United Kingdom: Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026 enter into force

On 7 April 2026, the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026 (SI 2026/268) enter into force. The Regulations apply to providers of regulated user-to-user services subject to the reporting duty under the Online Safety Act 2023. They require providers, and any third-party providers acting on their behalf, to register with the National Crime Agency through an online portal and appoint an organisation administrator as a point of contact. Providers must submit reports of detected and unreported child sexual exploitation and abuse content to the National Crime Agency containing specified information, including content details, upload times, IP addresses, and user account data. Reports must be classified according to three priority levels based on the risk of harm and submitted within corresponding timeframes. Providers must also retain the report reference number for five years and the associated content and user data for one year from the reporting date. Non-compliance may result in a penalty of up to 10% of qualifying worldwide revenue or GBP 18 million, whichever is greater.