Separate the historic deadlines for the first cohort of regulated services from the event-based deadlines that apply when a service starts, becomes regulated, or materially changes.
Royal Assent and commencement dates do not by themselves tell a provider when its assessment is due. Match the service event to Schedule 3, the applicable Ofcom guidance, and any notice-specific deadline.
Structured answer sets in this page tree.
Cited legal and guidance references.
For existing Part 3 services, the initial sequence was 16 March 2025 for illegal-content risk assessments, 16 April 2025 for children’s access assessments, 24 July 2025 for children’s risk assessments where the service was likely accessed by children, and 25 July 2025 for the child-safety duties. Later services must calculate their own deadlines from the Act rather than reuse these dates.
Record 16 March 2025 as the initial illegal-content risk-assessment deadline and 17 March 2025 as the date the corresponding illegal-content duties became enforceable. These are different events and should not be collapsed into one milestone.
Record 16 April 2025 as the initial children’s access-assessment deadline. For services assessed as likely to be accessed by children, record 24 July 2025 for the first children’s risk assessment and 25 July 2025 for the child-safety duties taking effect.
Part 5 provider-pornography services followed a separate route: section 81 commenced on 17 January 2025 and Ofcom’s age-assurance guidance governs the practical standard. Categorised-service, transparency-report, fee, CSEA-reporting, and information-notice dates must be tracked separately rather than inferred from the Part 3 child-safety dates.
The 2025 dates describe the first implementation wave. A service that launches later, acquires UK links, adds user-to-user or search functionality, or becomes likely to be accessed by children must use the statutory timing rules for that event.
Risk assessments also require review before significant design changes and when the provider has reason to suspect a material change in risk. Ofcom information notices, confirmation decisions, and transparency-report notices carry their own response periods.
The Act, commencement regulations, Ofcom codes, statutory guidance, non-statutory guidance, consultations, and government correspondence do different jobs. A code can provide a route to compliance, but the underlying duty comes from the Act; consultation text is not a final rule.
Categorisation is also not the gateway to the core illegal-content or child-safety duties. Those can apply to non-categorised Part 3 services; categories add further duties after Ofcom places a service on the register.
A defensible calendar entry identifies the affected service and statutory trigger, links to the controlling source, names the accountable owner, and points to the completed record. The calendar is an index to evidence, not the evidence itself.
For assessments, keep the methodology, risk findings, affected user groups, algorithms and functionalities considered, mitigations chosen, approval, completion date, and next review trigger. For notices and reports, keep the received instrument, response owner, data provenance, submission record, and follow-up correspondence.
This UK Online Safety Act guide helps turn Deadlines and Compliance Calendar into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Deadlines and Compliance Calendar into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.