Small does not mean outside

How we work

Why a comments box is a longer commitment than it looks

Adding user content to a website is a couple of days of work and, potentially, a permanent set of regulatory duties, and almost everybody encounters those two facts in the wrong order. The Online Safety Act applies to user-to-user services — services by which content generated, uploaded or shared by one user may be encountered by another — where there are the required links with the United Kingdom. Nothing in that test depends on the size of the service, its revenue or its ambitions. A forum with a few hundred members is a regulated service in the same sense that a global platform is. What size properly affects is the content of the duties, which must be proportionate to the service and to the risks it actually presents, and that is a real and sensible protection rather than a technicality.

The timetable has already run. An illegal content risk assessment was required by 16 March 2025, with the corresponding safety duties from the next day; a children's access assessment by 16 April 2025; a children's risk assessment by 24 July 2025, with children's safety duties from 25 July 2025 and requirements for highly effective age assurance in relation to specified content. Enforcement sits with Ofcom, which can impose penalties reaching eighteen million pounds or ten per cent of qualifying worldwide revenue, whichever is greater, pursue business disruption measures, and in connection with information notices engage criminal liability for senior managers. Whether a small service would ever face any of that is a separate question from whether the duties apply to it, and treating the first as an answer to the second is how organisations end up with nothing at all in place.

The other half deserves equal emphasis, because the alarm in this area is frequently overdone. The Act contains exemptions, and the broadest in practical terms covers services where the only user-generated content enabled is comments or reviews on material the provider published itself. That description fits an enormous number of small business sites, blogs and publications, which are consequently not in the position they fear. We will not tell a client which side of that line they are on, because it is a question of law and the honest answer to it comes from a lawyer. What we will do is establish the facts the answer depends on — exactly what a user can post, who can see it, whether a child could reach it, what happens when someone reports something — written down in a form a lawyer can work from in an hour rather than a week.