India Barlow
One single message to take away, it's that online safety is a governance issue, not a content issue. My ask of every Board would be to get ahead of this now. You know, it's not going anywhere, technology's increasing. And if you're in scope, make sure you're doing that risk assessment and build online safety into your governance, the way that you've already learned to build those other regulations in.
Carly Gulliver
What are people talking to their lawyers about when it comes to tech? Welcome to Inside Tech Minds from Addleshaw Goddard. In this podcast, we're sitting down with technologists, investors, business leaders who are at the heart of the biggest tech deals, innovations and disputes. I'm Carly Gulliver. Let's dive into today's episode.
I'm so excited to be here today on this episode of Inside Tech Minds, where we have some very special guests from Ofcom and also our very own India Barlow to talk about the Online Safety Act and it's brilliant that we actually get the opportunity to do this live in our AG lab. So I'll hand over to my guests to introduce themselves, India.
India Barlow
I'm India Barlow. I'm a Managing Associate in the global investigations team and I specialise in anything crime related for corporate, so financial crime, health and safety and now specifically online safety.
Carly Gulliver
Brilliant. Taymar?
Taymar Houghton
Hi, it's great to be here. Thank you for having us. So yeah, my name is Taymar Houghton. I'm a policy manager at Ofcom. I've been there for four years now. I specialise in the protection of children and before joining Ofcom, I worked in the prison service and then in Greater Manchester Police looking at threat intelligence.
Carly Gulliver
Wow. That sounds like a super interesting career.
Taymar Houghton
It was, yeah.
Carly Gulliver
Well maybe we'll get some interesting tales about that later on. And Matt?
Matt Cotton
Yeah, hi everyone. I'm Matt Cotton. I'm a senior associate at Ofcom in our supervision team that's specifically leading our compliance function. So, we're all about making the online safety regulations accessible and attainable for all services. I've been at Ofcom coming up to three years now and prior to that I was at the ICO where I worked in the innovation department.
Carly Gulliver
Wow, so you've got lots of experience in the enforcement arena, it sounds like. Great. So I've got the perfect guests on here to talk about online safety. But actually I'm just gonna start with a really basic question before we get into this. For our listeners who aren't as familiar with regulators, if you like, what is Ofcom? What's its role?
Taymar Houghton
Yeah, absolutely. Ofcom is a communications regulator. So, it looks after online safety, telecoms, post and even radiowaves. That's our spectrum department. And we’re here today, obviously to talk about online safety and the Online Safety Act in particular. If it's helpful, I can give you a brief overview of what the Online Safety Act is and what our role is within that.
Carly Gulliver
Brilliant yeah, you just guessed my second question.
Taymar Houghton
Excellent. So, the Online Safety Act is, it's got a really simple message and a really simple objective. And that is to create a safe life online for UK users. But particularly so for children. And it does that by, well, we expect services to be assessing risks on their services, managing those risks and mitigating them. And by mitigation, we mean taking steps to ensure that users aren't answering harmful content online. We've done this through three core pillars, and if it’s helpful I can go into a bit more information about what we've done over the last couple of years.
Carly Gulliver
Brilliant.
Taymar Houghton
So last year, our illegal harms duties came into effect and that was in March 2025. And then in July 2025, our protection of children duties came into effect and that's looking at legal but harmful content. It's not necessarily illegal content, but content that's more harmful to children. That's things like pornography content, suicide, self-harm, eating disorders. And we're also currently working on a further bucket of additional duties. They are going to apply to our categorised services, which are typically larger services. And that's going to strengthen things like our image abuse offenses and also crisis response protocols as well.
Carly Gulliver
Sounds you've been very busy over the last few years. Definitely have your hands full.
India, if I can ask you, obviously this podcast is called Inside Tech Minds. What relevance does this have to tech and to the people who are listening to this from companies and business leaders? Why is the Online Safety Act relevant to them?
India Barlow
Yeah, so I think it's relevant to a lot of our clients because the scope of the legislation is so broad. So I think the way it's portrayed in the media is very much it's a social media problem and it's social media companies and those giant tech platforms that need to be getting to grips with this. But actually the way in which the Online Safety Act is worded is it's very broad, it's very wide. It can apply to a whole host of sort of businesses that don't necessarily think they're within scope. So if you've got a customer-facing website and you can sort of engage in any way, you can upload, you can share, you can generate anything, you can comment, you know, I'm thinking sort of gaming websites, and any sort of comments, forums, any direct messaging ability, if you've got sort of fan pages, all these things can fall within scope. And it's not necessarily what companies understand. And I think that it's that perception that we're trying to change amongst businesses, that it's not just a social media problem. It's actually an issue if you have an online consumer facing platform.
Carly Gulliver
When I think of companies and, you know, our clients, lots of companies have those functions that you just described, whether or not they're tech companies. So, it sounds as if it could have a very wide remit.
India Barlow
Yeah, definitely. I mean, obviously, we've got Ofcom in the room, so I don't want to say figures that might not reflect their understanding, but I believe it's around 100,000 new companies come under the remit of Ofcom because of this legislation. So, if you think that's up to 100,000 new businesses that are actually going to be regulated by Ofcom because of this legislation, and that is, you know, quite a lot of companies that probably aren't aware that they're within scope. You know, for example, we've had clients who were adamant they were not within scope, but even just the ability to send, for example, messaging with the payments that would bring you within scope.
And it's not necessarily something that a bank would think that they need to think about, but it is, it's relevant across all different sectors. And I think that's what's really interesting about it because it's relevant across a wide range of sectors and it's not often you sort of get a legislation that is that interesting in the regulatory and legal sphere, but also sort of a legislation that everyone's talking about at home. This is a complete, you know, a thing that everyone in their homes are talking about. It's relevant not just to us in the regulatory sphere where we kind of find a novel interesting legislation and get passionate about it. It's relevant to most people because everyone cares about online safety, specifically for children as well.
Carly Gulliver
It sounds like it. And to our Ofcom guests, you know, for Boards who have only a headline understanding, what is the Online Safety Act trying to achieve from your perspective? And also, where are we then with the implementation of this in terms of timeline?
Taymar Houghton
The Online Safety Act is essentially just trying to achieve a safer life online for all users, whether it's every single UK user, whether they're adults or children, but more so for children. And I've talked a little bit about the duties that have been in place to protect people. In terms of implementation in particular, I think we're in a place now where we're moving away from setting up the regime and setting the rules into motion. We were doing that for the first four or five years. Last year, 2025 was very much our year of action. So that's where we started to take enforcement against services that weren't complying. Examples include pornography companies that weren't implementing age checks. And, you know, we have open investigations of services that aren't complying with children's safety duties. And I think at the moment that continues to be one of our core priorities, but we are still having to operationalise and implement the remaining parts of the Act. It's not finished yet. I mentioned earlier our additional safety duties that are going to be coming into play in about autumn this year.
And we have lots of work coming through next year. You know, we're looking at transparency notices, researcher access, and of course, online safety is not a static space. It is constantly evolving and moving and you can see that through new and emerging government legislation. And that's something that we obviously work very closely with the government on, and that's going to feed into whatever else we implement kind of moving forward as well.
Carly Gulliver
I can imagine it's a real moving feast given how dynamic tech is and the online space is. So I can completely get that. Thank you. And India, so when clients have first come to you about the Online Safety Act, what are their top questions or concerns at the moment?
India Barlow
Yeah, so I think the first question is always, does this even apply to us? Like I was saying earlier, there's sort of this widespread assumption that this is a law for big social media platforms only. And sort of my early conversations with clients are about changing that perception. So, once they sort of understand the breadth of the regime, their concerns quite as quickly shift into more, you know, what do we actually need to do and by when? So I think that's the first question we always get asked. This is definitely not one for us, you know, it's for a social media platform.
And then I think the second theme is sort of around proportionality. So, what do they actually need to be doing? Do they need to rip up their online products and start again? And I think that's not at all what the Online Safety Act requires. And my answer to that is very much it's a risk based and proportionate by design regime. So, for example, a small, low risk service wouldn't be expected to do what sort of a global giant platform would do. But I think the key point to drill home is you still have to do the work. So, you still have to demonstrate that judgment. You still have to do the underlying risk assessment and evidence why your approach was proportionate. And I think that's kind of one of the key things we're trying to say to businesses is even if you're not within scope, make sure that's right. Don't get caught out by an assumption that it's not relevant to you just because you're not a social media platform.
And then I think the final thing I would add is the increasing question that we get asked and we always do with sort of corporate offences, is where does the personal exposure for directors hit? And I think that's another key thing is understanding our individual liability. And one of the areas I think perhaps a lot of businesses don't understand is the information duties. They can carry personal liability for directors. So we have had clients receive Section 100 notices and just not sort of see it as a key issue, not respond and be in quite a difficult position where they could potentially face personal liability, up to £18 million fines or 10% of worldwide revenue, depending which is greater. So this is definitely not something to kind of just see as an unimportant information notice that doesn't apply to you. It's something that you kind of properly need to be aware of and plan for.
Carly Gulliver
That's really interesting to me as a corporate partner because I've definitely seen the directors' duties landscape evolve over the years and you know, it's not just the Companies Act and whether you've got a conflict, interests of shareholders, interests of employees and things like that that you have to think about. Think about corporate governance, corporate manslaughter potentially. And now this Online Safety Act feels like something which is going to be bang in the minds of directors, or it certainly should be.
But one thing that really jumped out to me there, India, is that you mentioned this can catch so many different types of companies and services. Matt, what would you say in terms of the types of services this could capture that people might not intuitively think about when they think of this Act?
Matt Cotton
You've got three kinds that the Online Safety Act covers. So you've got services that host pornographic content, you've got search engines, and that will feel really familiar for a lot of the listeners when they're thinking about who this applies to. And then there's this other bucket that we call user-to-user services. And that's sounds really broad. It's kind of like, what does that mean? And I think that's where it can really capture most people. So when we talk about user-to-user services, we're talking about services that allow users to interact with one another.
So imagine users can send direct messages, they can share files, images, audio, and so on. And these examples can be found across loads of different industries. I think India mentioned a few of them, you know, dating, gaming, discussion forums, and so on and so forth. And you were absolutely right. That we estimate there's about 100,000 services that come into scope here. So there's a real variety in terms of size. You've got large well-resourced services, you've got tiny services that are just like micro businesses. They can be largely or entirely based in the UK, they could be multinational, they could be based anywhere in the world, but the crucial point is whether they've got UK users and I think one thing that I'd like to reflect on as well is that there's a lot of discussion at the moment about AI and its uses across society. And I think it would be really important for me to highlight that in some ways, AI services can be caught in the Act as well.
Carly Gulliver
One of the things I often hear as a tech lawyer, particularly when clients or businesses are talking to me, is the balance between innovation and regulation and making sure that regulation doesn't stifle innovation. So, I mean, what would you say to businesses who are concerned that this could kill their road map?
India Barlow
I completely understand the sort of anxiety around that. But I would definitely sort of push back on that idea. The businesses that are saying this, I think, are picturing sort of worst-case scenarios here where they have to kind of rip up their whole product and start again. And I think that's rarely what the Act actually requires. Like I said earlier, it's a risk-based and proportionate Act, and the obligations will scale with the risk of your service. So it will depend on the size, the nature, what your risk assessment says. And I do feel I'll probably repeat myself a few times about the risk assessment, with any sort of regulation in this area, whether it be health and safety or bribery, money laundering, it all starts with that fundamental risk assessment, the underlying risk assessment. What harm does your service actually give to users? And I think that's where you start.
So I think for most organisations it's about adjusting how you build, not completely abandoning what you have built. And the way I would frame it is it's more safety by design as a feature. And if you bake that into your assessments and your product development lifecycle early, the same way that kind of any mature business would do now with data protection or security, it becomes a kind of routine design input rather than a later stage roadblock.
The other thing I would add is there's a kind of another competitive element here. So, trust is increasingly what users are actually buying. As I said earlier, this is sort of a household topic. And I think if you as a service can demonstrate that you take safety seriously, particularly in the context of children, you have an advantage there. You know, users want to feel safe online now. People do want this legislation. So, I do think that for companies that can do this the right way and move to a way where they innovate responsibly, it will become a good thing in the long run. It's sort of about not stifling innovation. And it's a tough challenge and it's a kind of tough balance to get. But if you could innovate in the right way, it's definitely going to be that companies that are able to do that are able to operate in this sort of more regulated market better.
Like I say, it's a tough challenge, but I think if you get it right, it'll be those companies that do well in the new regulatory landscape.
Carly Gulliver
That’s a really interesting perspective, India, in terms of that advantage for your brand. It sounds as if it could be really brand enhancing if you get this right, and particularly if you're one of the first people to get this right. Is that your view as well?
Matt Cotton
I think there are some really key points here. So we absolutely do accept that both innovation and growth are huge priorities for this country and especially this government and that's not going to go away. But to be really, really clear, so is online safety. And so, I think one of the key messages we'd really like to get across is that we're not out here to penalise small, low risk services that are trying to do the right thing. But we are absolutely committed to making it as easy as possible to understand and comply with, particularly for those that want to get it right.
And in our approach to that, we've launched our digital support service and a host of other resources to help companies understand how to comply. So, we've got tools that you can use to make sure you understand which rules apply to you. So you just answer a few simple questions and it will give you the outcome there. We've got step by step guides that really guide you through the process, help you do your risk assessments, understand how you keep records or like what safety measures are most appropriate for your platform as well.
And you know, these have been used thousands of times. So, we know that there is some real value there. And when we're designing those, we're really listening to those companies that are in scope of the Online Safety Act. So, we've done lots of research, we've done lots of testing with them, because we really want to understand what some of those barriers are that they face, because we recognise absolutely that particularly new legislation and regulatory frameworks, it can feel slightly overwhelming or slightly complicated. And so we really wanted to tackle that kind of head on and make sure that we could use some of those findings to inform what we were doing.
And we'll continue to launch more practically focused tools as well. And we will be launching some new ones later on this year, focused on about like helping some of the platforms make some of the changes that they need to make to comply with the Act. And so I'd absolutely agree with you that the Online Safety Act won't kill your product roadmap, but I do think that the roadmap will need to be built with user safety in mind. And that's quite right. And that's in recognition that there is a cost to doing business in the UK now if you're an online service, because we're asking them to carry out risk assessments, we're asking them to introduce new systems and processes that they might not have previously had to prioritise. And that's because unfortunately we know that harm can exist on any platform, even on the smallest ones. And so it's really important. And I think this is something that we'll keep coming back to regularly actually, that companies are thinking about safety by design from the outset and putting in place those appropriate safety measures. And that's really at the center of the Act and Ofcom's approach to implementing it as well, which is about tackling harm, protecting users in the UK, but doing so in a way that's both risk based and proportionate. And India again, you know, completely agree with you that the more onerous requirements here fall on those that are the largest and highest risk as well. So that proportionality does exist and the support from Ofcom is out there and available through the tools and resources that we've delivered.
Carly Gulliver
Brilliant and I love the spoiler alert. Listeners, you heard it here first that there will be some new tools launching too. And are those tools free for the general public?
Matt Cotton
Absolutely free. And I think, you know, I guess the USP here is that it's coming from the regulator. So that should be the authoritative voice to give you the assurance that you understand what you're doing as well.
Carly Gulliver
Excellent. I love the sound of this already. So we've heard from India that it would be important to do a bit of a risk audit to understand whether this applies to you and exactly how and where it will apply. And then you can just shoot straight over to the Ofcom website and have a look at what free tools are available and how to implement it.
One thing that you mentioned there that really spiked my curiosity is this, you know, the phrase around safety by design. And India, you'd mentioned that as well. But what does that actually mean for a service and why is that central to your approach?
Taymar Houghton
Yeah, absolutely. So, I think when people hear this term safety by design, they assume it's quite a technical term. It's really not. It's a really simple principle. Just means don't wait for harm to happen before you address it. So exactly what India is just saying, think about safety when you're designing your products and your features and when you're thinking about that user journey. And I think it's really important to remember that Ofcom's role isn't to moderate individual pieces of content. We're here to regulate the systems, the processes and those governance arrangements that kind of sit underneath that user experience. So, for online services, what I'll be recommending today is when you're thinking about safety by design, think about how things like recommender systems, your messaging functions, your platform features, how they might be creating risk. And obviously we're doing that for your risk assessments, which India spoke through, and then be taking steps to reduce those risks. And obviously we've got our recommended duties and our recommended measures, which you can follow.
Some practical examples include, your robust risk assessment, testing products before you launch them is really important. Among those recommended measures is the governance structures. So we know we say providers should have an individual who's accountable to the senior governance body for compliance. That helps them to comply with their duties underneath the Act and make sure they're following those measures as robustly they can be.
And I think this is what Matt was getting at, that safety by design to work as an approach, it really needs to start at the very, very top. Like it is about cultural change. It needs to have the right people in the right room having the right conversations at the earliest possible stage it can do. And I think the reason it's so important for the Online Safety Act and for Ofcom is that it moves away from being reactive to harm online, to just preventing it from happening in the first place.
Carly Gulliver
And we always say, don't we, prevention is better than cure.
Taymar Houghton
Exactly.
Carly Gulliver
What you just said there in terms of whose responsibility is it and when should they start thinking about it, that really chimes with quite a few conversations we're having with businesses generally in terms of, even when you think of AI, we've spoken with experts around who’s responsibility is the ethical governance implications which surround AI to make sure that AI is adopted properly. It's inevitably the Board responsibility, but then also it filters through every layer of the organisation. So, it feels as if that's very similar to some of the other themes that we're talking about at the moment. Obviously AI is a tricky subject and it's still generative AI, it's still relatively new for some Boards and on their agenda. So is there a particular way that Boards need to be thinking about this in the context of generative AI or things like personalised feeds?
Taymar Houghton
Yeah, absolutely. It's fantastic question. I think it's something we're having to talk about and face every day at the moment. I think before we get into it, what's really important to understand is that the Act itself, the Online Safety Act, was written in a way that was intended to be tech neutral. So that means that it covers emerging technologies. It doesn't just specify particular pieces.
So that means that obviously internally, we are thinking about generative AI, we have those discussions every day. It doesn't mean that we haven't identified gaps in legislation. Sometimes it doesn't all fit perfectly and we do have to go back to government and kind of flag where things might not be working and work on ways to strengthen that legislation. But ultimately, services do still have responsibility in relation to AI functionalities. So those services in scope are still responsible for understanding the risks that are on the service and managing those risks just like, every other in scope service is. And Matt's already pointed to some of the tools that we've used to help services understand their responsibility. We've also published an open letter recently to providers, which explains their duties in relation to AI features and functionalities. So that includes AI tools and AI chatbots. And we also have our supervisory function where we do have a lot of informal one-on-one engagement with service providers, and those conversations will be happening there as well.
Carly Gulliver
You know, for the listeners, what sorts of things do personalised feeds capture?
Taymar Houghton
In terms of personalised feeds, I wouldn't necessarily call it an emerging tech because I talk about that as like recommender systems. That's your algorithmic generated kind of fed content. The reason I wouldn't call it an emerging technology is because it's actually called out specifically in the Act. So I think we mentioned recommender systems as something that services need to mitigate risk of harm from, especially for children we know, Ofcom research has shown that recommender systems are a pathway to harm for children. There's no doubt about that. And we have recommended measures around that, which includes exclusion of content harmful to children on children's feeds. So I think, kind of going back to that overall question around emerging technology, the answer is that whether it's artificial intelligence, whether it's recommended systems, personalised feeds, or whether it's something brand new that we've not heard about yet, that's probably going to come down the path tomorrow. Services will still ultimately have the same responsibility under the Act to manage that risk, whatever that risk is creating for users. So the tech is always going to change, it's always going to evolve, but that responsibility will never change.
Carly Gulliver
What is a recommended system? Could you give me some examples?
India Barlow
So it's an AI tool essentially that predicts what a user would like or what would want. So for me, for example, it keeps showing me clothes and it's causing me an issue. So, I think it's that kind of thing where, you know, for me it ruins my bank balance. But for children, for example, I've seen instances where it recommends, you know, diet pills, it recommends you know, harmful content because of the nature of what that person's doing online. It then pushes the certain type of content so that's what a recommender system is. It's sort of recommending to the user what they should look at.
Carly Gulliver
Well, indeed not the only one whose bank balance recommended systems impact, also impacts my bank balance as well. But also on the plus side it does improve my wardrobe.
India Barlow
Yeah, you look nice. Exactly.
Carly Gulliver
So from a regulator's point of view, what conversations would you like to see Boards having if they're not having them yet? Because you clearly, I think we all agree that this is really a Board issue.
Matt Cotton
Yeah, I totally agree with that and I think our hope here is that we would we would also like expect Boards to be having those conversations about how services can be safe by design for their UK users. So for example, we would expect them to be holding their executives to account for user safety and ultimately compliance with the Online Safety Act as well. And really they should see this as something that's as critical as scaling user numbers, revenues and profits as well. I think it's equally as important.
And it's not a tick box exercise, you know, this now is fundamental to services' ability to operate within the UK. And I think a really important thing to note is that this isn't just Ofcom and he UK that's doing this at the moment, you know, online safety regulation is becoming global conversation. I think we're seeing that now in lots of different jurisdictions. They're introducing new legislative frameworks around this.
And so really, you know, it should be front and center of Board agendas. And, you know, maybe perhaps some of those conversations haven't taken place in the past. Well we would like to see Boards getting ahead of the curve here and really putting user safety firmly on the agenda rather than being reactive to regulation. So, you know, we'd like to see them being proactive and making sure that this is being prioritised.
Carly Gulliver
And what you just said there about it not being a tick box, that really resonated with me because of course so many compliance issues really can't be treated as if they are just a tick box exercise. India, any practical tips there in terms of, you know, a checklist if you like, when businesses are starting to think about the Online Safety Act and compliance?
India Barlow
Yeah, so I would echo what Matt said. This isn't a tick box exercise. This sits more comfortably where the risk of bribery, health, and safety sit, a Board level issue that requires governance and oversight. And what I sort of say to clients is a three-step process that they should take. So first they should scope it properly. Work out whether they're actually a regulated service – like I said, Ofcom have got a tool to do that. AG have got a tool to do that. There's various different tools that can help you do that. I think the tools take about two minutes. So, you know, work out whether you're a user to use a service, whether you're a search engine. Whether your service is likely to be accessed by children, because the duties depend on which one of those categories you fall into. And then make sure you document that analysis.
So I think everything flows from getting that right. And that's also the first line of defence if our friends at Ofcom ever do come knocking. And then second, when you know if you're in service or not, carry out and record your risk assessment. So I've talked about it earlier and I feel like as a compliance lawyer, I do say this every day of my life. But everything starts with the risk investment, that's the kind of foundation to your whole governance and compliance package, you know, really understand where does the harm sit on your platform and what do you need to do about it. And that will all come from your risk assessment.
Again, make sure that's documented. As Taymar said earlier, it shouldn't be a static exercise. It's a living and breathing risk assessment that will change over time as tech changes, et cetera.
And then I think third and finally, the kind of thing I would say is, what we were saying earlier, it's the Board level issue. So you need to think about governance and accountability. Who owns this at executive level? Put clear reporting lines up to the Board and make sure that someone's genuinely responsible for it. So I think in practice that's naming a senior owner and making sure there's some Board reporting and that they're in charge of, is the risk assessment done properly when things have been developed? Have they been developed with safety by design in mind? And I think those three things, scoping, risk address, and governance is sort of a spine that will build everything else from.
Carly Gulliver
So lots to think about, but a systematic approach with some accountability at Board level sounds as if it's going to be a really solid start and a good way to navigate this. We've heard already that there is such a broad remit for this, both from a services perspective, but also from the fact that it will impact companies of all sizes, micro companies to global companies, also has an international element here. So, it sounds to me like it's a good thing that the Act is built around proportionality and how can organisations think about what is reasonable and proportionate for them? What will Ofcom look for in practice?
Matt Cotton
I think it's useful here to take like maybe a bit of a step back and then think about like the legislation itself. So, you know, I think Taymar spoke about this before as well, that it really it was written in recognition that this would cover a broad range and diverse set of online services. We've spoken before about like, you know, how many that might come into scope with. So then on that basis, the Act really places that responsibility on all companies in scope to take very basic steps to assure themselves and their users that they understand the risks that exist on their service and then the steps that they'll take to manage those. So they all need to carry out a risk assessment to understand how harm can take place on their platform, how it can manifest. And I completely agree with you, India, that they really should view these like risk assessments as kind of a key to determining what action they need to take here.
So there are some measures that we recommend in our codes of practice that will apply to all services. So for example, that will include things like naming an individual accountable for online safety compliance and then ensuring your terms of service are clear and accessible. But then also we really spell out what safety measures we recommend that services should take to keep users safe. We're taking into account things like user numbers or like the features and functionalities of different platforms and also like their inherent risk levels as well and really thinking about those.
And again, I've come back to this point a few times now, but we do recognise that these new regulations can be complicated. It can be really difficult even knowing where to start on some occasions. And just another plug again that it's a really valuable digital tool that we have that really guides you through that process of doing the risk assessment, but it will also tell you which safety measures will be most appropriate for you to implement. And so the way that we approach things really builds that proportionality element into that and that's kind of the approach that services should take when they're facing this. Brilliant.
Carly Gulliver
That's very clear. Thank you. So if organisations are looking for other tips like that and they want to engage with Ofcom, what's the best way for them to do that? And what kind of dialogue would you be looking for?
Matt Cotton
Yeah, and I think this is always of interest to a lot of platforms, especially the ones that really want to get this right. And, you know, I think it's fair to say here, I'd love to be able to give you like the perfect answer, but unfortunately, because of the size of the services that we regulate, we unfortunately can't engage with absolutely everybody. But there are kind of different approaches that we can take here. So we're ultimately focused on the end result. So, we're looking to like secure meaningful changes to online services that will make UK users safer online as quickly as possible. And so the way that we approach that is we communicate our expectations up front. We publish a range of resources to help companies comply with their duties. I've already spoken about some of those today and where they can find those on our website. But we also publish our quarterly industry bulletin that people can subscribe to, and that includes things like milestones and new guidance and statements that they should be aware of, action that we've taken, action that they might need to take as well. So it's a really useful way of being able to stay abreast of some of the developments and what they need to be informed about.
We host a number of different workshops and events. That's always something that's worth looking out for. And we also run targeted campaigns to keep the industry informed as well. On occasion, and Taymar mentioned this earlier about our supervisory function, we do sometimes have that kind of one-to-one engagement with individual services to make sure that they comply. So in that scenario, we would initially make the contact and it will, you know, occasionally lead to those direct meetings. And of course, we would expect in those scenarios that it would need to be a constructive conversation and dialogue at that point. And I think, you know, just to wrap up here, I think it would be really remiss of me not to mention that we can't just exclusively rely on informal approaches here. So yes, we absolutely do recognise that some of those kind of more proactive upstream approaches can be really useful in getting platforms to understand their duties and steer them into making those improvements that we want to see. But we also recognise that where there is a potential compliance breach, you know, we'll need to move swiftly into an enforcement investigation. And we are one of the most active regulators on enforcement internationally, with investigations involving more than 100 apps or online services, even just over the last 18 months. So I think there are a number of different tools and approaches that we take when we think about communicating with services.
Carly Gulliver
So we've covered a lot today in terms of the Online Safety Act. It's broad remit, the things that we're looking to protect, how to go about it. I mean, the message I think has been really underlined around a risk assessment and making sure that you bear in mind things like safety by design and that you do things which are proportionate to your business. And that is a responsibility for the Board. Lots of messages there. But if I can challenge you to leave us with one key message for Boards and other listeners, what would that be, India?
India Barlow
Yeah, so I think if there's one single message to take away, it's that online safety is a governance issue, not a content issue. I think the instinct is very much to see this as something for tech to handle in the background. But the whole architecture, what we've heard today, the architecture of the app, the way that Ofcom are enforcing it, the systematic duties, the risk assessment, the senior management liability, the revenue-based fines is all designed in a way to push responsibility to the top of the organisation. So this is a risk that should sit comfortably with health and safety, financial crime.
So I think my asB of every board would be to get ahead of this now. You know, it's not going anywhere, technology's increasing. And if you're in scope, make sure you're doing that risk assessment and build online safety into your governance, the way that you've already learned to build those other regulations in. And I think any kind of company that can change that mindset and shift to safety by design is going to be a company that sort of gets ahead of this now.
Carly Gulliver
And Ofcom?
Taymar Houghton
Yeah, I really echo India's thoughts, especially around safety by design. I think for us, it would be recognising that it might seem really daunting and a little bit scary. And we're not here to be scary. We have tools and guidance in place to support you and help you because that's what ultimately we want to do. We just want to drive improvement and then help services to do that. And Matt I'll hand over to you to talk about our resources.
Matt Cotton
Yeah, I mean I've spoken about a few of those already, you know, the ones that really guide you through those processes. So I suppose I would just really encourage listeners to go and use those tools, check them out. They're really easy to use. They are designed with you in mind to help you along that process. And again, I would just echo some of the messages today around like making sure that this is prioritised and making sure that that accountability is felt across the organisation. Compliance very often is something that's seen across the organisation and everyone should feel accountable for it.
Carly Gulliver
That has been absolutely brilliant. I've definitely learned a lot and I feel armed to speak to my clients about this. So thank you very much for your time.
