UK platforms that allow users to share content face a new statutory reporting line from 7 April 2026. Under the Online Safety Act, regulated user-to-user services must report detected and previously unreported child sexual exploitation and abuse content to the National Crime Agency. At the same time, providing materially false information in those reports becomes a specific criminal offence. (gov.uk)

These changes are triggered by the Online Safety Act 2023 (Commencement No. 7) Regulations 2026, signed on 9 March by Home Office minister Jess Phillips and effective from 7 April. The instrument activates section 66(1)–(2) and related supplementary provisions, section 69, and selected enforcement and transparency lines, but only in relation to regulated user-to-user services at this stage.

For operators, the legal duty in section 66 is not about best endeavours; it requires systems and processes that, so far as possible, ensure all detected and unreported CSEA content present on the service is reported to the NCA. The Home Office has signposted that further regulations will set out the format and timing of reports. The NCA’s dedicated Industry Reporting Portal is the endpoint. (gov.uk)

Section 69 is tightly framed. The offence is committed where a person knowingly or recklessly provides materially false information in relation to CSEA reporting. Penalties vary by jurisdiction, and, for overseas platforms, the Act extends jurisdiction where there is a UK link to the underlying content or service. (legislation.gov.uk)

Ofcom’s back-end powers also step up. The regulator can compel information under section 100, commission reports by skilled persons under section 104, and rely on certain interview statements as evidence under section 120. These sit alongside existing Part 7 offences for obstructing information requests or providing false information to Ofcom, and the potential for named‑manager liability. (legislation.gov.uk)

Transparency reporting is part of the picture too. The transparency provisions engaged by this commencement allow Ofcom to require information on how providers manage CSEA risks, and Ofcom has already set out the broad transparency framework in final guidance published last year. (ofcom.org.uk)

Operationally, Trust & Safety teams should assume an always‑on triage function, dependable signalling to identify likely CSEA material, and an auditable pathway into the NCA portal. Expect strengthened logging, data‑handling rules and chain‑of‑custody steps so evidence can withstand court scrutiny and Ofcom enquiries. (nationalcrimeagency.gov.uk)

For many SMEs and mid‑market platforms, a pragmatic route is to connect existing moderation tooling to a minimal, well‑tested reporting service first, then build out coverage and automation. Because false positives carry legal risk under section 69, providers should test classifier performance, tighten human‑review thresholds, and document every escalation decision.

The cross‑border angle matters. Non‑UK providers with a UK link are expected to report to the NCA even if they already send reports to an overseas body. It is sensible to map which incidents are routed to the NCA alongside any existing U.S. CyberTipline process to avoid duplication and gaps. (legislation.gov.uk)

Governance will be tested. Ofcom can require interviews and name a senior manager in information notices; boards should ensure a clear owner for CSEA reporting, complete staff training, and pre‑clear confidentiality and data‑protection arrangements around evidence sharing. (gov.uk)

Timeline risk is real. The government has indicated further process rules will come via regulations specifying report formats and deadlines; providers should watch for Home Office or Ofcom updates ahead of go‑live and allow time in Q2 engineering schedules. (gov.uk)

The bottom line: the UK is switching on an enforceable CSEA reporting regime for user‑to‑user platforms on 7 April 2026. Build the pipeline, test the hand‑offs, and be audit‑ready-because both Ofcom and the criminal courts will expect precision.