Does the Online Safety Act apply to my SaaS app?
It depends on one thing more than any other: whether people who use your app can create content that other users can then see or access. If they can — chat, comments, profiles, listings, shared files, forums, direct messages — your SaaS is likely a "user-to-user service" and the Online Safety Act can apply, even to a small team.
If your app has none of that — it just delivers your own software or content to each customer privately — it is generally out of scope. Many B2B SaaS tools fall on this side of the line.
The two tests that matter
First, the functionality test: does your service let users generate, upload, or share content that other users can encounter? A support-ticket box only you can read does not count; a public feed, shared workspace, or community does.
Second, the UK-link test: do you have a significant number of UK users, or is the UK a target market? If yes, and you meet the functionality test, the Act reaches you regardless of where your company is based.
What "in scope" actually means for a small SaaS
Being in scope does not mean instant penalties. It means you have preparatory duties — most importantly an illegal-content risk assessment and a record of the safety measures you take — that Ofcom expects you to be able to show.
The duties are proportionate to your size and risk. A small, low-risk SaaS is not expected to do what a global social network does — but it is expected to have looked, recorded what it found, and put sensible measures in place.
Not sure if this applies to you?
Run the free scope checker — seven questions, about three minutes, a cited verdict at the end.
Frequently asked
- My SaaS is B2B only — am I exempt?
- Not automatically. A service used only inside your own organisation is exempt, but a tool you sell to other businesses can still be in scope if their users create content others can see. The internal-only exemption is about your own staff, not your customers.
- We have almost no UK users yet — does that help?
- Possibly. Scope depends on a significant UK user base or the UK being a target market. If neither is true today it may be out of scope for now, but re-check as you grow — the position can change.
Sources
- Ofcom — Online safety
- GOV.UK — Online Safety Act 2023
- Ofcom — Illegal harms: risk assessment guidance & Codes of Practice
General guidance to help you prepare records — not legal advice, and following it does not make you “compliant”.
More guides
Want a tool that walks you through these duties when we build it?