On 12 May 2026, Ofcom opened a consultation on changes to how it oversees resilience and incident reporting across the UK telecoms sector. It is aimed at the providers Ofcom regulates, not at end-user businesses, so on first read it can feel like a policy story that does not really involve SMEs. The more useful framing is different. Ofcom sharpening its focus on outages, supervisory clarity and real service impact is a strong prompt for any small or medium business to look hard at its own business connectivity resilience and ask whether the setup behind its broadband, phones and mobile coverage is genuinely fit for how the business now operates.

This post walks through what Ofcom has actually proposed, why it matters even though SMEs are not the ones reporting incidents, and the practical questions worth asking your provider or internal IT lead this quarter.

What Ofcom has proposed

Ofcom is updating its General Statement of Policy under section 105Y of the Communications Act 2003. In plain English, that is the document that sets out how Ofcom monitors telecoms providers and enforces their security and resilience duties. The current version has been in force for around three years, and Ofcom says the revisions reflect what it has learned from real incidents during that period.

The proposals focus on a few clear themes:

• More consistent incident reporting from providers, including a standardised 72-hour reporting form and a bulk reporting template for high-volume incidents
• Clearer expectations around mobile network incidents, including a new cell data reporting standard
• A specific dataset to distinguish rural and most-rural postcodes, recognising that the same outage can have a very different impact on customers depending on where they live and work
• Sharper supervisory clarity, so that Ofcom and the wider sector get a more accurate picture of where resilience is weakest

The consultation runs until 5pm on 4 August 2026. Detailed responses will come from the large network operators, not from end-user businesses. But the direction of travel matters.

Why this matters beyond telecoms providers

Most SMEs do not file incident reports to Ofcom. The reason this consultation still matters for smaller businesses is simpler. Regulators sharpen their attention on the things that have caused the most real-world disruption. Ofcom looking more closely at mobile incidents, rural-versus-urban impact and consistent outage reporting tells you something useful: outages are still a regular operational reality, and the gap between providers in how well they handle them is wide enough that the regulator wants better visibility.

For the average business, the practical translation is this. When connectivity, phones or mobile coverage fail, the cost lands on the customer, not the network operator. Missed calls, abandoned card payments, an empty inbox, a hosted phone system that drops mid-call, a cloud accounting platform you cannot reach. Those are commercial losses, not regulatory ones. And how quickly those losses are contained depends almost entirely on how the service was set up in the first place and how the supplier responds when something breaks.

The gap between “we have internet and phones” and resilient communications

A lot of SMEs would say their setup is fine because they have broadband, a phone system and mobile coverage that mostly works. That is a reasonable starting point. It is not the same as business connectivity resilience.

Resilience is about what happens when something fails. A single broadband line with no fallback is one outage away from a quiet office. A hosted phone system without a tested failover plan can mean calls just disappear during a fault. A mobile signal that depends on a single mast covering a rural unit may not come back as quickly as the equivalent service in a city centre, which is exactly the disparity Ofcom is now trying to measure more carefully.

The other side of resilience is supplier behaviour. When a fault hits, the difference between a one-hour and a one-day disruption usually comes down to how the issue is triaged, who owns it, and how clearly it is escalated. That is rarely visible from a price comparison or a basic service contract.

Six business connectivity resilience checks worth running this quarter

You do not need to be a network engineer to pressure-test your own setup. The following questions surface the gaps that matter most.

1. What happens if our primary internet connection fails right now? If the honest answer is “everything stops”, that is a single point of failure. Backup options range from a secondary fixed line on a different network to 4G or 5G failover routers that switch over automatically. The right answer depends on what downtime actually costs the business.

2. How does our phone system behave during an outage? If you use hosted or cloud telephony, calls should be able to route to mobiles, voicemail or another site without manual intervention. Confirm this is configured. A continuity plan that has never been tested is not a continuity plan.

3. Who is responsible when something fails, and what is the realistic response time? Service level agreements vary enormously. A consumer-grade broadband product may have a target fix time of several working days. A business-grade service with a managed wrapper should be quicker and more accountable. Find out which you are actually paying for.

4. Do we have a single point of contact, or are we juggling suppliers? Many SMEs end up with broadband from one provider, phones from another, mobile from a third and IT from a fourth. When a fault crosses two of those, no one owns it end to end. Consolidating ownership, or at least having one accountable contact, removes the finger-pointing that turns small issues into long ones.

5. Do we know how dependent we have become on connectivity? Card payments, hosted phones, cloud accounting, video calls, file sharing, remote working, smart alarms, even some door entry systems all run over the same connection. Map what would stop working in a one-day outage, then decide which of those you can actually afford to lose.

6. When did we last review any of this? Most businesses inherit a setup that was right two or three years ago and has never been revisited. Usage has almost certainly changed since. Headcount, hybrid working, the number of cloud services in daily use and the volume of calls handled online have all moved on.

Where managed services fit in

The honest part of this, from a 1Connect point of view, is that resilience is not a product you buy off a shelf. It is the result of how services are designed, supported, escalated and owned day to day. That is where managed services genuinely earn their place. A managed setup means someone is watching the connections, knows the configuration, has a relationship with the underlying carriers and can act quickly when something goes wrong, rather than the business itself trying to coordinate that during a crisis.

It also means resilience can be built in proportionately. Not every SME needs leased lines and dual carriers. Many do well with a sensible primary connection, a tested failover, a hosted phone platform with continuity routing and a single accountable supplier. The point is that the decisions have been made deliberately rather than left to chance.

What to take from the Ofcom consultation

The detail of the Ofcom consultation is a matter for the large network operators. The signal for everyone else is more straightforward. The regulator is paying closer attention to outages, mobile incidents and the difference between a service that works in central Manchester and one that works in a rural unit thirty miles away. That attention exists because those problems are real and they have commercial consequences.

For an SME, the most useful response is not to read the policy paper. It is to use this as a prompt to review the connectivity, telephony and supplier setup the business depends on every day, and to decide whether it would hold up the next time something fails.

If reviewing this raises more questions than answers, a quick way to start is by checking what is actually available at your address and how it compares to what you have today. The 1Connect business connectivity check takes under 30 seconds, needs only a postcode and gives you an instant view of available services and pricing with no commitment.

Sources: Ofcom, “Proposals to update our General Statement of Policy under section 105Y of the Communications Act 2003”, consultation published 12 May 2026, response deadline 5pm 4 August 2026. Ofcom guidance for communications providers and operators of essential services, accessed 14 May 2026.