WHAT THE LAW AND OFCOM SAY

A forum is
a regulated service.

If users can post for other users, the Act may apply.

The UK Online Safety Act covers services where people share content with each other, and the government's explainer names online forums. For a small community site, the core duty is a written illegal content risk assessment, kept up to date.

When to review Read the short answer

A volunteer's desk at night with a laptop showing a blurred discussion board, a mug and a notebook of handwritten notes — AI-generated image, not a photograph of a real person or place.

01 Check if you're in scope02 Assess and write it down03 Review when things changeProportionate, not one-size

THE SHORT ANSWER

Three duties
for a small site.

Ofcom says its risk guidance works for services of all types and sizes.
The government says small services needn't match the largest companies.

SCOPE

Users talking to users

The Act defines a user-to-user service as one where content posted by one user may be encountered by others, with links to the UK.

The scope test

ASSESS

A written risk assessment

Ofcom requires an illegal content risk assessment, protections against the risks found and a written record of both.

The four steps

REVIEW

Keep it current

Ofcom recommends reviewing at least annually, and a new assessment is needed before any significant change to the service.

When to review

A QUICK TIMING CHECK

When does the
assessment need doing?

Pick a situation to see what Ofcom's guidance says about timing. The bar shows how pressing it is.

From Ofcom's page on illegal content duties (updated June 2026). General information, not legal advice.

Timing check

Choose a situationLaunching a new forumAdding a big new featureOfcom updates its Risk ProfilesNothing has changed

Launching a new forumWithin 3 months

You have three months to complete a risk assessment after launching a service that the Act applies to.

Adding a big new featureBefore the change

If you plan a significant change to the service's design or operation, you need to complete a new risk assessment before making it.

Ofcom updates its Risk ProfilesReview it

You also need to review your assessment if Ofcom makes a significant change to its Risk Profiles, as it did when new priority offences were added.

Nothing has changedYearly review

Ofcom recommends reviewing your illegal content risk assessment at least once a year to keep it up to date.

Source: Ofcom, Illegal content duties under the Online Safety Act.

TWO NUMBERS WORTH KNOWING

Short deadlines,
serious penalties.

One figure on timing,
one on what Ofcom can fine.

TIMING · OFCOM

To complete a risk assessment after launch

3 months

After launching an in-scope service you have three months to complete the assessment, and you must keep a written record of every risk assessment you carry out.

FINES · GOV.UK

Maximum fine, whichever is greater

£18m or 10%

Companies can be fined up to £18 million or 10 percent of qualifying worldwide revenue. Ofcom has set up a taskforce for small but risky services.

The illegal content duties have been enforceable by Ofcom since 17 March 2025. Ofcom's guidance asks services to rate each kind of priority illegal content as negligible, low, medium or high risk.

A printed checklist on a clipboard beside a laptop and a pen on a wooden table — AI-generated image, not a photograph of a real person or place.

OFCOM'S FOUR STEPS

Assess, decide,
record, review.

Ofcom's Risk Assessment Guidance sets out four steps. It says there is no one-size-fits-all approach, and offers a free digital toolkit and record template.

Understand the content to assessWork through Ofcom's list of priority illegal content, such as fraud, hate and harassment, and its Risk Profiles for your kind of service.
Assess the risk of harmJudge the likelihood and impact of each kind, using evidence about your users, features and existing controls.
Decide measures and record themUse measures from Ofcom's Codes of Practice, such as moderation and reporting tools, or your own alternatives, and keep a written record.
Report and reviewFor small services without a board, Ofcom says reporting can simply mean telling a senior person responsible for online safety.

THE SCOPE TEST

Forum or blog
with comments?

The Act covers user-to-user services with links to the UK: a significant number of UK users, or the UK as a target market. It does not matter what share of the content users post, as long as they can share it.

Schedule 1 exempts limited-functionality services, where users can only comment on or review the provider's own content and react with likes, emoji, votes or ratings. A blog with comments may fall here; a forum where members start their own threads is a different case.

A small group of adults seen from behind around a table at a community club evening, laptops open — AI-generated image, not a photograph of a real person or place.

QUESTIONS PEOPLE ASK

Frequently asked

Does the Online Safety Act apply to small forums?

It can. The GOV.UK explainer lists online forums among the services the Act's duties apply to. Ofcom's Regulation Checker tool helps providers work out whether a service is in scope.

What is an illegal content risk assessment?

A written assessment of how likely users are to encounter illegal content on your service, and the impact, for each kind of priority illegal content Ofcom lists, followed by the measures you take.

Do I have to send my risk assessment to Ofcom?

Not usually. Ofcom says you do not need to share the record unless it specifically asks for it or you provide a categorised service.

Are blog comment sections covered?

Schedule 1 of the Act exempts services where users can only post comments or reviews on the provider's own content and react with likes, emoji, votes or ratings.

How often should I review it?

Ofcom recommends at least once a year, and you must do a new assessment before any significant change to how the service is designed or run.

SOURCES

Where the facts come from

Each figure on this page comes from the sources below. Check them for the full detail and context.

A forum isa regulated service.

Three dutiesfor a small site.