Online Safety Act: which product control should change before the next feature ships?

A small feature can redraw the risk map. Add public comments, private messaging, live video or file sharing and a service that looked like a publisher may now expose UK users to new forms of illegal content or harm to children. Online-safety duties are already in force, Ofcom has opened investigations, and its risk-assessment material was updated again in June 2026 for new priority offences. The acquisition opportunity is not a generic “Online Safety Act audit”; it is a short product-safety sprint tied to a launch, an overdue review or a control that no longer matches how the service is used. This reading shows how to decide scope, separate illegal-content and children’s assessments, connect risks to product measures and build a recurring evidence cycle. It also distinguishes current requirements from measures still moving through consultation or parliamentary steps, so a campaign can create urgency without inventing a deadline.

The Act can cover UK-linked user-to-user services, search services and certain providers of pornographic content. Scope turns on functionality and links to the United Kingdom, not a company’s preferred label. A marketplace, game, creator tool, forum, dating product or file-sharing service can therefore require assessment even when “social network” never appears in its business plan.

The first step is a functional inventory. Can users upload, share, encounter or search content generated by others? Who can see it? How is it recommended? Does a partner or embedded feature alter the user journey? The conclusion should identify the legal entity providing the service and retain the evidence behind any exclusion.

Ofcom’s checker and guidance support this triage but do not certify compliance. Borderline services need specialist advice before public claims are made. The commercial sprint should sell a documented scope decision and next action, not a badge.

Illegal-content risk assessment, safety, reporting, complaints and record-keeping duties are active for in-scope services. Children’s access assessment and, where relevant, children’s risk and protection duties are also active. Ofcom states that many duties are ongoing: assessments and measures must remain current as products, evidence and risk profiles change.

This matters because many firms completed a first assessment in 2025 and treated it as a launch document. Ofcom recommends reviewing illegal-content assessments at least annually and requires review before a significant service change. Product roadmaps should therefore contain a safety gate alongside privacy, security and commercial approval.

The governing body does not need to become a moderation team. It needs an intelligible account of material risks, control choices, exceptions and unresolved decisions. Small services can assign that responsibility to a senior manager; scale changes the evidence expected, not the need for ownership.

Ofcom updated its illegal-content risk-assessment guidance, risk profiles, content-judgement guidance and record-keeping material on 25 June 2026. Services must account for new priority offences concerning encouragement or assistance of serious self-harm and cyberflashing, and review assessments when the updated profiles materially affect their risk picture.

Other measures announced in 2026, including amendments on intimate-image hash matching and crisis response, had expected future commencement subject to the required process. A responsible implementation map marks each item as active, announced or proposed. Treating all three as identical leads either to premature cost or late compliance.

A paid sprint should select one service or significant feature, confirm scope, map users and functionalities, test the current risk assessments, trace priority harms into controls and produce a decision log with owners and dates. It should not attempt to outsource the provider’s accountability or promise that following a template makes the product compliant.

The most buyable trigger is specific: launching live chat, opening a UK service, introducing recommendations, adding adult content, preparing an Ofcom information response or updating a year-old assessment. A two- to four-week sprint can finish with a risk delta, control backlog and governance decision.

Illegal-content and children’s assessments examine different duties and harms, even where they use overlapping evidence about users, features and content. Ofcom says providers must keep separate, clearly identifiable records. A single blended heat map can therefore hide whether each assessment followed the required process and led to the appropriate measures.

The children’s access assessment asks whether the service is likely to be accessed by children. If it is, the provider assesses harmful content and how design, algorithms, contact and commercial features affect exposure. Evidence may be reused, but conclusions and records should remain traceable to each duty.

Age assurance should be selected against the duty, service risk, user journey, accuracy, privacy and opportunities for circumvention. A date-of-birth box is not automatically highly effective age assurance. The provider must explain why its chosen method works for the relevant access decision and what happens when confidence is low.

The design should include failure, appeal and accessibility paths. Product teams also need to understand data minimisation and vendor dependencies. The safest commercial message is about the outcome the control supports, not a claim that a particular vendor makes every service child-safe.

Terms should explain prohibited content and the measures the service actually applies; moderation should execute those commitments; reporting and complaints should reveal where decisions fail. If policy, tooling and user outcomes diverge, the provider needs a documented correction rather than a new paragraph in its terms.

Sample testing follows a content event from detection or report through classification, action, user notice and appeal. The provider can then measure decision consistency, speed and recurrent causes without publishing unsupported safety percentages.

A recurring service should review material product changes, refresh risk evidence, sample moderation and complaints, test control actions and prepare governance reporting. Its cadence follows change and risk—not an arbitrary monthly checklist. The provider remains responsible for legal decisions, system operation and any response to Ofcom.

Quarterly testing may suit a fast-moving service; an annual assessment plus event-driven reviews may fit a lower-risk product. The contract should state data access, independence, escalation and what requires legal counsel. That clarity protects both delivery quality and margin.

Strong buying signals include a UK launch, a new interactive feature, an assessment older than a year, children accessing the service, an Ofcom request, repeated moderation complaints or dependence on updated risk profiles. Search, developer communities, sector partners, events, calls, email and targeted voicemail can reach product, trust-and-safety, legal and executive owners.

The message should lead with the feature and decision: “What changed in your risk assessment when private messaging launched?” A short screen confirms scope, sponsor, evidence access, urgency and capacity. Fear-based claims about maximum penalties are less useful than a precise route to the next governance decision.

The offer is ready when the partner can analyse product evidence, distinguish current duties from proposed measures, deliver a bounded sprint and support recurring testing without taking over the provider’s accountability. GetFishNet’s free eligibility test checks the buyer, proof, capacity, margin and market reach before recommending a campaign.

The service may also address non-UK companies serving UK users, but scope and buyer access must be requalified. If the partner only sells generic policies or cannot inspect product behaviour, another acquisition angle should be chosen.

Authorities cited: Ofcom; Department for Science, Innovation and Technology; UK Legislation. Dated references remain in the private source register.