The UK Online Safety Act – Herzog’s Practical Playbook
22 February 2026
The UK Online Safety Act 2023 (“OSA“) establishes a comprehensive statutory framework governing the safety obligations of online services with a connection to the United Kingdom.
The act applies not only to services established in the UK, but also to services based outside the UK where they enable access by UK users or where their operation gives rise to a material risk of harm to users in the UK.
Under the OSA, compliance is service-specific and depends on the nature of the service, its features, its user base and the risks it presents. Providers are required to identify how illegal content – and, where relevant, content harmful to children – may arise on their services, and to implement proportionate systems and processes to address those risks.
The obligations under the OSA and its related statutory codes of practice are ongoing in nature. Services are required to maintain, document and periodically review their assessments and measures as the service, its features and patterns of use evolve. Risk assessments, governance decisions, and mitigation measures must be integrated into the operation of the service and be capable of being substantiated to Ofcom upon request. Providers are required to have regard to the regulatory codes of practice and may comply either by following them, or by adopting alternative measures, provided they can demonstrate that those measures achieve equivalent compliance outcomes.
To assist with understanding and navigating between the various regulatory requirements and the layered system of duties, we are pleased to share Herzog’s OSA Practical Playbook, providing explanation about its scope, key practical takeaways and insights.
