EveryAILaw.comUK Online Safety Act 2023
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Royal Assent | Oct 26, 2023 | Online Safety Act 2023; Part 1 interpretive sections in force immediately (s.240(4)) |
| Duty provisions commenced | Jan 10, 2024 | S.I. 2023/1420 — illegal content, children's safety and transparency duties in Parts 3-4 |
| Further commencement | Jan 31, 2024 | S.I. 2024/31 — enforcement and information powers |
| Children's safety codes | 2025-04 | Ofcom codes of practice |
| Phased enforcement ongoing | 2025-2026 | Additional duties rolling out |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
AI-Generated Content Duties
The saved heading identifies an AI-related application of the Act, but Part 3 duties turn on regulated service and in-scope content risk, not on AI origin alone. Section 55 distinguishes user-generated content, including user-applied software and qualifying bots, from provider content; s. 57 defines search content and its exclusions. Section 216A permits later regulations extending duties to AI services; it imposes no such duty by itself.
Requirements
| Requirement | Details |
|---|---|
| Illegal content | Regulated user-to-user providers must assess and address illegal content under ss. 9-10; regulated search providers have corresponding duties under ss. 26-27. An AI-generated item falls within those duties only where it is in the Act's regulated user-generated or search-content scope and meets the applicable illegal-content trigger (ss. 55, 57). |
| Children's safety | The additional assessment and safety duties in ss. 11-12 and 28-29 apply to regulated services likely to be accessed by children, according to the statutory content categories. |
| AI-service extension | Section 216A authorizes regulations that could extend corresponding duties to providers of AI services for illegal AI-generated content or priority-offence use. The power alone does not impose those duties. |
| Transparency reports | Under s. 77, providers of Category 1, 2A or 2B relevant services produce a report in response to OFCOM's annual notice, with the specified information, format and deadlines. It is not a universal annual AI-content report. |
Penalties
| Violation | Fine |
|---|---|
| Applicable regulated-service breach | Where OFCOM can impose a monetary penalty for an applicable requirement, Sch. 13 para. 4 sets the maximum at the greater of GBP 18M or 10% of qualifying worldwide revenue for the relevant accounting period, subject to its qualifications. |
Sources: Online Safety Act 2023
Risk Assessment for AI Systems
Part 3 Chapter 2 duties cover regulated user-to-user services, regardless of whether AI generated the content. The parallel search-service duties sit in Chapter 3 (ss. 26, 28). Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(c), (d)); Ofcom compliance deadlines fell later.
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Carry out a suitable and sufficient assessment of risks of users encountering priority or other illegal content, considering service algorithms and dissemination; keep it current and reassess before significant service changes (s. 9). |
| Children's risk assessment | If the service is likely to be accessed by children, assess the statutory categories of harmful content and relevant design or algorithmic risk factors; keep the assessment current and reassess before significant service changes (s. 11). |
| Assessment record | Make and keep the required written record of each risk assessment (s. 23(2)). Safety mitigation duties are separately in ss. 10 and 12. |
Penalties
| Violation | Fine |
|---|---|
| Applicable regulated-service breach | Sch. 13 para. 4 sets the applicable maximum at the greater of GBP 18M or 10% of qualifying worldwide revenue, subject to its qualifications. |
Sources: Online Safety Act 2023
Risk Assessment for Search Services
Part 3 Chapter 3 covers search-specific risks: s. 26(5)(a) names algorithms, indexing, organisation and presentation of results, and s. 28(5)(c) names predictive search functionality. These are functionality factors, not an AI-origin trigger. Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(j)).
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Suitable and sufficient assessment of the risk of users encountering priority and other illegal content in search content, taking into account risks presented by the service's algorithms and by how it indexes, organises and presents results (s.26(2), (5)(a)) |
| Children's risk assessment | Where the service is likely to be accessed by children, a further assessment covering primary priority, priority and non-designated content harmful to children, with separate consideration by age group and explicit assessment of predictive search functionality (s.28(2), (5)(a), (5)(c)) |
| Keep assessments current | Duty to keep each assessment up to date, including when Ofcom significantly changes an applicable risk profile (ss.26(3), 28(3)) |
| Reassess before significant change | Further assessment before any significant change to the design or operation of the service, covering the impacts of that change (ss.26(4), 28(4)) |
| Assessment timing | Assessments carried out at the times set out in Schedule 3 |
| Records | Records of risk assessments kept under s.34(2) and (9) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Greater of GBP 18M or 10% of qualifying worldwide revenue (Sch. 13 para. 4) |
Cite this regulation
Permalink: https://everyailaw.com/regulation/uk-online-safety-act/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “UK Online Safety Act 2023”, EveryAILaw.com, Aug 15, 2026. https://everyailaw.com/regulation/uk-online-safety-act/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.