Ofcom has confirmed that businesses which received formal notices earlier this year must submit records of their illegal content and children’s risk assessments by 31 July 2026, with enforcement action on the table for anyone who misses it. That’s just three weeks away. Most coverage of the Online Safety Act has focused on giant social platforms, but the Act’s duties apply far more broadly than that — to any UK service that lets users post, share, or interact with content, including plenty of small businesses that never thought of themselves as a “platform” at all.
If your website has a comments section, a customer review feature, a forum, a community area, or any way for users to upload content that other users can see, it’s worth checking whether this applies to you before the deadline lands.
Who this actually catches
The Act was written with the largest platforms in mind, but its scope is defined by function, not size — any UK-facing service enabling user-to-user content sharing or search functionality can fall in scope, and Ofcom explicitly runs a “Small but Risky Services” watch for smaller platforms whose content carries disproportionate potential for harm relative to their size. The reassuring part is that duties are meant to be proportionate: a small business with a modest review section faces a lighter set of expectations than a large social network. The less reassuring part is that “proportionate” doesn’t mean “exempt” — a risk assessment obligation can still apply, just scaled to your size and risk profile.
If you’ve had direct contact from Ofcom or received a formal information request already, the 31 July deadline is real and specific to you. If you haven’t, it’s still worth a few minutes establishing whether your site’s functionality — reviews, forums, comment threads, messaging between users — puts you in scope at all, because the framework is still being actively enforced and new notices continue to go out.
What to check this week
Start by listing every place on your site where a user can post something another user or visitor can see: product reviews, blog comments, forum posts, user profiles, direct messages. For each one, a basic illegal content risk assessment asks simple questions — could this feature be used to share illegal content, how would you become aware of it, and what would you do about it. For most small sites, the honest answer might be “we moderate reviews before they go live” or “comments are switched off” — and documenting that decision is itself the risk assessment for a proportionate, low-risk service.
Don’t assume silence from Ofcom means you’re in the clear indefinitely — the enforcement approach is explicitly risk-based, and services with any capacity for harm can be brought into scope as priorities shift. A short, written note of what user-generated content your site allows, how it’s moderated, and who’s responsible for it is worth having on file regardless of whether you’ve been formally contacted.
The takeaway
If any part of your website lets users post content — reviews, comments, forums — check this month whether the Online Safety Act’s risk assessment duties apply to you, particularly if you’ve had any contact from Ofcom already. For most small sites the fix is a short, honest document rather than a compliance overhaul, but 31 July is a real deadline for those already on Ofcom’s radar, and worth acting on now rather than after a notice arrives.
It’s also a good prompt to review who owns this on an ongoing basis rather than treating it as a one-off box to tick. Platforms change — a review feature added last year, a forum bolted on for a product launch — and each addition can shift where your site sits against the Act’s thresholds, so it’s worth revisiting this assessment whenever you add a new way for users to post or interact.
