Online Safety Act 2023 commencement brings mandatory CSEA reporting for regulated user-to-user services

Online Safety Act 2023 commencement brings a mandatory CSEA reporting duty for regulated user-to-user services under UK health and safety law

What has changed

The seventh commencement regulations bring into force the duty on providers of regulated user-to-user services to report Child Sexual Exploitation and Abuse content to the National Crime Agency and create an offence related to reporting obligations. The Act also empowers Ofcom to obtain information to support enforcement and compliance with the duty and offences.

Who is affected

The change applies to providers of regulated user-to-user services in the UK. This includes platforms that host user generated content where the provider is subject to the Online Safety Act 2023 duties. Business models that rely on user to user interactions and content moderation are particularly impacted.

Key duties for providers

Responsibilities include implementing robust reporting mechanisms for CSEA content, establishing clear escalation paths to the National Crime Agency, maintaining records to demonstrate compliance, and ensuring staff training and policies reflect the duty to report.

Enforcement and sanctions

The regulations create an offence for failing to comply with the reporting obligation and enable Ofcom to exercise information powers to support enforcement. Organisations should ensure evidence retention, governance and oversight to withstand regulatory scrutiny.

Steps to achieve compliance

1. Identify a reporting lead and formal governance for CSEA content obligations.
2. Confirm contact routes with the National Crime Agency or relevant enforcement bodies.
3. Review and update internal policies, terms of service and moderation procedures to reflect the duty to report.
4. Integrate reporting requirements into incident response plans and training programs for staff and contractors.
5. Implement data handling controls to preserve evidence and support investigations.
6. Engage with Synergos for support with risk assessment and governance alignment, including health and safety risk assessments or Competent Person support as appropriate.

To support governance and risk management aligned with UK health and safety law consider ISO 45001 occupational health and safety management frameworks and engage with Synergos for specialist support.

For ongoing regulatory compliance and risk management you may also find Synergos resources helpful alongside health and safety training.

Timely compliance with the Online Safety Act 2023 commencement will help protect users and demonstrate responsible service operation while reducing regulatory risk for providers of regulated user-to-user services.