Online Safety Act for small business websites: what applies

Last checked: October 2026. This article summarises the Online Safety Act 2023 as published on legislation.gov.uk and the government’s explainer on GOV.UK. It is general information, not legal advice. Ofcom is the regulator and publishes the codes of practice and guidance; check its current material and, if in doubt, take legal advice.

Most business websites never touch the Act. A brochure site, a portfolio or a shop where only you publish content does not let users reach each other. The Act defines a user-to-user service as an internet service through which content generated, uploaded or shared by one user may be encountered by another user. It does not matter whether content is actually shared, as long as the functionality allows it. Forums, community areas, message boards, chat and open comment sections are the usual examples; the GOV.UK explainer names online forums among the services in scope.

Size does not exempt you. Section 9 applies the risk assessment duties to all regulated user-to-user services. The explainer says duties are proportionate to the risk of harm and the size and capacity of each provider, so small services with limited functionality are not required to take the same actions as the largest corporations.

Schedule 1 to the Act lists exempt services. Paragraph 4 exempts a user-to-user service whose functionalities are limited so that users can communicate only by:

• posting comments or reviews relating to provider content, meaning content published by the provider or someone acting on its behalf;
• sharing such comments or reviews on a different internet service;
• expressing a view on those comments or reviews, or on provider content, with a like or dislike button, an emoji or symbol, yes/no voting, or a rating or score, including star ratings;
• displaying identifying content, such as a name or profile picture, in connection with those activities.

User-generated content is never treated as provider content. In practice:

• Likely in the exemption: a shop where customers can review your own products, or a blog where visitors can comment only on your posts.
• Likely outside it: replies to other users’ comments, reviews of third-party sellers on a marketplace, direct messages, user uploads or user-started threads, because none of these is on the paragraph 4 list.
• There is no application process in the text. The exemption depends on whether your actual features fit the paragraph 4 description, so record your reasoning.

When we checked in October 2026, legislation.gov.uk showed paragraph 4 without amendments, up to date with changes in force on or before 21 October 2026. Other parts of Schedule 1 have a later version, and some changes may come into force in future, so re-read the text before relying on it.

If your site is a regulated user-to-user service, the illegal content duties apply. The GOV.UK explainer says those duties are in effect: the deadline for existing services to complete their risk assessment was 16 March 2025, and Ofcom could enforce from 17 March 2025.

• An illegal content risk assessment under section 9. It covers, among other things, your user base, the risk of users encountering each kind of priority illegal content (assessed separately) and other illegal content, the risk of the service being used to commit or facilitate a priority offence, and which functionalities raise that risk.
• Timing. Under Schedule 3, a new service that starts when the guidance is available must complete its first illegal content risk assessment and its first children’s access assessment within three months of its first day. Before any significant change to the design or operation of the service, section 9 requires a further assessment of that change.
• A written record. Section 23 requires a written record, in an easily understandable form, of all aspects of every risk assessment, including how it was carried out and its findings. It also requires a record of the code of practice measures you use, or of any alternative measures and why they comply, and a regular review of compliance.
• Safety measures. Section 10 requires proportionate measures and systems, including swiftly taking down illegal content once you are alerted to it. What is proportionate depends on the findings of your risk assessment and on the size and capacity of the provider.

Section 10 was amended with effect from 29 June 2026: services must now also take down content subject to an intimate image content report, and substantially the same content, as soon as reasonably practicable and no later than 48 hours after the report, subject to limited exceptions.

Section 10 is more specific than many site owners expect. Where proportionate, the measures must cover areas such as risk management arrangements, the design of functionalities, terms of use, user access (including blocking users), content moderation and take-down, user support and staff policies. The provider must also:

• include provisions in its terms of service explaining how individuals are protected from illegal content, including the new intimate image take-down duty;
• apply those provisions consistently;
• describe any proactive technology used for compliance, including what kind it is, when it is used and how it works;
• make those provisions clear and accessible.

Summarising the risk assessment findings in the terms of service is an additional duty for Category 1 services only, not for ordinary small sites.

Priority illegal content is the most serious category. The GOV.UK explainer lists the kinds of content involved, including fraud, selling illegal drugs or weapons, terrorism, child sexual abuse, inciting violence and intimate image abuse. For a business forum or marketplace, fraud and the sale of illegal items are the risks most worth thinking through in the assessment, in our view.

The children’s access assessment decides whether your service is likely to be accessed by children. According to the GOV.UK explainer, services likely to be accessed by children must also assess the risk of harm to children and protect them from harmful content. A small trade forum may conclude that children are unlikely to use it, but that conclusion should be written down with the reasons. We have not covered the children’s duties in detail here.

On penalties, Schedule 13 sets the maximum at the greater of £18 million and 10% of the provider’s qualifying worldwide revenue for its most recent complete accounting period. The explainer also says Ofcom has set up a small but risky supervision taskforce to monitor such services and move to rapid enforcement where there is evidence of non-compliance.

What does this mean for an ordinary small business? In our view, a service that only lets users review your own products is unlikely to fall under these duties at all. A community forum or an open comment area on third-party content is a different matter.

1. List every place where users can post: comments, reviews, forum, chat, profiles, uploads, direct messages.
2. For each, ask whether users can see or reach other users’ content, or only comment on yours.
3. If only your own content: record why you believe the Schedule 1 paragraph 4 exemption applies.
4. If not exempt: complete and write down an illegal content risk assessment and a children’s access assessment.
5. Decide how you will find and take down illegal content, and check Ofcom’s codes of practice for the measures that apply to a service of your size.
6. Set up a route for reports, including intimate image content reports and the 48-hour deadline.
7. Assign someone responsible, review compliance regularly and reassess before any significant change.
8. Switch off features you do not need. Disabling comments or forums reduces what the Act can catch.

The Act looks at features. That makes some design decisions compliance decisions.

• Reviews limited to your own products fit the exemption’s logic.
• Open comments under third-party content, or a general forum, add obligations.
• Direct messaging between users is not one of the permitted interactions in paragraph 4.
• Pre-moderation of comments reduces the chance of illegal content going live, but in our reading it is a measure, not an exemption.

If you are planning a site with community features, decide early. We build and adapt sites with this in mind; simple presentation sites start from €300. Our services and references are online, and you can request a quote or contact us. We do not provide legal advice.

• legislation.gov.uk: Online Safety Act 2023, section 3
• legislation.gov.uk: Online Safety Act 2023, Schedule 1 paragraph 4
• legislation.gov.uk: Online Safety Act 2023, section 9
• legislation.gov.uk: Online Safety Act 2023, section 10
• legislation.gov.uk: Online Safety Act 2023, section 23
• legislation.gov.uk: Online Safety Act 2023, Schedule 3
• legislation.gov.uk: Online Safety Act 2023, Schedule 13 paragraph 4
• GOV.UK: Online Safety Act explainer