UK Online Safety Act Compliance

Start by deciding whether the service is in scope and which illegal-content, children-safety, age-assurance, user-empowerment, transparency, complaints, risk-assessment, or Ofcom enforcement duty is triggered. The answer should clearly name the trigger, affected product or process, required action, owner, evidence, and escalation point.

Keep the Online Safety Act source, service-scope decision, user-to-user/search feature map, risk assessment, code-of-practice mapping, age-assurance evidence, and Ofcom-facing record together.

Ownership should sit with the team that can change service design, moderation, recommender systems, age assurance, reporting, complaints, terms, or transparency data, with legal and trust-safety review.

Evidence should show service categorisation, illegal-content risk assessment, children access assessment, children risk assessment, mitigation controls, age-assurance decisions, terms/complaints records, and Ofcom reporting readiness.

Most Online Safety Act mistakes happen at the boundary between user-to-user, search, pornography, category, child-access, illegal-content, and transparency duties.

Use this section before launching a user feature, recommender change, moderation change, age-assurance flow, complaint process, or transparency-reporting process.

Use an Online Safety Act workflow that captures service scope, user groups, risk assessment, code mapping, child-access status, mitigation owner, evidence, and Ofcom escalation path.

The workflow should produce the service-scope memo, risk assessment, children access assessment, mitigation plan, age-assurance decision, complaint workflow, or transparency-report evidence pack.