Artifact GuideUKOfcom Enforcement

UK Online Safety Act Ofcom Enforcement

Ofcom can gather information, investigate suspected breaches, require remediation, impose penalties, and seek court orders that restrict a service in serious cases.

This guide explains the normal enforcement sequence, maximum penalty, notice-response evidence, and the limits of individual complaint handling.

Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
9

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Treat every Ofcom as a controlled legal and factual response. Confirm the recipient, power, scope, deadline, format, and responsible people; preserve records; and verify every answer. Ofcom has already used its Online Safety Act powers for illegal-content assessments, information requests, age assurance, and child-protection duties.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

How does an Ofcom investigation usually proceed?

Ofcom can use statutory information notices to obtain information needed for its online-safety functions. It can open an investigation where it suspects non-compliance. Its enforcement guidance describes a process that may lead to a , an opportunity for written and oral representations, and then a , a further provisional notice, settlement, or closure.

A can record a contravention, require steps to remedy it or comply with the obligation, and impose a financial penalty. Ofcom may also impose daily penalties in circumstances allowed by the Act. The specific process and available outcome depend on the requirement being enforced.

  • Log every notice, statutory basis, question, definition, deadline, submission channel, owner, reviewer, and dependency.
  • Preserve responsive documents and data, control queries and calculations, and retain the final response with approvals and delivery proof.
  • Correct identified errors promptly through the appropriate channel; do not silently change an earlier submission.
Citations
Question 2

What penalties and court orders are available?

For many enforceable requirements, the maximum financial penalty is the greater of GBP18 million or 10% of qualifying worldwide revenue. Schedule 13 contains the penalty framework, including how qualifying worldwide revenue is determined. The actual amount depends on the legal power, facts, seriousness, and Ofcom's penalty guidance.

In serious cases and subject to the statutory conditions, Ofcom can apply to the court for service-restriction or access-restriction orders directed at ancillary services or access facilities. These are court orders, not an automatic result of an investigation. Criminal offences also exist for specified information failures and related conduct; individual and senior-manager exposure depends on the exact offence and facts.

  • Do not describe the maximum as the expected fine or apply the 10% figure without the statutory revenue definition.
  • Escalate any suspected false statement, destruction or alteration of information, obstruction, or missed statutory deadline immediately.
  • Separate Ofcom's administrative decisions from orders that require a court application and judicial decision.
Citations
Question 3

What does enforcement readiness require?

Enforcement readiness is the ability to reproduce a compliance decision and answer a regulator accurately. Keep current scope analyses, risk assessments, code mappings or alternative-measure rationales, child-access and age-assurance records, terms, complaints evidence, transparency data definitions, governance approvals, incidents, tests, and change logs.

Ofcom does not resolve individual users' complaints or direct a service to remove or reinstate specific content. It can use complaints and other intelligence to identify systemic compliance issues. A provider therefore needs an internal complaints process that works and an evidence trail showing whether recurring failures were fed back into risk assessments and controls.

  • Run a notice-response tabletop using existing records without creating new facts after the event.
  • Name legal, trust and safety, engineering, analytics, privacy, finance, and executive contacts before a notice arrives.
  • Track remediation to verified completion and keep evidence that the deployed service changed.
Citations
Primary sources

References and citations

legislation.gov.uk
Referenced sections
  • Sets the maximum-penalty and qualifying-worldwide-revenue framework.
legislation.gov.uk
Referenced sections
  • Sets the service-restriction-order route and conditions.
legislation.gov.uk
Referenced sections
  • Provides Ofcom's power to require information for online-safety functions.
legislation.gov.uk
Referenced sections
  • Sets the access-restriction-order route and conditions.
legislation.gov.uk
Referenced sections
  • Creates specified offences relating to information notices.
Related guides

Explore more topics

Does the UK Online Safety Act apply to this service?
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How Ofcom and ICO duties overlap for online services
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
How to complete a children's access assessment
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
How to complete an illegal content risk assessment
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Is This a User-to-user or Search Service Under the UK Online Safety Act?
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Ofcom Transparency Reporting FAQ
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
Online Safety Act Children's Access Assessment
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Online Safety Act Complaints Handling Workflow
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Online Safety Act Illegal Content Risk Assessment
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Online Safety Act moderation, reporting, and complaints
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
Online Safety Act: User-to-user and Search Service Scope
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
UK Online Safety Act Age Assurance Options
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
UK Online Safety Act Age Assurance Requirements
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
UK Online Safety Act Age Assurance Selection Workflow
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
UK Online Safety Act Applicability Test Guide
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
UK Online Safety Act categories: thresholds and duties
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the July 2026 register means.
UK Online Safety Act Categorisation Guide
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register published in June 2026 and updated in July.
UK Online Safety Act Checklist
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
UK Online Safety Act Children's Safety Duties Guide
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
UK Online Safety Act Compliance Guide
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
UK Online Safety Act Content Moderation and Appeals Guide
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act Deadlines and Compliance Calendar Guide
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
UK Online Safety Act Enforcement and Penalties Guide
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
UK Online Safety Act FAQ: scope, duties, and deadlines
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
UK Online Safety Act ICO Overlap Guide
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
UK Online Safety Act Illegal Content Duties Explained
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
UK Online Safety Act Moderation, Complaints and Appeals
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
UK Online Safety Act Ofcom Enforcement Guide
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
UK Online Safety Act Penalties and Fines Guide
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
UK Online Safety Act Regulated Service Scope Guide
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
UK Online Safety Act Requirements Guide
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
UK Online Safety Act Risk Assessment Template
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
UK Online Safety Act Risk Assessment Workflow
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
UK Online Safety Act Risk Assessments Playbook
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
UK Online Safety Act Senior Manager Liability Explained
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
UK Online Safety Act Service Classification Workflow
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
UK Online Safety Act Service Scope and Categorization Guide
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
UK Online Safety Act Transparency Reporting
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
UK Online Safety Act vs DSA: scope and duties
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
When Are Senior Managers Liable Under the UK Online Safety Act?
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When is age assurance required under the UK Online Safety Act?
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.