https://www.noxia.co.uk/field-notes/a-comments-box-is-a-regulated-service · printed from noxia.co.uk · sources checked 23 September 2026
Field note · Security
The Online Safety Act applies to all sizes. Including yours.
The reporting on this Act has been about very large platforms, which is reasonable, because that is where the harm is. It has also left most small businesses with the impression that scope is a question of size. Scope is a question of function.
- Security
- Online Safety Act
- Ofcom
- Compliance
- Websites
The short answer
The Online Safety Act applies to all regulated user-to-user and search services regardless of size. Additional duties attach to categorised services: Category 1 above 34 million UK monthly users with content recommenders, or above 7 million with recommenders and content-sharing; Category 2A search engines above 7 million; Category 2B user-to-user services at 3 million with direct messaging. Penalties reach £18 million or 10% of global revenue, whichever is greater.
On this page · 7 sections
A user-to-user service is one where content generated by one user can be encountered by another. That definition does not mention scale, industry or intent.
Most professional firms do not run one. But some do without having framed it that way: a client forum, a comments section, a community area, a review wall where visitors post, a portal where users share documents with each other rather than only with you.
The dates that have already passed
Children's access assessments were due by 16 April 2025. Age assurance for pornography services and children's risk assessments arrived in July 2025. Full implementation was expected through 2026.
A small service that has never done a risk assessment is not in a grace period. It is late, and the obligation is retrospective in the sense that the assessment was supposed to exist before the risk did.
Proportionality is real, and it is not an exemption
The duties are framed around measures that are appropriate and proportionate to the size and risk of the service. A ten-person firm with a moderated client forum is not expected to build what a social network builds.
What it is expected to do is think about it and record the thinking. An assessment that says "this service allows clients to post in a closed, verified forum; the risk of illegal content is low for these reasons; these are the measures we take; this is reviewed annually" is a proportionate answer.
The penalty is the reason to spend an afternoon
Fines reach £18 million or 10% of global revenue, whichever is greater. For a small firm the 10% is the operative figure, and it is a number that makes a half-day of assessment look cheap.
The realistic risk is not a fine, though. It is that a service nobody thought about becomes a problem — a user posts something illegal in a forum nobody monitors, and the firm discovers its obligations at exactly the wrong moment.
Three questions to settle in writing
- Does any part of our site let one user encounter another user's content? Comments, forums, reviews, shared documents, profile pages. If yes, you are probably in scope.
- Can children access it? That is a separate assessment with its own duties and its own deadline, which has passed.
- Who removes something, how fast, and how do we know? The duty is to reduce risk and remove illegal content, and both require somebody to be looking.
What this does not tell you
We are not lawyers and the scope definitions have exclusions we have not set out — the Act carves out several categories of service, and whether a particular feature makes you a regulated service is a legal question with a real answer that we are not giving.
It also does not cover the categorised-service duties in any detail, because almost nobody reading this is a categorised service. If you are, you have a compliance function and it knows.
The general point we would leave you with is the one this site keeps returning to: a feature added years ago for a good reason can acquire a legal consequence without anybody touching it. Knowing what you run is the prerequisite, which is where the stack check and the cleanup work start, and it is the same prerequisite as the five Cyber Essentials controls and the incident clock.
Questions people actually ask
Does the Online Safety Act apply to small websites?
The base duties apply to all regulated user-to-user and search services regardless of size. The size thresholds — Category 1 above 34 million UK users, Category 2A above 7 million, Category 2B above 3 million — determine which services carry additional duties, not which services are covered at all.
What is a user-to-user service?
A service where content generated by one user can be encountered by another. That can include a client forum, a comments section, a community area, a review wall where visitors post, or a portal where users share documents with each other rather than only with the firm.
What are the penalties under the Online Safety Act?
Fines of up to £18 million or 10% of global revenue, whichever is greater. For a small firm the percentage is the operative figure, which is what makes a short risk assessment a cheap investment by comparison.
What does a proportionate risk assessment look like for a small service?
Short and specific: what the service allows users to do, why the risk of illegal content is low or high for stated reasons, what measures are in place, who removes content and how quickly, and when it will be reviewed. Proportionality means a brief document that exists rather than a long one that does not.
Sources
- House of Commons Library, research briefing on implementation of the Online Safety Act (CDP-2025-0043). Duties: services must “implement measures to reduce the risk of their services being used for illegal activity” and remove illegal content; child protection duties including preventing access to age-inappropriate material and transparent risk assessments; the “triple shield” for adults. Scope: “all regulated user-to-user and search services” regardless of size, with additional duties for categorised services — Category 1 where monthly active UK users “exceeds 34 million” with a content recommender, or exceeds 7 million with a recommender and content-sharing; Category 2A search engines where it “exceeds 7 million”, excluding vertical search; Category 2B user-to-user services where it “exceeds 3 million” with direct messaging. Dates: children’s access assessments due 16 April 2025; age assurance for pornography services and children’s risk assessments July 2025; full implementation expected through 2026. Penalties up to “£18 million, or 10% of their global revenue (whichever is greater)”. commonslibrary.parliament.uk ↗ — primary for practical purposes; a parliamentary research briefing, which is neutral and sourced but is not the Act or Ofcom’s codes re-checked every 6 months
- The exclusions from scope, and whether a particular feature makes a service regulated, are legal questions we are not answering. We have not set out the carve-outs. — a stated limit on this note
- The three questions, and the reading that scope is a question of function rather than size, are ours. — our own argument, labelled as such. Not legal advice
Checked 23 September 2026. Next scheduled check 22 March 2027. Numbers that move — leaderboards, live indices — are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
Cite this note
Noxia, “The Online Safety Act applies to all sizes. Including yours”, Field notes, 23 September 2026; sources checked 23 September 2026. https://www.noxia.co.uk/field-notes/a-comments-box-is-a-regulated-service
Does any part of your site let one user see another user’s content?
That single question decides whether an Act you assumed was about social networks applies to you. We map what your site actually does — including the features added years ago that nobody has looked at since — and tell you which ones carry a duty.
Talk to us about thisRead next
Security
A 24-hour clock, and your IT supplier is in scope.
Light-touch notification within 24 hours, full report within 72. Managed service providers and data centres come into scope for the first time.
Security
£320 buys five controls, and £25,000 of cover if you tick the box.
Five controls, £320 plus VAT to certify, and £25,000 of cyber liability cover for organisations under £20m turnover that opt in when they apply. It is the cheapest security decision a small firm makes.
Security
Two hundred people is where a new duty starts.
Standard tier at 200 to 799 expected people, enhanced at 800 and above. The regulator is the Security Industry Authority, which expects the Act to come into force in spring 2027.