Andrew Bennett is a Policy Principal at Form Ventures, a U.K. VC fund investing in start-ups where regulation is a driver of success. Andrew’s expertise is in regulatory strategy, having worked across tech policy at the Tony Blair Institute and founded TxP, a network for people in tech and policy.

How can online platforms keep up with upcoming regulations? What are the most imperative business implications? Do they really matter?

The challenges for different online platforms vary. While some have no idea what their obligations will be, others have a sense of their duties but underestimate the time and effort required to build a fully-fledged trust and safety function. This is not just a new form to fill in or a tick-box exercise: new rules come with new enforcement powers, so many platforms will need to resource significant internal capability, systems and tooling to avoid challenges down the road. For companies trying to keep up, it’s worth looking out for regulators’ guidance. For example, despite the U.K. pausing the passage of its Online Safety Bill for now, the regulator, Ofcom, has published its Roadmap to regulation which sets out a timeline for actions services will need to take.

What will be the consequences for platforms who aren’t compliant on day one?

As Dorothy Chou said in our recent newsletter, “the more start-ups have worked through the rules and institutions they want to operate within, the more freedom they will ultimately have to focus on the work they do best.”

That’s absolutely true of the online safety space, so despite the initial effort, it’s well worth getting on top of what will be required by cross-referencing the rules against how your service works, how you run your internal processes, and what’s in your community standards.

Fortunately, companies do still have time to get their heads around their obligations. In the EU, while large online platforms will need to comply within four months of being designated by the Commission, smaller platforms will have longer. In the U.K., once platforms’ duties come into force there will still be a period where Ofcom, the regulator, will be consulting on the language of its guidance and how it will enforce the rules on illegal harms, child safety and transparency reporting. Enforcement will also be proportional to the platform and risk in question. These will include fees for registering with the regulator. But we’re yet to see what that means in practice.

By 2024, however, services will need to be submitting their risk assessments and fully complying with the rules. If they don’t, akin to GDPR, they risk fines of up to £18m or 10% of global annual turnover (whichever is higher) — and under the EU’s DSA, fines could amount to 6% of global turnover. And complying with a full investigation from the regulator will also take focus and resources away from the business’ core job.

What are the key differences between the EU’s Digital Services Act (DSA) and the U.K.’s Online Safety Bill (OSB)? What impact will they have on online platforms?

Despite sharing a philosophy on how to regulate content, there are significant differences between the U.K. and EU’s approaches that mean platforms will need to prepare for different rules and different compliance processes — unfortunately this will mean additional costs and a limit to how much can be fixed and shared across different markets.

Specifically, the DSA goes further on rules around targeted advertising and external audit processes, while also having stronger protections for intermediary liability. For example, if Ofcom finds your service to be in breach of your duties, it may place a ‘proactive monitoring requirement’ on you. This was previously prohibited under the EU’s eCommerce Directive, except for terrorism and CSEA, and the DSA retains this approach. The OSB also bundles in other issues such as ID verification, duties for platforms to prevent children accessing pornography, and allowing the regulator to require platforms to use specific content moderation technology.

Tighter and more stringent regulations can often be seen as governments abusing their power and restricting freedom of speech and expression. It has also been argued that the OSB will create potential obstacles for small and medium businesses. Do you think the proposed legislation sufficiently protects online innovation and free speech?

There are clearly challenges with the OSB in its current form — from ambiguity in the wording of duties that might incentivize overzealous enforcement (undermining free expression), to contradictory duties that make it hard for services to comply at all. The new rules will also impose direct costs that make it harder not only for new social start-ups to scale, but also services in adjacent sectors — which policymakers may not even realize will be caught up in this — which have some user-to-user aspect to their work.

But it’s hard for anyone to argue that there isn’t a clear problem with online safety that needs addressing, and states have a sovereign right to legislate. For a small number of services, it might be worth engaging with the policy process to help improve the rules. But ultimately, there is still strong political momentum behind the OSB and the base case for all firms should be to adapt to the reality that this is happening.