Artifact GuideUKCategorisation

UK Online Safety Act Categorisation

and 2B apply to regulated user-to-user services; applies to regulated search services or the search engine of a combined service.

A provider should monitor the thresholds, but Ofcom makes the formal decision. The first register was published on 30 June 2026 and most recently updated on 28 September 2026.

Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
Overview

A is a Part 3 service that Ofcom has entered on its register after assessing the specified scale and functionality conditions. Categorisation comes after Part 3 scope and does not trigger the core illegal-content, children's access, child-safety, reporting, complaints, or record-keeping duties. Calculate each threshold against the regulated service part, then use Ofcom's register for formal status.

Section 1

Which category thresholds and calculation rules apply?

has two routes. A regulated user-to-user service qualifies if its user-to-user part exceeds 34 million average monthly and uses a , or exceeds 7 million and both uses a recommender and lets users forward or share regulated user-generated content with other users of the service.

covers a regulated search service or a combined service whose search engine exceeds 7 million average monthly . The threshold excludes a search engine that only searches selected websites or databases on a specific topic, theme, or genre and is facilitated by a relevant arrangement; both parts of that exception must be satisfied.

covers a regulated user-to-user service exceeding 3 million average monthly where direct messages cannot be encountered by other users unless the sender or recipient takes further action. The design of the messaging function, not its marketing name, controls.

For all three categories, calculate the mean number of per month over the six months ending with the month before the assessment starts. Use the shorter operating period if the service has operated for less than six months. A number equal to the threshold does not meet wording that requires the number to exceed it.

The first register shows why the service boundary matters. ChatGPT Search is , but Ofcom states that this does not categorise unrelated chatbot content that is not search content. Facebook appears through different regulated parts, and services such as WhatsApp appear in while many marketplaces and messaging services appear in . These entries illustrate Ofcom's decisions; they do not classify another service by analogy.

  • Use the regulated user-to-user or search part as the measurement boundary.
  • Document the active-UK-user definition, data sources, deduplication, and six monthly figures.
  • Capture current recommender, forward-or-share, direct-message, and search design evidence.
  • Compare the internal analysis with Ofcom's register; do not label the service formally categorised based only on an internal calculation.
Section 2

Who maintains the user counts and functionality evidence?

A data owner should maintain the monthly active UK user calculation. Engineering and product owners should attest to the relevant functionality, and the regulatory owner should map Ofcom's decision to the correct service part and additional duties.

Preserve the six-month data extract, metric definition, service-boundary rationale, functionality specifications and user journeys, internal threshold conclusion, register entry, Ofcom information requests, and any representations made during assessment.

  • Separate user counts for the user-to-user part from users who only use another part of a combined service.
  • Explain how logged-out users, multiple accounts, automated traffic, and cross-device duplication are handled.
  • Version the recommender, sharing, messaging, and search evidence used for each calculation.
  • Assign an owner to monitor Ofcom's register, , information requests, and category-specific deadlines.
Section 3

How do combined services and emerging Category 1 listings differ?

One product can appear in more than one category because the category attaches to a regulated service part. Formal status for a public search engine does not extend the Category 2A duties to unrelated chatbot, publishing, or user-to-user functions unless those functions fall within the categorised search service.

The is not the register. It uses the Act's 75% user-number conditions and specified functionality to flag services that may soon meet a Category 1 threshold. The current user-number markers are 25.5 million, or 5.25 million where the recommender and forward-or-share conditions also apply; listed services do not acquire the additional Category 1 duties.

  • If the same user-to-user service meets both and conditions, the Act treats it as Category 1 and Ofcom enters it only in the Category 1 part of the register.
  • A public search engine within a combined service can be even when the user-to-user part is not categorised, and the reverse is also possible.
  • Do not treat the topic-specific exception as a Part 3 scope exemption or apply it to general search functions.
  • Do not wait for categorisation to complete illegal-content or child-safety work; those duties follow Part 3 scope and risk, not category.
Section 4

How should teams implement a formal categorisation decision?

Once Ofcom places a service on the register, map the statutory additional duties to the registered part and current commencement position. includes duties concerning user empowerment, identity verification, democratic-importance content, news publisher content, journalistic content, terms, complaints, and freedom-of-expression and privacy assessments.

and 2A services have fraudulent-advertising duties and duties to provide specified risk-assessment records to Ofcom. Category 1, 2A, and 2B services can also have transparency-reporting and fee obligations. Check the current Ofcom notices, codes, and commencement position for each deliverable rather than assuming one common deadline.

  • For and 2A services, update the risk-assessment record to reflect the registered service boundary and Ofcom's current request for records by October 2026.
  • Create a category-duty register with the legal section, service part, owner, evidence, current regulatory document, commencement status, and due date.
  • Label Ofcom consultations and draft codes as proposals until issued or otherwise brought into effect.
  • Recalculate and review after material user growth or functionality changes even when the formal register has not yet changed.
Primary sources

References and citations

ofcom.org.uk4 citations
Referenced sections
  • Official register published on 30 June 2026 and most recently updated on 28 September 2026, with threshold summaries, service-part decisions, and the emerging Category 1 list.
  • Formal register published on 30 June 2026 and most recently updated on 28 September 2026, with category entries, service-part descriptions, providers, and threshold explanations.
  • Official examples of multi-category and service-part entries and the separate emerging Category 1 list.
Show 1 more
  • Formal status and registered service boundaries to use when assigning the additional duties.
legislation.gov.uk2 citations
Referenced sections
  • Primary legislation for Ofcom's categorisation process, the formal register, and additional category duties.
  • Primary source distinguishing core Part 3 duties from the additional duties for categorised services.
Show all related guides (41)

UK Online Safety Act Age Assurance Selection Workflow

Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.

UK Online Safety Act Applicability Test Guide

Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.

UK Online Safety Act Checklist

Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.

UK Online Safety Act Children's Safety Duties Guide

Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.

UK Online Safety Act Compliance Guide

Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.

UK Online Safety Act Content Moderation and Appeals Guide

Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.

UK Online Safety Act Deadlines and Compliance Calendar Guide

UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.

UK Online Safety Act Enforcement and Penalties Guide

How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.

UK Online Safety Act FAQ: scope, duties, and deadlines

Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.

UK Online Safety Act ICO Overlap Guide

Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.

UK Online Safety Act Illegal Content Duties Explained

Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.

UK Online Safety Act Moderation, Complaints and Appeals

Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.

UK Online Safety Act Ofcom Enforcement Guide

How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.

UK Online Safety Act Penalties and Fines Guide

The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.

UK Online Safety Act Regulated Service Scope Guide

Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.

UK Online Safety Act Requirements Guide

See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.

UK Online Safety Act Risk Assessment Template

A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.

UK Online Safety Act Risk Assessment Workflow

Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.

UK Online Safety Act Risk Assessments Playbook

Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.

UK Online Safety Act Senior Manager Liability Explained

Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.

UK Online Safety Act Service Classification Workflow

Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.

UK Online Safety Act Service Scope and Categorization Guide

Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.

UK Online Safety Act Transparency Reporting

Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.

UK Online Safety Act vs DSA: scope and duties

Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.

Does the UK Online Safety Act apply to this service?

A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.

How Ofcom and ICO duties overlap for online services

How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.

How Ofcom enforces the UK Online Safety Act

Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.

How to complete a children's access assessment

The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.

How to complete an illegal content risk assessment

UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.

Is This a User-to-user or Search Service Under the UK Online Safety Act?

Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.

Ofcom Transparency Reporting FAQ

Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.

Online Safety Act moderation, reporting, and complaints

How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.

UK Online Safety Act categories: thresholds and duties

How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.

When Are Senior Managers Liable Under the UK Online Safety Act?

When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.

When is age assurance required under the UK Online Safety Act?

When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.