UK Online Safety Act Compliance

Create a scope record for each regulated user-to-user part, public search engine, and provider-pornography service. Identify the provider entity, UK link, exemptions, users, content flows, and features that affect risk.

Complete separate illegal-content and, where triggered, children's risk assessments. Consult the current Ofcom risk profiles and guidance, record all aspects of the assessment in an understandable form, and complete a new assessment before a significant change.

Translate each risk into a measure, owner, evidence, monitoring signal, and review date. Map issued Ofcom code measures or explain how an alternative measure satisfies the underlying duty. Maintain content-reporting, complaints, terms, privacy, and freedom-of-expression controls alongside moderation and product measures.

Add Part 5 age-verification or age-estimation work for provider pornographic content and category-specific work only where those legal triggers apply. Ofcom's register, first published on 30 June 2026 and updated on 10 July 2026, is the source for formal Category 1, 2A, and 2B status.

Sequence timing from the actual trigger. The first illegal-content and child-access deadlines for existing services passed in March and April 2025, and the first children's risk-assessment deadline passed on 24 July 2025. A later launch, a service coming into scope, or a significant change can create a new assessment deadline; preserve the trigger date and calculation instead of copying the historic calendar.

As an operating control, assign an accountable program owner with authority to resolve gaps across product, engineering, trust and safety, data, privacy, legal, support, and communications. Give each control and assessment an operational owner and a named reviewer.

Keep signed or approved scope and risk records, code mappings, control specifications, test results, moderation and complaint evidence, age-assurance decisions, terms versions, incident reviews, category records, review logs, and regulator correspondence.

A policy or completed assessment does not prove compliance if the service has not implemented and maintained the measures. Code measures are not the only route, but an alternative requires a defensible connection to the underlying duty.

Do not merge different legal tests into one risk score. Scope, illegal-content risk, child access, child harm, provider pornography, and category thresholds each require their own conclusion.

Ofcom can investigate, require information, and enforce the Act. For a breach, the maximum penalty can be the greater of £18 million or 10% of qualifying worldwide revenue. The Act also provides court-based service-restriction and access-restriction routes in specified serious cases. The available response depends on the breached duty, notice, and facts.

Use stage gates: no duty mapping without an approved service boundary; no final control plan without completed risk assessments; no significant change without the required pre-change assessment; and no closure without implementation and test evidence.

Review on a scheduled cadence and after changes in service design, user base, risk evidence, incidents, complaints, control performance, formal category, or official codes and guidance. Record whether each change requires a new statutory assessment, a control retest, an updated record, or all three.