Sector
Technology & Digital
Software, IT services, digital products, telecoms and tech startups.
Start here
See all 8Comply with the Online Safety Act from scratch
If users can encounter each other's content on your service
Online Safety Act compliance quick check
For platforms already in scope of the Online Safety Act
Start a tech business
The onboarding route for a new tech business
Export controlled goods and dual-use items
If you ship hardware, encryption or dual-use technology overseas
Respond to an Ofcom investigation
Contacted by Ofcom? Start here
Who regulates you
See all 19Ofcom (opens in a new tab)
Regulates telecoms, TV, radio, video-on-demand, postal services, and online safety. Issues licences for telecoms providers, manages spectrum. Now enforces Online Safety Act duties for …
Enforces 9 Acts this sector relies on.
ICO (opens in a new tab)
Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. All businesses …
Enforces 7 Acts this sector relies on.
Trading Standards (opens in a new tab)
Enforces consumer protection legislation including food labelling, weights and measures, product safety, and fair trading. Part of local authority structure. Investigates food labelling breaches.
Enforces 7 Acts this sector relies on.
CMA (opens in a new tab)
Promotes competitive markets and tackles unfair behaviour. Investigates mergers, enforces competition law, and has specific digital markets powers. Digital Markets Unit (DMU) designates Strategic …
Enforces 6 Acts this sector relies on.
FCA (opens in a new tab)
Regulation of financial services firms and markets. Supervises banks, insurers, investment firms, payment services, and cryptoasset businesses. Issues authorisations and enforces conduct rules.
Enforces 5 Acts this sector relies on.
BBFC (opens in a new tab)
Classifies films, videos, and some video games for age rating. Statutory authority for classifying cinema releases and video works under the Video Recordings Act …
Enforces 4 Acts this sector relies on.
Key legislation
See all 32What’s changing
Electronic Communications Code tribunal jurisdiction conferral — First-tier Tribunal for LTA 1954 Code-rights tenancy disputes from 30 July 2026
Ofcom publishes categorisation register for Online Safety Act (July 2026)
General rules
Common requirements that apply across industries. Conditions such as employing people or operating premises are shown only after they are known.
Meet your business waste duty of care
Every business that produces, stores or disposes of waste has a duty of care under section 34 of the Environmental Protection Act 1990, and stays responsible after it hands the waste on. Use only registered waste carriers, complete waste transfer notes correctly, and follow the stricter rules for hazardous waste.
Applies across industries.
General ruleFile your confirmation statement
File a confirmation statement every 12 months, within 14 days after your review period ends. Filing late is a criminal offence for the company and its officers.
Applies across industries.
General ruleVerify your identity for Companies House as a director or PSC
Yes, if you are an individual director or PSC of a UK company, or an individual director of an overseas company registered in the UK. Corporate directors and officers of corporate PSCs are not yet required to verify. The transition for existing directors and PSCs ends on 17 November 2026.
Applies across industries.
General ruleCheck if you need to register for VAT
You must register for VAT when your taxable turnover passes the registration threshold in any rolling 12 months, or when you expect it to pass the threshold within the next 30 days alone. Under the first test, register within 30 days of the end of the month. Late registration brings penalties and backdated VAT.
Applies across industries.
All guidance for technology & digital
Compliance & Legal
6
Privacy and Electronic Communications Regulations
PECR sits alongside UK GDPR and gives specific privacy rights relating to electronic communications, including marketing calls, emails, texts, cookies, and traffic data.
Relevant across several parts of this sector.
Print and periodical publishing rules
If you publish books, newspapers, journals or directories — in print or online — three duties apply on top of the rules every publisher shares: you must deposit copies of what you publish with the legal deposit libraries, meet consumer subscription and cancellation rules, and (for directories and mailing lists) handle personal data lawfully.
Relevant to a specific activity in this sector.
Meet your telecommunications regulatory duties
You must notify Ofcom before you start providing a public electronic communications network or service, and then follow its General Conditions. Radio transmitters need a spectrum licence unless they use a licence-exempt band, and you must take the required security measures.
Relevant to a specific activity in this sector.
Data processing, hosting and web portal rules
Most small hosting and data-processing businesses are outside the NIS Regulations and the Online Safety Act. NIS applies only to cloud, search and marketplace services with 50 or more staff or over €10 million turnover. The Online Safety Act applies if your users can share content with each other.
Relevant to a specific activity in this sector.
Rules for news agencies and information services
Copying other publishers' content for media monitoring, press clipping or aggregation needs their permission. A news agency owns the copyright in what it creates and licenses it to subscribers, and joining a press regulator is voluntary.
Relevant to a specific activity in this sector.
Software and video-game publishing rules
Video games that are not exempt must be classified before supply, and supplying an unrated game is a criminal offence. Your software is protected by copyright automatically, and a game with chat or user uploads may have Online Safety Act duties.
Relevant to a specific activity in this sector.
Digital & Technology
8
AI Regulation Framework
The UK has no single AI law: regulators such as the Information Commission (formerly the ICO), FCA, CMA and Ofcom apply five shared principles in their own areas. Since 5 February 2026, people subject to significant automated decisions have the right to human intervention, to give their view and to contest the decision.
Relevant across several parts of this sector.
Software licensing compliance
Understand your legal obligations when using, developing, or distributing software - including open source licensing, commercial agreements, and intellectual property protection.
Relevant across several parts of this sector.
Export Control (Dual-Use Technology)
You need a licence to export goods, software or technology on the UK Strategic Export Control Lists, including transfers by email or remote access from abroad. Unlisted items can still need one if you suspect a military or WMD end use, and exporting without a licence can mean up to 10 years in prison.
Relevant across several parts of this sector.
Get written authorisation before testing a computer system
Accessing or interfering with a computer system without the consent of whoever controls it is a criminal offence under the Computer Misuse Act 1990, however good your intentions. Before any penetration test, vulnerability scan or bug bounty work, get the owner's written permission and stay within it.
Relevant across several parts of this sector.
Implement age assurance on your platform
If children are likely to access your service, the Online Safety Act requires effective age assurance, and services publishing pornography must use highly effective age verification or estimation so children cannot normally encounter it. Choose methods that suit your risks, check providers carefully, and collect no more personal data than you need.
Relevant across several parts of this sector.
Children's safety duties under the Online Safety Act
If children are likely to access your online service, the Online Safety Act's children's safety duties apply on top of the illegal content duties. Assess risks to children by age group, and protect them from content that is legal for adults but harmful to them, such as self-harm or eating disorder material.
Relevant across several parts of this sector.
Set up content moderation to meet Online Safety Act requirements
Every service regulated by the Online Safety Act must have proportionate systems to stop users encountering illegal content, and to protect children where they are likely to use it. Base your moderation on your illegal content risk assessment, combining automated tools, trained human moderators, easy user reporting and records of every decision.
Relevant across several parts of this sector.
Conduct a children's access assessment
Every regulated online service must assess under section 37 of the Online Safety Act whether children, meaning anyone under 18, are likely to access it. Unless you can show children are effectively prevented from accessing it, assume they can. If children are likely to use the service, the full children's safety duties apply.
Relevant across several parts of this sector.
Show 6 more
Conduct an illegal content risk assessment
Every user-to-user and search service regulated by the Online Safety Act must carry out a suitable and sufficient illegal content risk assessment, covering each kind of priority illegal content in Schedule 7. Map your features, users and existing safety measures, record the assessment, and update it before any significant change to your service.
Relevant across several parts of this sector.
Notify Ofcom and pay Online Safety Act fees
Ofcom funds its online safety work through annual fees from regulated services, based on qualifying worldwide revenue. Check whether your user-to-user or search service is in scope and which category it falls into, then work out whether your revenue makes you liable to notify Ofcom and pay fees.
Relevant across several parts of this sector.
Write terms of service that meet Online Safety Act requirements
Under the Online Safety Act 2023, your terms of service must explain clearly how you deal with illegal and harmful content, and you must apply them consistently. Set out prohibited content, enforcement action, how to report content and how to complain. Ofcom can act if your terms do not match your moderation in practice.
Relevant across several parts of this sector.
Cyber Essentials Certification
Government-backed scheme helping organisations guard against common cyber attacks. Required for many government contracts involving handling of sensitive information.
Relevant across several parts of this sector.
Electronic Communications Code
Rights and obligations for communications network operators to install and maintain electronic communications apparatus on public and private land.
Relevant to a specific activity in this sector.
General Authorisation for Electronic Communications Services
Any provider of electronic communications services or networks in the UK operates under a general authorisation regime. No individual licence required, but providers must comply with general conditions.
Relevant to a specific activity in this sector.
Sector-Specific
8
E-commerce regulations for online selling
Legal requirements for selling online - including consumer contracts, pre-contract information, cancellation rights, and digital content regulations.
Relevant across several parts of this sector.
Cryptoasset Business Regulation
Regulatory requirements for cryptoasset businesses in the UK - how token classification determines whether you need full FCA authorisation or Money Laundering Regulations registration only.
Relevant across several parts of this sector.
Consumer rights compliance for digital content sellers
Your legal obligations under the Consumer Rights Act 2015 and Consumer Contracts Regulations 2013 when selling software, apps, games, music, video, e-books, or other digital content to consumers.
Relevant across several parts of this sector.
App store and digital platform regulation
The Digital Markets, Competition and Consumers Act 2024 lets the CMA designate large digital platforms with Strategic Market Status where they have entrenched market power and turnover above £25 billion globally or £1 billion in the UK. A designation lasts 5 years and brings conduct requirements, such as trading on fair terms.
Relevant across several parts of this sector.
Radio Equipment Regulations
Equipment that intentionally transmits or receives radio waves for communication or radio determination must comply with Radio Equipment Regulations, including IoT devices, WiFi equipment, and Bluetooth products.
Relevant across several parts of this sector.
Age verification for online services
The Online Safety Act 2023 requires online services to use age verification or age assurance to protect children from harmful content, and pornography services must stop children reaching it. Ofcom regulates the content duties and the Information Commission (formerly the ICO) the data protection side, including its Children's Code, so age checks must also respect privacy.
Relevant across several parts of this sector.
Distance and off-premises selling requirements
When you sell to consumers online, by phone or at their home, you must give them set information before they buy and let them cancel within 14 days for any reason. Since 6 April 2025, the CMA can fine you up to 10% of global turnover for breaches.
Applies if you sell or provide services at a distance - online, by phone or by mail order
Software and AI as medical devices (SaMD/AIaMD)
Software with a medical purpose, such as diagnosing, monitoring or treating disease, is a medical device in its own right and must be registered with the MHRA before going on the Great Britain market. Many such products are Class I now, but most are expected to move to at least Class IIa.
Relevant across several parts of this sector.
All journeys
Start a tech business
Launch a software, digital services, or technology startup
Comply with the Online Safety Act from scratch
A complete learning path for platform operators new to the Online Safety Act 2023. Covers understanding the Act, …
Respond to an Ofcom investigation
What to do when Ofcom takes enforcement action against your online service under the Online Safety Act 2023. …
Online Safety Act compliance quick check
Rapid compliance self-assessment for experienced operators: confirm scope, verify risk assessments, check content moderation, terms of service, complaints, …
Set up an IT and programming business
For new IT, programming and consultancy businesses. Put the duties every employer shares in place, manage screen work, …
Set up an information service business
A step-by-step path for setting up an information service business — a data-processing or hosting provider, a cloud …
Set up a publishing business
Set up a publishing business of any kind: a book imprint, a magazine or newspaper, a directory, or …
Set up a telecommunications business
For new telecommunications businesses. Put the employer duties in place for field work at height, near electricity and …
Subsectors
SIC 2007 divisions covered by this sector.