<p dir="ltr">I was reading about the Online Safety Act and had a question about how far it reaches, since most coverage focuses on large social media platforms and says little about smaller online services. Here is what I understood from my reading, and I would appreciate anyone correcting me or adding context.

<p dir="ltr">The Act is UK legislation that places legal duties on online services to reduce the risk of users encountering illegal and harmful content. It applies to user to user services, where people can share content with each other, and to search services. It is not limited to the largest platforms. A forum, a marketplace with messaging, a community app, or a platform with comments could all fall within scope, and the rules can apply to services based outside the UK if they have a significant number of UK users or target the UK market.

<p dir="ltr">The duties seem to scale with the type and size of service and the level of risk. Companies are expected to carry out risk assessments for illegal content, put in place proportionate measures to reduce those risks, and provide ways for users to report content and make complaints. Services likely to be accessed by children have additional duties, including a children&rsquo;s risk assessment and protections against content that is harmful to them, which is where age assurance comes in. Larger and higher risk services face extra obligations on top. Ofcom is the regulator, and it publishes codes of practice and guidance on what compliance looks like, with the power to issue fines and take enforcement action.



<p dir="ltr">My question is how a small company without a legal or compliance team can realistically work out whether it is in scope, what a proportionate risk assessment looks like at that size, and which parts of Ofcom&rsquo;s guidance matter most for a first version of compliance. I first came across a summary of the topic on Entrepreneur Plus a little while ago, and it made me want to hear from people who have actually dealt with it, whether as an operator or an adviser, about what took the most effort, what was clearer than expected, and what they would check first.