new tab)
- Violate online safety laws from outside the UKDirector or Officer
2 years imprisonment · amended 4 times (opens in a new tab)
Other duties (1) — Crown / regulator
- Ofcom must publish information in a way that reaches affected partiesStatutory regulator
amended 1 time
amended 2 times
amended 4 times
Interpretation and final provisions
16 of 16 sections shownSchedules
33 of 342 shownOther duties (1) — Crown / regulator
- Ofcom must follow specific principles and objectives when drafting safety codesStatutory regulator
- Complete first illegal content and children's access risk assessments on timeAny Person
- Complete Section 15(2) risk assessment within 3 months of guidanceAny Person
- Complete first illegal content risk assessment and children's access assessment within deadlinesAny Person
- Complete illegal content risk assessment and CAA within 3 monthsAny Person
- Complete Part 4B risk assessment within 3 months of guidanceAny Person
- Complete illegal content risk assessment and CAA within deadlinesAny Person
- Complete first illegal content risk assessment and CAA within 3 months of launchAny Person
- Complete illegal content risk assessment and CAA within 3 months of becoming a Part 3 serviceAny Person
- Complete children's risk assessment within 3 monthsAny Person
- Complete section 15(2) risk assessment within 3 months of becoming Category 1Data Controller
Other duties (1) — Crown / regulator
- Ofcom: ensure code measures align with online safety objectivesStatutory regulator
- Publish obscene material encouraging specified serious offencesAny Person
- Possess or distribute indecent images of childrenAny Person
Unlimited fine
- Attempt or conspire to commit a listed offence under the Online Safety ActAny Person
- Possess indecent images of a childAny Person
Unlimited fine
- Commit serious child sexual offencesAny Person
Unlimited fine
- Attempt or conspire to commit an online safety offenceAny Person
- Engage in threatening or abusive behaviour or stalking onlineAny Person
Unlimited fine
- Supply or offer to supply a psychoactive substanceAny Person
- Breach firearms licence and trading rulesAny Person
Unlimited fine
- Sell offensive weapons or knives to under-18sAny Person
Unlimited fine
- Use or sell air weapons without a certificate (Scotland)Any Person
- Engage in human trafficking (Scotland)Any Person
Unlimited fine
- Engage in human traffickingAny Person
Unlimited fine
- Make misleading statements or create misleading impressionsAny Person
- Attempt, conspire, or assist a Schedule 7 offenceAny Person
Other duties (1) — Crown / regulator
- Ofcom must consider service characteristics when deciding what information to require in a noticeStatutory regulator
Other duties (1) — Crown / regulator
- Secretary of State must set threshold conditions for online service categoriesCrown / Minister / Government department
Other duties (1) — Crown / regulator
- OFCOM must research and publish advice before threshold regulations are changedStatutory regulator
- Obstruct Ofcom officers or provide false informationAny Person
Unlimited fine
- Fail to comply with regulatory notice as controlling individualAny Person
Unlimited fine
- Include qualifying revenue breakdown for Part 4B services in OFCOM notificationAny Person
309 other schedules
Help complying
Guvnor’s practical routes through this instrument.
Comply with the Online Safety Act from scratch
A complete learning path for platform operators new to the Online Safety Act 2023. Covers understanding the Act, determining scope and platform …
Start using AI responsibly in your business
End-to-end learning path for businesses adopting AI: understanding the regulatory landscape, assessing obligations, setting up governance, managing specific risks around data, bias, …
AI compliance quick check
Rapid AI compliance self-assessment: identify AI systems, map to regulators, flag critical obligations, confirm key safeguards in place.
Online Safety Act compliance quick check
Rapid compliance self-assessment for experienced operators: confirm scope, verify risk assessments, check content moderation, terms of service, complaints, age assurance, and Ofcom …
Respond to an Ofcom investigation
What to do when Ofcom takes enforcement action against your online service under the Online Safety Act 2023. Covers identifying the type …
Responding to an AI regulatory investigation
What to do when a UK regulator investigates your AI system: ICO enforcement, FCA investigation, EHRC inquiry, CMA review. Covers immediate steps, …
Age verification for online services
How to implement age verification to comply with the Online Safety Act and ICO Children's Code. Covers verification methods, pornography requirements, privacy …
Children's safety duties under the Online Safety Act
Comprehensive guide to the children's safety duties under the Online Safety Act 2023. Covers what triggers the duties, risk assessment by age …
Conduct a children's access assessment
Step-by-step guide to assessing whether children are likely to access your online service under the Online Safety Act 2023. Covers the legal …
Conduct an illegal content risk assessment
Step-by-step guide to conducting the mandatory illegal content risk assessment under the Online Safety Act 2023. Covers how to identify risks from …
Implement age assurance on your platform
Practical guide to implementing age assurance on your online platform. Covers choosing between age verification and estimation, evaluating providers, privacy-preserving approaches, the …
Online Safety Act compliance checklist
Quick-check verification of your Online Safety Act compliance status. Covers scope assessment, risk assessments, content moderation, terms of service, complaints, age assurance, …
Online Safety Act penalties and enforcement powers
Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act 2023.
Online Safety Act: duties for online services
How to comply with the Online Safety Act 2023 if you operate a user-to-user service or search service. Covers service categories, illegal …
13 more guides that reference this instrument
Duty extraction and severity labels are Guvnor’s analysis of the instrument, not the instrument itself. Always verify against the linked source text.