Services Caught By The OSA Need A Crisis Response Protocol, Says Ofcom

If you are a user-to-user (U2U) service in scope of the U.K.'s Online Safety Act 2023 (OSA), Ofcom has recommended, in a June 9, 2026, statement, you adopt a written crisis protocol to mitigate and manage risks arising from a significant increase in relevant illegal content and/or content harmful to children on your service. Certain providers should also have a dedicated communication channel through which law enforcement can contact them during a crisis. Ofcom has published draft consolidated Illegal Content Codes of Practice and Protection of Children Code of Practice for user-to-user services reflecting this recommendation.

What are the new measures and who should implement them?

(table reproduced from pages 4-5 of Ofcom's Crisis response protocol Statement, June 9, 2026)

What is a “crisis”?

Ofcom defines a crisis as:

“An extraordinary situation in which there is a serious threat to public safety in the U.K. which is highly likely to:

• have resulted (in whole or in part) from a significant increase in relevant illegal content and/or content harmful to children on a service, and/or
• have caused, or cause, a significant increase in relevant illegal content and/or content harmful to children on the service.”

Whether a situation is extraordinary or not is not dependent on where it is or how large a geographical area is impacted.

What are relevant harms for these purposes?

Relevant illegal content is content connected with the priority illegal harms in scope of this measure: terrorism, hate, harassment, stalking, threats and abuse, and foreign interference. Relevant content harmful to children, refers to content harmful to children in scope of this measure: abuse, hate, violent content. Combined, Ofcom refers to them as “relevant content” or “relevant harms”.

What should be included in the internal crisis response protocol?

As a U2U service provider, you should prepare and apply a written internal protocol for identifying and responding to a crisis. The protocol should set out how you will mitigate and manage the risks arising from a significant increase in relevant content during a crisis and, where relevant, the increased risk of the service being used for the commission or facilitation of a priority offence during a crisis.

The protocol should include:

• indicators identified by you that you will consider in determining whether a crisis is occurring or is likely to occur (Ofcom sets out a non-exhaustive list)
• how you will regularly monitor those indicators to make that determination
• how you will keep the indicators under regular review to ensure they remain relevant
• details of a crisis response team, including representatives of sufficient seniority from relevant internal teams, to facilitate timely decision-making and action
• how you will deploy the crisis response team as soon as reasonably practicable if you determine that a crisis is occurring or is likely to occur
• systems and/or processes you have identified to mitigate and manage the risks arising from a significant increase in relevant illegal content and/or content harmful to children on the service during a crisis, and (where relevant) the risk of the service being used for the commission or facilitation of a priority offence (Ofcom provides relevant examples), and
• how you will deploy those systems and/or processes as soon as reasonably practicable if you determine that a crisis is occurring or is likely to occur.

How to respond to a crisis

You should deploy the reactive elements of your crisis response protocol i.e. your crisis response team and relevant systems and processes, as soon as reasonably practicable once you determine that a crisis is occurring (or is likely to occur) on your service.

If you are a provider of large in-scope services and determine that a crisis is occurring or is likely to occur, you should implement a dedicated communication channel for law enforcement in relation to the crisis to facilitate relevant time-sensitive communication in both directions.

Once a crisis is over—or after 90 days since you determined that a crisis is occurring or was likely to occur (if sooner)—you should conduct and record a post-crisis analysis. This should include recording key decisions made during the crisis and assessing whether the crisis response protocol remains appropriate for mitigating and managing the risks arising from a significant increase in relevant content on the service during a crisis and, where relevant, the increased risk of the service being used to commit or facilitate a priority offence during a crisis.

A crisis should be treated as a short-term event, with crisis response protocols ending once the crisis is over or after 90 days, whichever is sooner. Situations lasting beyond 90 days should shift from crisis response to 'business as usual' measures and longer-term resilience planning.

You should keep a record of the post-crisis analysis. Ofcom may request the analysis and its findings if necessary e.g. when exercising its regulatory supervision and/or enforcement functions but unless it does so, there is no obligation to publish the analysis or submit it to Ofcom.

Ofcom says service providers should decide what information to include in their post-crisis analysis, but includes suggestions in its statement. Importantly, you should include lessons learned in order to understand and implement necessary modifications to the protocol.

What do you need to do and when do you need to do it?

The new Codes of Practice will apply 21 days after the final versions are published in Parliament. If you are an in-scope user-to-user service, you will need to:

• Draft a written crisis response protocol if you don't have one, making sure it includes identified crisis indicators.
• Assemble a crisis response team and include details in your response protocol. This must include representatives from relevant teams with appropriate escalation.
• Map systems and processes to ensure these match your protocol.
• If you are a large service, establish a law enforcement communication channel.
• Set out a post-crisis analysis process in line with Ofcom's timelines and ensure you review it periodically. Implement any identified changes as a result of post-crisis analysis as and when one takes place.

Please get in touch if you'd like help with any of these steps or with other online safety matters.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.