This implementation guide helps translate the UK Online Safety Act duties into owned controls, evidence, review checkpoints, and escalation paths.
Compliance is service-specific and ongoing. The provider must connect each legal duty to current risk evidence, an implemented measure, a named owner, and a review trigger.
Run the program in dependency order: approve service scope, complete the illegal-content assessment, implement core safety and user processes, assess child access, complete child-safety work where triggered, map Part 5 pornography duties, then add formal category duties. Treat each issued as a statutory compliance route, while keeping the underlying duty and any alternative-measure rationale visible. Keep the records current and ready for Ofcom information requests.
Create a scope record for each regulated user-to-user part, public search engine, and provider-pornography service. Identify the provider entity, UK link, exemptions, users, content flows, and features that affect risk.
Complete separate illegal-content and, where triggered, children's risk assessments. Consult the current Ofcom risk profiles and guidance, record all aspects of the assessment in an understandable form, and complete a new assessment before a .
Translate each risk into a measure, owner, evidence, monitoring signal, and review date. Map issued Ofcom code measures or explain how an satisfies the underlying duty. Maintain content-reporting, complaints, terms, privacy, and freedom-of-expression controls alongside moderation and product measures.
Add Part 5 age-verification or age-estimation work for provider pornographic content and category-specific work only where those legal triggers apply. Ofcom's register, first published on 30 June 2026 and most recently updated on 28 September 2026, is the source for formal , 2A, and 2B status.
Sequence timing from the actual trigger. The first illegal-content and child-access deadlines for existing services passed in March and April 2025, and the first children's risk-assessment deadline passed on 24 July 2025. A later launch, a service coming into scope, or a can create a new assessment deadline; preserve the trigger date and calculation instead of copying the historic calendar.
Sources (2)
Primary source for the provider duties, records, reviews, codes, information powers, categories, and enforcement framework.
Current regulator sequence for applying the core service, illegal-content, and protection-of-children duties.
As an operating control, assign an accountable program owner with authority to resolve gaps across product, engineering, trust and safety, data, privacy, legal, support, and communications. Give each control and assessment an operational owner and a named reviewer.
Keep signed or approved scope and risk records, code mappings, control specifications, test results, moderation and complaint evidence, age-assurance decisions, terms versions, incident reviews, category records, review logs, and regulator correspondence.
Sources (2)
Binding record-keeping and review duties for Part 3 services.
Current source for issued codes, risk and content guidance, and record-keeping guidance.
A policy or completed assessment does not prove compliance if the service has not implemented and maintained the measures. Code measures are not the only route, but an alternative requires a defensible connection to the underlying duty.
Do not merge different legal tests into one risk score. Scope, illegal-content risk, child access, child harm, provider pornography, and category thresholds each require their own conclusion.
Ofcom can investigate, require information, and enforce the Act. For a breach, the maximum penalty can be the greater of £18 million or 10% of qualifying worldwide revenue. The Act also provides court-based service-restriction and access-restriction routes in specified serious cases. The available response depends on the breached duty, notice, and facts.
Sources (4)
Current significant-change, assessment, measure, record, and review expectations for child-accessible services.
Current joint-regulator context for coordinating online-safety and data-protection compliance when implementing age assurance.
Current regulator summary of the compliance sequence and maximum financial penalty for failure to comply.
Binding source for Ofcom's enforcement powers, penalties, and the statutory service-restriction and access-restriction order framework.
Use stage gates: no duty mapping without an approved service boundary; no final control plan without completed risk assessments; no without the required pre-change assessment; and no closure without implementation and test evidence.
Review on a scheduled cadence and after changes in service design, user base, risk evidence, incidents, complaints, control performance, formal category, or official codes and guidance. Record whether each change requires a new statutory assessment, a control retest, an updated record, or all three.
Sources (2)
Current illegal-content program steps and Category 1 and 2A risk-record submission timing.
Formal register published on 30 June 2026 and most recently updated on 28 September 2026, with the service boundaries used to assign additional work.
Use Sorena to connect each service duty to its assessment, control owner, evidence, and review date.
Turn Compliance into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next Compliance actions with Sorena.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.