We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

By Sorena AIPublished Updated

UK Online Safety Act

UK Online Safety Act

UK Online Safety Act hub for service scope, illegal-content and child-safety duties, provider pornography, categorisation, records, and Ofcom readiness.

Act passed
26 Oct 2023
Illegal risk deadline
16 Mar 2025
Child risk deadline
24 Jul 2025
First category register
30 Jun 2026

Understand UK Online Safety Act

Decide whether a service is covered, which provider duties apply, which deadlines have passed, and what evidence Ofcom can expect under the UK Online Safety Act 2023.

The Act covers more than social media. It can reach UK-linked and , including providers based outside the UK, plus services that publish . Core Part 3 duties do not depend on company size or formal categorisation. Start with service scope and exemptions, then apply the risk, child-access, content, and category tests in order.

Use the timeline for legal status and dates, then follow the grouped guides from scope to duties, evidence, and regulator readiness.

Implementation focus

Scope and exclusions

Part 3 covers UK-linked user-to-user and that are not exempt for the relevant functionality. Part 5 separately covers UK-linked services publishing or displaying .

Live deadlines

Existing in-scope Part 3 services faced the 16 March 2025 illegal-content risk-assessment deadline, 16 April 2025 children's access-assessment deadline, and, where likely accessed by children, 24 July 2025 children's risk-assessment deadline. The related safety duties took effect on 17 March and 25 July 2025. New or changing services must use event-based timing, not copy those historic dates.

Evidence and enforcement

Treat issued Ofcom codes as a statutory compliance route, not the only lawful design. If a provider uses different measures, it must keep the required record and show how those measures meet the underlying duties.

Formal categories

Ofcom published the first Category 1, 2A, and 2B register on 30 June 2026 and most recently updated it on 28 September 2026. Use the registered service part for additional duties; an internal threshold calculation or inclusion on the emerging Category 1 list is not formal categorisation.

Decisions to make

  1. 1

    Scope and service model

    Map user-to-user, search, and provider-pornography functionality; apply the UK-link test; then check Schedule 1 and other service-specific exemptions.

  2. 2

    Duty sequencing

    Separate duties that apply broadly from duties triggered by likely child access, provider pornography, or Ofcom categorisation.

  3. 3

    Ofcom readiness

    Keep risk assessments, control decisions, terms enforcement, complaints, records, and information-notice responses tied to the affected service.

Key dates for UK OSA implementation

Distinguish Royal Assent and commencement instruments from Ofcom codes, completed assessment deadlines, enforceable duties, and the first category register published on 30 June 2026 and most recently updated on 28 September 2026.

Loading timeline...

Choose the next Online Safety Act decision

New to the Act? Start with service scope and the UK-link test. If scope is already documented, move directly to risk and child-access assessments, implementation evidence, deadlines, or Ofcom readiness.

Start here: service scope and classification

Identify the regulated service, relevant UK links, exempt or disapplied functionality, and formal category status before assigning duties to a service part.

Deadlines, reporting, and enforcement

Separate completed implementation milestones from ongoing duties, then prepare records for category-specific submissions, transparency reporting, Ofcom information powers, enforcement, and privacy-regulator overlap.

Compare regimes or answer a focused question

Use the DSA comparison for cross-regime scoping, or go to the FAQ hub when you already know the question that needs a direct answer.

Sources

GOV.UK Online Safety Act collection
gov.uk
Referenced sections
  • Government implementation collection for issued codes, commencement material, and the status of illegal-content and child-safety duties.
Ofcom - Register of categorised services
ofcom.org.uk
Referenced sections
  • Official first register published on 30 June 2026 and most recently updated on 28 September 2026, including Category 1, 2A, and 2B service entries, service boundaries, providers, and the emerging Category 1 list.
Online Safety Act 2023
legislation.gov.uk
Referenced sections
  • Primary legislation for regulated-service scope, provider duties, Ofcom powers, service categories, records, enforcement, and event-based timing rules.

Next steps

Assign the applicable Online Safety Act duties and evidence

Record the regulated service, UK link, exemptions, child-access result, risk assessments, applicable codes or alternative measures, formal category status, owners, and review triggers in one assessment record.

  • Scope the assessment to a named provider, service, and relevant service functionality.
  • Assign each applicable duty, control decision, evidence request, and review checkpoint to an owner.
  • Use cited research to resolve unresolved scope, timing, category, and interpretation questions.
  • Reassess after material changes to service functionality, users, risks, controls, Ofcom codes, or formal category status.