There is no
small-businessexemption.

If users can see each other's content, then being small does not take it out of scope. That is the part people find hard to believe, so it is worth stating precisely: the Act applies to user-to-user services with links to the United Kingdom, and nothing in that test turns on how many users there are or how much the service earns. What size does affect is the content of the duties, which have to be proportionate to the service and to the risks identified. A community of three hundred people is not expected to do what a global platform does. It is expected to have thought about it, written it down, and built a way for someone to report a problem.

They have. Providers of services in scope were required to complete an illegal content risk assessment by 16 March 2025, with the corresponding duties taking effect the following day. A children's access assessment was due by 16 April 2025. A children's risk assessment was due by 24 July 2025, with children's safety duties from 25 July 2025, including requirements for highly effective age assurance in relation to specified content. If a service is in scope and none of that has happened, the useful response is to start with the risk assessment rather than with a policy page, because the assessment is what the rest is supposed to follow from.

Ofcom may impose a penalty of up to eighteen million pounds or ten per cent of qualifying worldwide revenue, whichever is the greater, and may seek business disruption measures affecting payment or access services. There is also criminal liability for senior managers in connection with failures to comply with information notices, which is the provision that tends to concentrate minds. Whether any of that would ever be directed at a small service is a different question from whether the duties apply, and conflating the two is how organisations end up with nothing in place at all.

There are real exemptions, and this is the half of the story that gets lost. The most widely applicable one covers services where the only user-generated content enabled is comments or reviews on content published by the provider itself — which describes a very large number of small publishers, blogs and business sites. Other exemptions cover certain internal business services and some forms of one-to-one communication. We will not tell you that you are exempt, because that is a question of law. We will set out exactly what functionality your service offers, which is what the question turns on, and that is usually a day's work.

No, and anyone who answers that question for a fee without being a lawyer is doing you a disservice. What we can do is establish the facts the answer depends on: precisely what a user can post, who can encounter it, whether there is any route by which a child could reach it, what the service does with reports, and who inside the organisation owns it. With that written down, a lawyer can answer the question quickly and cheaply. Without it, they will spend their first three hours asking us for it.

Because a decision nobody recorded is a decision nobody can demonstrate. When a report comes in about a piece of user content, what matters afterwards is not only what was decided but that there was a process, that it ran within the stated time, and that the reasoning existed. A log of who decided what, when, and why takes seconds per entry and is the only thing that can show, later, that a small service was taking its duties seriously rather than reacting to whatever reached the loudest inbox.