Compliance tools · AI, digital commerce and consumer protection

Online Safety Act 2023 compliance tool

OSA 2023 (c. 50) · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Online Safety Act 2023 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Online Safety Act 2023 is OSA 2023 (c. 50), a binding instrument in the United Kingdom. Duties of care for UK services hosting user-generated content or search.

The free assessment screens for Online Safety Act 2023 when a business runs a service on which users share content with each other, or provides online search.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Online Safety Act 2023: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Online Safety Act 2023 applies to your business, free →

Does Online Safety Act 2023 apply to my business?

You are caught if you provide a regulated user-to-user service, a regulated search service, or an internet service publishing regulated provider pornographic content within the meaning of section 80(2). The service must have links to the United Kingdom, meaning a significant number of UK users, UK users as a target market, or use in the UK with a material risk of significant harm to UK individuals.

Who does Online Safety Act 2023 apply to?

The Act applies to providers of regulated user-to-user services, providers of regulated search services, and providers of internet services publishing regulated provider pornographic content. Category 1, Category 2A and Category 2B services carry extra duties, and officers of provider entities can be liable personally under sections 202 and 203.

Does Online Safety Act 2023 apply to a small business?

There is no size threshold. All regulated user-to-user and search service providers, regardless of size, must comply with the baseline illegal content, content reporting, complaints, freedom of expression and record-keeping duties, although OFCOM may exempt particular descriptions of providers from record-keeping duties.

When does Online Safety Act 2023 apply from, and what are the deadlines?

Under Schedule 3, the first illegal content risk assessment, first children's access assessment, first children's risk assessment and first section 15(2) assessment must each be completed within 3 months of the applicable guidance publication date or relevant day. Initial fee notification is due within 4 months under section 83(5)(a), subsequent fee notification at least 6 months before the charging year under section 83(5)(b), and children's access assessments not more than one year apart under section 36(3).

What does Online Safety Act 2023 require me to do?

You must carry out and keep current an illegal content risk assessment under section 9 and, where relevant, a children's risk assessment under section 11, record each assessment in writing under section 23, and provide content reporting and complaints procedures under sections 20 and 21. Category 1 providers must also run a section 14 user empowerment assessment and supply risk assessment records to OFCOM as soon as reasonably practicable under section 23(10).

What records or documents does Online Safety Act 2023 require me to keep or produce?

You must keep written records of your risk assessments and code of practice measures in an easily understandable form under section 23, and review them regularly and after significant change under section 23(6). Category 1 providers must supply OFCOM with a copy of each illegal content risk assessment record or section 14 assessment record as soon as reasonably practicable under section 23(10), and Category 2A providers have the equivalent duty under section 34(9).

What happens if I do not comply with Online Safety Act 2023?

OFCOM can issue an information notice under section 102, appoint a skilled person under section 104, investigate under section 105, and impose a confirmation decision under section 133 with a penalty whose maximum is set by Schedule 13. Failure to comply with a confirmation decision requirement is a criminal offence under section 138, carrying on indictment up to 2 years imprisonment or a fine, or both.

Does Online Safety Act 2023 apply to a UK business selling into the EU?

Yes. Section 204 confirms that providers of internet services, user-to-user services and search services provided from outside the United Kingdom are subject to the Act in the same way as UK-based providers, so a UK business selling into the EU is caught only where its service has the UK links described in the territorial scope.

Does Online Safety Act 2023 apply to an EU business selling into the UK?

Yes. Section 204 confirms that providers of internet services, user-to-user services and search services provided from outside the United Kingdom are subject to the Act in the same way as UK-based providers, so an EU business selling into the UK is caught where its service has a significant number of UK users, has UK users as a target market, or can be used in the UK with a material risk of significant harm to UK individuals.

How do I start complying with Online Safety Act 2023?

The first practical step is to carry out the illegal content risk assessment required by section 9, which must be completed within 3 months of the applicable guidance publication date or relevant day under Schedule 3. You then record that assessment in writing under section 23.

Which ComplianceSME account includes the Online Safety Act 2023 toolkit?

The Online Safety Act 2023 agent toolkit is included in Compliance Complete.

Related in AI, digital commerce and consumer protection: EU AI Act · Digital Services Act · Digital Markets Act · Product Liability Directive