Online Safety Act 2023 (c. 50) – Section 133 – Confirmation decisions: requirements to take steps

Sections

Section 133Confirmation decisions: requirements to take steps

(1) A confirmation decision may require the person to whom it is given to take such steps as OFCOM consider appropriate (including steps relating to the use of a system or process) for either or both of the following purposes—

(a)
complying with a notified requirement;
(b)
remedying the failure to comply with a notified requirement.

(2) But see section 136 in relation to OFCOM’s power to include in a confirmation decision requirements as described in subsection (1) relating to the use of proactive technology.

(3) A confirmation decision may impose requirements as described in subsection (1) only in relation to the design or operation of a regulated service—

(a)
in the United Kingdom, or
(b)
as it affects United Kingdom users of the service.

(4) A confirmation decision that includes requirements as described in subsection (1) must—

(a)
specify the steps that are required,
(b)
give OFCOM’s reasons for their decision to impose those requirements,
(c)
specify which of those requirements (if any) have been designated as CSEA requirements (see subsections (6) and (7)),
(ca)
[^F1 specify which of those requirements (if any) have been designated as intimate image content requirements (see subsections (7A) and (7B)),]
(d)
specify each notified requirement to which the steps relate,
(e)
specify the period during which the failure to comply with a notified requirement has occurred, and whether the failure is continuing,
(f)
specify a reasonable period within which each of the steps specified in the decision must be taken or, if a step requires the use of a system or process, a reasonable period within which the system or process must begin to be used (but see subsection (5) in relation to information duties),
(g)
(if relevant) specify the period for which a system or process must be used,
(h)
contain details of the rights of appeal under section 168, and
(i)
contain information about the consequences of not complying with the requirements included in the decision (including information about the further kinds of enforcement action that it would be open to OFCOM to take).

(5) A confirmation decision that requires a person to take steps for the purpose of complying with an information duty may require the person to take those steps immediately.

(6) If the condition in subsection (7) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as a “CSEA requirement” for the purposes of section 138(3) (offence of failure to comply with confirmation decision).

(7) The condition referred to in subsection (6) is that the requirement is imposed (whether or not exclusively) in relation to either or both of the following—

(a)
a failure to comply with section 10(2)(a) or (3)(a) in respect of CSEA content, or in respect of priority illegal content which includes CSEA content;
(b)
a failure to comply with section 10(2)(b) in respect of an offence specified in Schedule 6 (CSEA offences), or in respect of priority offences which include such an offence.

(7A) [^F2 If the condition in subsection (7B) is met in relation to a requirement imposed by a confirmation decision which is of a kind described in subsection (1), OFCOM must designate the requirement as an “intimate image content requirement” for the purposes of section 138(3A) (offence of failure to comply with confirmation decision).

(7B) The condition referred to in subsection (7A) is that the requirement is imposed (whether or not exclusively) in relation to—

(a)
a failure to comply with a provision listed in column 1 of the table, which

(b)

where there is an entry for the provision in column 2 of the table, is in respect of a matter listed in column 2.

Provision	Failure in respect of
Section 10(2)(a)	(1) Intimate image content (2) Priority illegal content which includes intimate image content
Section 10(2)(b)	(1) An offence under section 66B of the Sexual Offences Act 2003 (2) Priority offences which include an offence under that section
Section 10(3)(a)	(1) Intimate image content (2) Priority illegal content which includes intimate image content
Section 10(3)(b)	(1) Intimate image content (2) Illegal content which includes intimate image content
Section 10(3A)
Section 27(3)(a)	(1) Intimate image content (2) Priority illegal content which includes intimate image content
Section 27(3)(b)	(1) Intimate image content (2) Illegal content which includes intimate image content
Section 27(3A) ]

(8) A person to whom a confirmation decision is given has a duty to comply with requirements included in the decision which are of a kind described in subsection (1).

(9) The duty under subsection (8) is enforceable in civil proceedings by OFCOM—

(a)
for an injunction,
(b)
for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or
(c)
for any other appropriate remedy or relief.

(10) In this section—

“CSEA content”, [^F3“intimate image content”,] “priority illegal content” and “priority offence” have the same meaning as in Part 3 (see section 59);
“information duty” means a duty set out in section 102(8);
“notified requirement” has the meaning given by section 132.

Amended text

This Section is shown as amended by Crime and Policing Act 2026 (see the annotations below), as incorporated in the text in force on 19 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 S. 133(4)(ca) inserted (29.6.2026) by Crime and Policing Act 2026 (c. 20), ss. 100(9)(a), 255(1); S.I. 2026/689, reg. 2(1)(j)
F2 S. 133(7A)(7B) inserted (29.6.2026) by Crime and Policing Act 2026 (c. 20), ss. 100(9)(b), 255(1); S.I. 2026/689, reg. 2(1)(j)
F3 Words in s. 133(10) inserted (29.6.2026) by Crime and Policing Act 2026 (c. 20), ss. 100(9)(c), 255(1); S.I. 2026/689, reg. 2(1)(j)

Commencement Information

I1 S. 133 not in force at Royal Assent, see s. 240(1)
I2 S. 133 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z17)

https://osa.digiphile.law/article/article-133.html

Text as at 19 September 2026.

This is an unofficial convenience version of the Online Safety Act 2023. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.