UK OSA Section 12(3)(b) and 12(9)(c) - Non-designated content that is harmful to children (regulated user-to-user services)
Operate proportionate systems to mitigate and manage risks from other content harmful to children that falls outside the primary priority and priority content tiers
Where this comes from
Provision: Section 12(3)(b) and 12(9)(c) - Non-designated content that is harmful to children (regulated user-to-user services)
Instrument: UK Online Safety Act 2023
Citation: Online Safety Act 2023, c. 50, s 12(3)(b) and s 12(9)(c), read with s 13(2)-(4); s 60(2)(c) and s 60(4) (non-designated content that is harmful to children); s 11(5) (duty to notify OFCOM)
Text version: Online Safety Act 2023 c. 50, revised text as displayed on legislation.gov.uk on 2026-09-21 ('up to date with all changes known to be in force on or before 21 September 2026'), including the amendments made by the Crime and Policing Act 2026 in force from 29 June 2026 (S.I. 2026/689) and s 66 in force from 7 April 2026 (S.I. 2026/262). The as-enacted text is superseded.
Who it applies to
Child audience (designed for OR likely accessed by children) — any one of these:
- Service is specifically designed for children under 18
- Service is likely to be accessed by children under 18
Remaining applicability scope — all of these:
- Service allows user-generated content
- Youngest user age is Under 13 or 13-15
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Known-illegal media is matched against a hash database (e.g. PhotoDNA-style) before or at upload
- Harmful content can be removed within the required statutory window (e.g. 24 hours) once notified
- Confirmed CSAM/CSEA is reported to the designated authority and preserved per legal requirements
- Re-upload of removed content is prevented (hash/fingerprint blocklist)
- Removal actions and reports are logged with actor, timestamp, and legal basis
Questions people ask
- Does UK OSA Section 12(3)(b) and 12(9)(c) - Non-designated content that is harmful… apply to my service?
- It applies when at least one of: Service is specifically designed for children under 18; Service is likely to be accessed by children under 18; and Service allows user-generated content; Youngest user age is Under 13 or 13-15.
- From when does this apply?
- UK OSA Section 12(3)(b) and 12(9)(c) - Non-designated content that is harmful… applies from 10 January 2024. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.