Topic

Digital & Technology

Digital tools, cyber security, and technology adoption

Cyber Security

Cyber security basics for small businesses

Most cyber attacks on small businesses can be prevented cheaply. Put the five Cyber Essentials controls in place: firewalls, secure settings, access control, malware protection and prompt software updates. Then train staff to spot phishing, where most successful attacks begin.

Meet your cyber resilience duties as a financial services firm

UK financial services firms are held to cyber security through operational resilience, outsourcing, accountability and incident reporting rules. In-scope firms must be able to stay within their impact tolerances during a cyber attack, name an accountable senior manager and tell the FCA about material incidents.

Online Safety Act duties for online services

If your service lets users share content with each other or lets people search the internet, the Online Safety Act 2023 requires you to assess and reduce the risk of illegal content and, if children are likely to use it, protect them. Ofcom can fine up to £18 million or 10% of qualifying worldwide revenue.

Implement age assurance on your platform

If children are likely to access your service, the Online Safety Act requires effective age assurance, and services publishing pornography must use highly effective age verification or estimation so children cannot normally encounter it. Choose methods that suit your risks, check providers carefully, and collect no more personal data than you need.

IoT product security compliance (PSTI Act)

Since 29 April 2024, consumer connectable products sold in the UK must meet three security requirements under the PSTI Act. Manufacturers, importers and distributors each have duties, and breaches can cost up to £10 million or 4% of qualifying worldwide revenue.

Meet your duties under the NIS Regulations

You are covered if you provide an essential service in energy, transport, health, drinking water or digital infrastructure above set thresholds, or run an online marketplace, search engine or cloud computing service. You must secure your systems and report significant incidents within 72 hours. Penalties reach £17 million.

Get written authorisation before testing a computer system

Accessing or interfering with a computer system without the consent of whoever controls it is a criminal offence under the Computer Misuse Act 1990, however good your intentions. Before any penetration test, vulnerability scan or bug bounty work, get the owner's written permission and stay within it.

Conduct a children's access assessment

Every regulated online service must assess under section 37 of the Online Safety Act whether children, meaning anyone under 18, are likely to access it. Unless you can show children are effectively prevented from accessing it, assume they can. If children are likely to use the service, the full children's safety duties apply.

Conduct an illegal content risk assessment

Every user-to-user and search service regulated by the Online Safety Act must carry out a suitable and sufficient illegal content risk assessment, covering each kind of priority illegal content in Schedule 7. Map your features, users and existing safety measures, record the assessment, and update it before any significant change to your service.

Children's safety duties under the Online Safety Act

If children are likely to access your online service, the Online Safety Act's children's safety duties apply on top of the illegal content duties. Assess risks to children by age group, and protect them from content that is legal for adults but harmful to them, such as self-harm or eating disorder material.

Get Cyber Essentials certified

Cyber Essentials is mandatory for many government contracts involving personal data or ICT services. For the basic level, you complete an online self-assessment with an IASME-accredited certification body, and you must renew the certificate every 12 months.

Set up content moderation to meet Online Safety Act requirements

Every service regulated by the Online Safety Act must have proportionate systems to stop users encountering illegal content, and to protect children where they are likely to use it. Base your moderation on your illegal content risk assessment, combining automated tools, trained human moderators, easy user reporting and records of every decision.

Write terms of service that meet Online Safety Act requirements

Under the Online Safety Act 2023, your terms of service must explain clearly how you deal with illegal and harmful content, and you must apply them consistently. Set out prohibited content, enforcement action, how to report content and how to complain. Ofcom can act if your terms do not match your moderation in practice.

Notify Ofcom and pay Online Safety Act fees

Ofcom funds its online safety work through annual fees from regulated services, based on qualifying worldwide revenue. Check whether your user-to-user or search service is in scope and which category it falls into, then work out whether your revenue makes you liable to notify Ofcom and pay fees.

Digital Tools

E-commerce and digital exporting

Selling internationally through online marketplaces, understanding distance selling regulations, and VAT obligations.

Telecommunications

Electronic Communications Code

Rights and obligations for communications network operators to install and maintain electronic communications apparatus on public and private land.

General Authorisation for Electronic Communications Services

Any provider of electronic communications services or networks in the UK operates under a general authorisation regime. No individual licence required, but providers must comply with general conditions.

Software & AI

AI Regulation Framework

The UK has no single AI law: regulators such as the Information Commission (formerly the ICO), FCA, CMA and Ofcom apply five shared principles in their own areas. Since 5 February 2026, people subject to significant automated decisions have the right to human intervention, to give their view and to contest the decision.

Export Control (Dual-Use Technology)

You need a licence to export goods, software or technology on the UK Strategic Export Control Lists, including transfers by email or remote access from abroad. Unlisted items can still need one if you suspect a military or WMD end use, and exporting without a licence can mean up to 10 years in prison.

Software licensing compliance

Understand your legal obligations when using, developing, or distributing software - including open source licensing, commercial agreements, and intellectual property protection.

Cyber Essentials Certification

Government-backed scheme helping organisations guard against common cyber attacks. Required for many government contracts involving handling of sensitive information.