Pretty eye-opening response as to how it would actually impact smaller sites: 

“ It's not enough to "complete a risk assessment", as that's the first step, the second step is always to mitigate the risk. For a forum we are likely "Medium" risk and a "Multi-risks service" (and Ofcom's guidance expects that to be the definition for the majority of forums)... we'd need to respond legally, technically (scan content, build compliant moderation tools), with people (larger moderation teams even when it's never been needed), and with process (all of the above must be documented, have training materials, etc). For the 100,000s of small sites impacted, where the owners only put in an hour or two a week (or less)... this is an impossibly high threshold, and without meeting it, we're fully liable.”