Online Safety Act for small business websites: are your comments and forums in scope?

Many owners hear "Online Safety Act" and assume it only concerns social media giants. It does not. The law also reaches ordinary websites and apps that let people post content or talk to each other. If your business runs a customer forum, a community area, a review section with replies, or a members' chat, it is worth ten minutes to check where you stand. This guide explains who is covered, what the duties are, what regulators have said about small services, and what to do this week.

Who the Act applies to

According to the government's own explainer, the Act's duties apply to search services and to services that allow users to post content online or to interact with each other. The examples listed include social media, cloud storage and sharing sites, video-sharing platforms, online forums, dating services and instant messaging.

The key idea is user-generated content. A brochure website where only you publish content is a very different thing from a site where customers can post messages, upload images or reply to each other. Law firm Bristows notes that Ofcom has said discussion forums and chat rooms fall within the definition, and that if a forum sits inside a larger site that is otherwise out of scope, the forum part is still in scope.

The Act also covers overseas providers that have a UK link. The government explainer describes this as a significant number of UK users, the UK being a target market, or UK access combined with a material risk of significant harm to UK users. So a business based abroad but selling to Britain cannot assume it is exempt.

Is there a small business exemption?

No general one. Bristows states that there is no general exemption for small platforms such as niche, volunteer-run forums. Size alone does not take a service out of scope.

What size does change is how much you are expected to do. The government explainer says duties are proportionate to the risk of harm and to the provider's size and capacity. Bristows quotes Ofcom as saying there is no "one size fits all" approach, and describes Ofcom's enforcement as targeted and proportionate, focused on the largest and highest-risk services. It adds that Ofcom may show more leniency to providers making good-faith efforts to comply. That is a commentator's reading, not a promise, so treat it as encouragement rather than a safe harbour.

What the duties are

For a typical small user-to-user service, the government explainer sets out the core duties: assess the risk of illegal content, reduce the risk of your service being used for illegal activity, and remove illegal content when it appears. Priority offences include child sexual abuse, fraud, terrorism, and promoting or facilitating suicide.

Bristows sets out the steps a small forum operator should work through:

• An illegal content risk assessment. Identify the types of illegal content that could be relevant, judge how likely users are to meet them, and put mitigations in place. Bristows flags that risk rises with image or video sharing, commenting, user profiles and anonymous posting.
• A children's access assessment. Decide whether children can access your service and whether they use it, or are likely to use it, in significant numbers. Bristows says only highly effective age assurance that keeps under-18s out supports a conclusion that children do not use your service.
• A children's risk assessment. Needed if children are likely to access the service.
• Baseline measures. Bristows reports that Ofcom's Illegal Harms Codes recommend 14 basic measures for in-scope user-to-user providers, including easy-to-find terms, a complaints process, the ability to review and remove content, and a named person responsible for compliance.

The government explainer lists the dates for the first assessments: the children's access assessment was due by 16 April 2025 and the children's risk assessment by 24 July 2025, with Ofcom able to enforce the illegal content duties from 17 March 2025. Those dates have passed, so if you run an in-scope service and have not documented your assessments, you are behind rather than early. Bristows' own deadlines come from a February 2025 article, so check Ofcom's current timelines too.

What happens if you get it wrong

The government explainer says companies can be fined up to £18 million or 10 percent of their qualifying worldwide revenue, whichever is greater. With a court's agreement, Ofcom can also require payment providers, advertisers and internet service providers to stop working with a site. Senior managers can face criminal action in specific cases, such as failing to comply with Ofcom's information requests.

Those are the maximums, and they are aimed at serious failures. The enforcement example Burges Salmon gives is at the other end of the scale from a small shop's forum: in December 2025 Ofcom fined an adult website operator £1 million for not having robust age checks, plus a further £50,000 for failing to respond to an Ofcom information request. The second fine is a useful reminder: ignoring a regulator's request for information is its own problem.

How the debate has felt for small operators

Commentary from small site owners has been anxious, with worries about time, cost and liability. Law firms and Ofcom's own framing point the other way: Bristows describes enforcement as targeted and proportionate, and expects small, low-risk community forums to be less likely to face the most severe powers.

The calm reading is this: the law is real, the risk assessment is the main task, and a well-moderated space with a clear record of removing harmful content is the kind of service that should be able to show a low risk. Burges Salmon reports that Ofcom's 2026 priorities centre on protecting children, effective age checks, and scrutiny of the biggest platforms such as Facebook, Instagram, TikTok, YouTube and Snapchat, which is a long way from a local firm's comment section. None of that removes your duties, but it tells you where the regulator is looking first.

What to do this week

• List every feature where a visitor can post or interact. Comments, reviews with replies, forums, chat widgets, user profiles, file uploads and community groups all count as candidates.
• Ask whether you need them. If a comments section brings little value, switching it off may take that feature out of scope, but check Ofcom's own scoping guidance to confirm.
• If you keep them, write down a risk assessment. A short, dated document covering what content could appear, how likely it is and what you do about it is far better than nothing.
• Name a responsible person and publish simple terms. Make it easy for users to report content and make sure someone reads the reports.
• Check who can use the space. If it is not meant for under-18s, be honest about whether your controls keep them out.
• Ask your web developer or agency. Moderation tools, spam filters and reporting buttons are often a configuration job, not a rebuild.

If you are planning a new site or app with community features, build the reporting and moderation tools in from the start. Our web design and mobile app teams can help you decide which features are worth having and how to run them safely.

This article is general information drawn from the sources below, not legal advice. If your service has significant community features, take professional advice and check Ofcom's current guidance.