The Online Safety Act for agencies with client sites
If you build or run websites for clients, the key question is who is the "provider" of each service — because the Online Safety Act duties sit with the provider, not with whoever wrote the code. Usually that is your client: it is their service, their users, and their control over what the site does.
But the line can blur if you also operate or moderate the service on the client’s behalf. It is worth making the responsibility explicit rather than assuming.
Who holds the duties
The provider is broadly the entity with control over the service and its user-to-user or search functionality. For a site you merely build and hand over, that is the client. Where you host, operate, or moderate on an ongoing basis, responsibility can be shared or less obvious.
Whichever it is, a site that lets users post content others can see, with a UK link, is in scope for someone — so it should not fall between the cracks.
What agencies should do in practice
Make responsibility explicit in your contracts: state who is the provider for OSA purposes and who does what. Flag to clients when a feature you are building (comments, forums, profiles, uploads) brings their service into scope, so they can prepare their risk assessment and records.
This protects both sides and means the client can meet their duties knowingly rather than by accident.
Not sure if this applies to you?
Run the free scope checker — seven questions, about three minutes, a cited verdict at the end.
Frequently asked
- If I just build the site, am I liable under the OSA?
- Generally the duties sit with the provider — usually your client, who controls and operates the service. Building it to spec and handing it over does not normally make you the provider, but if you also run or moderate it the position can differ.
- Should OSA responsibility be in the contract?
- Yes — stating who the provider is and who handles which duties avoids ambiguity later and helps the client prepare. It is cheap insurance for an agency.
Sources
General guidance to help you prepare records — not legal advice, and following it does not make you “compliant”.
More guides
Want a tool that walks you through these duties when we build it?