UK Online Safety Act Compliance Program

Each regulated service or service part should have a named accountable owner, a legal contact, a moderation or trust and safety lead, and a product lead. A central policy team alone is not enough because the Act works through service functionality and service-specific risk.

This also makes reassessment after launches or incidents much faster.

Illegal content duties, child access duties, child safety duties, terms duties, and category duties should each trace back to an assessed risk or a direct statutory trigger. This prevents over-control in low-risk areas and under-control in high-risk areas.

The program should also show where ICO child-data controls intersect with child safety controls.

Ofcom and internal reviewers will ask for evidence. That means the program should routinely test whether the service can produce scope decisions, assessments, moderation metrics, complaints records, and action logs quickly and coherently.

If the evidence cannot be retrieved or explained, the control is weaker than it looks.