UK Online Safety Act Checklist

Identify the provider entity and map user-generated content, public search, messaging, comments, sharing, and provider-published pornography. Apply the UK-link test, every relevant Schedule 1 exemption, and the Schedule 2 exclusion to each service part.

Once Part 3 scope is approved, complete the illegal-content risk assessment and children's access assessment. If children are likely to access any part, complete the separate children's risk assessment before finalizing child-safety controls. A new or newly in-scope service generally has three months for its first applicable assessment, but a significant design or operational change requires the relevant risk assessment before the change.

For each applicable duty, verify the measure exists, operates on the assessed service version, has a named owner, and produces evidence. A policy statement or implementation ticket alone does not show that a control works.

Close the checklist only when every applicable item has evidence, required compliance gaps are resolved, every exception has a valid reason, and required pre-launch or pre-change assessments are approved. Keep other follow-up actions with owners and due dates. A completed historic deadline does not close an ongoing duty.

Reopen the checklist before a significant service change and after changes in users, risk evidence, recommender or search design, moderation, age assurance, incidents, complaints, control performance, Ofcom category status, or official regulatory documents.