00WHAT THE LAW AND OFCOM SAY

A forum is
a regulated service.

A volunteer's desk at night with a laptop showing a blurred discussion board, a mug and a notebook of handwritten notes — AI-generated image, not a photograph of a real person or place.

If users can post for other users, the Act may apply.

The UK Online Safety Act covers services where people share content with each other, and the government's explainer names online forums. For a small community site, the core duty is a written illegal content risk assessment, kept up to date.

ASSESSrecord, reviewUpdated 16 October 2026

When to review

01Principles

Check if you're in scope
Assess and write it down
Review when things change
Proportionate, not one-size

02THE SHORT ANSWER

Three duties
for a small site.

Ofcom says its risk guidance works for services of all types and sizes.
The government says small services needn't match the largest companies.

SCOPE

Users talking to users

The Act defines a user-to-user service as one where content posted by one user may be encountered by others, with links to the UK.

The scope test

ASSESS

A written risk assessment

Ofcom requires an illegal content risk assessment, protections against the risks found and a written record of both.

The four steps

REVIEW

Keep it current

Ofcom recommends reviewing at least annually, and a new assessment is needed before any significant change to the service.

When to review

General information only, not legal advice. For advice on your own situation, speak to a qualified lawyer or a free advice service.

03A QUICK TIMING CHECK

When does the
assessment need doing?

Pick a situation to see what Ofcom's guidance says about timing. The bar shows how pressing it is.

From Ofcom's page on illegal content duties (updated June 2026). General information, not legal advice.

Timing check

Choose a situationLaunching a new forumAdding a big new featureOfcom updates its Risk ProfilesNothing has changed

Launching a new forumWithin 3 months

You have three months to complete a risk assessment after launching a service that the Act applies to.

Adding a big new featureBefore the change

If you plan a significant change to the service's design or operation, you need to complete a new risk assessment before making it.

Ofcom updates its Risk ProfilesReview it

You also need to review your assessment if Ofcom makes a significant change to its Risk Profiles, as it did when new priority offences were added.

Nothing has changedYearly review

Ofcom recommends reviewing your illegal content risk assessment at least once a year to keep it up to date.

Source: Ofcom, Illegal content duties under the Online Safety Act.

04TWO NUMBERS WORTH KNOWING

Short deadlines,
serious penalties.

One figure on timing,
one on what Ofcom can fine.

3 months

To complete a risk assessment after launch

After launching an in-scope service you have three months to complete the assessment, and you must keep a written record of every risk assessment you carry out.

TIMING · OFCOM

£18m or 10%

Maximum fine, whichever is greater

Companies can be fined up to £18 million or 10 percent of qualifying worldwide revenue. Ofcom has set up a taskforce for small but risky services.

FINES · GOV.UK

The illegal content duties have been enforceable by Ofcom since 17 March 2025. Ofcom's guidance asks services to rate each kind of priority illegal content as negligible, low, medium or high risk.

05OFCOM'S FOUR STEPS

Assess, decide,
record, review.

Ofcom's Risk Assessment Guidance sets out four steps. It says there is no one-size-fits-all approach, and offers a free digital toolkit and record template.

Understand the content to assess
Work through Ofcom's list of priority illegal content, such as fraud, hate and harassment, and its Risk Profiles for your kind of service.
Assess the risk of harm
Judge the likelihood and impact of each kind, using evidence about your users, features and existing controls.
Decide measures and record them
Use measures from Ofcom's Codes of Practice, such as moderation and reporting tools, or your own alternatives, and keep a written record.
Report and review
For small services without a board, Ofcom says reporting can simply mean telling a senior person responsible for online safety.

A printed checklist on a clipboard beside a laptop and a pen on a wooden table — AI-generated image, not a photograph of a real person or place.

06THE SCOPE TEST

Forum or blog
with comments?

A small group of adults seen from behind around a table at a community club evening, laptops open — AI-generated image, not a photograph of a real person or place.

The Act covers user-to-user services with links to the UK: a significant number of UK users, or the UK as a target market. It does not matter what share of the content users post, as long as they can share it.

Schedule 1 exempts limited-functionality services, where users can only comment on or review the provider's own content and react with likes, emoji, votes or ratings. A blog with comments may fall here; a forum where members start their own threads is a different case.

07Questions

Questions people ask

Does the Online Safety Act apply to small forums?

It can. The GOV.UK explainer lists online forums among the services the Act's duties apply to. Ofcom's Regulation Checker tool helps providers work out whether a service is in scope.

What is an illegal content risk assessment?

A written assessment of how likely users are to encounter illegal content on your service, and the impact, for each kind of priority illegal content Ofcom lists, followed by the measures you take.

Do I have to send my risk assessment to Ofcom?

Not usually. Ofcom says you do not need to share the record unless it specifically asks for it or you provide a categorised service.

Are blog comment sections covered?

Schedule 1 of the Act exempts services where users can only post comments or reviews on the provider's own content and react with likes, emoji, votes or ratings.

How often should I review it?

Ofcom recommends at least once a year, and you must do a new assessment before any significant change to how the service is designed or run.

08Sources

A forum is
a regulated service.