UK Online Safety Act Deadlines and Compliance Calendar

For the first cohort of Part 3 user-to-user and search services, record 16 March 2025 as the illegal-content risk-assessment deadline and 17 March 2025 as the date the illegal-content safety duties took effect. These are separate milestones.

Record 16 April 2025 as the first children's access-assessment deadline. A service found likely to be accessed by children then had until 24 July 2025 to complete its first children's risk assessment, and the children's safety duties applied from 25 July 2025.

Part 5 services that publish or display regulated provider pornographic content followed a separate timetable. Their highly effective age-assurance duty took effect on 17 January 2025. Do not derive a Part 5 deadline from the Part 3 children's timetable.

From 7 April 2026, regulated user-to-user services must report detected and unreported child sexual exploitation and abuse content under the statutory reporting regime. UK providers report all such content; providers outside the UK report UK-linked content. The April 2026 regulations do not yet commence the duty for search services, and content already reported to a qualifying foreign agency is not reported again.

Ofcom published the register of categorised services on 10 July 2026. Category 1 and Category 2A providers must now give Ofcom a copy of an illegal-content risk-assessment record, and any applicable children's risk-assessment record, as soon as reasonably practicable after making or revising it. Ofcom expects current records by October 2026 and published summaries by November 2026; those months are regulator expectations, not substitutes for the statutory 'as soon as reasonably practicable' test.

A 31 July 2026 deadline applies only to providers that received Ofcom's April 2026 formal information request for risk-assessment records. For the 2027/28 fee year, the notification window for new fee-liable providers closes on 30 September 2026. Providers already in the fee process may instead receive an Ofcom information request, so the notice controls their response date.

Ofcom expects to issue invoices and publish the 2026/27 tariff in September 2026, with payment running to March 2027 and instalments possible in specified cases. Treat dates for consultations and proposed additional safety measures as planning entries until the relevant final measure and legal process are complete.

A Part 3 service that becomes available to UK users after the relevant guidance has been published generally has three months from the day it comes into scope to complete its first illegal-content risk assessment and children's access assessment. If it is likely to be accessed by children, it also has three months to complete a children's risk assessment. The exact statutory trigger must be checked against Schedule 3 for the service's facts.

Complete the relevant risk assessment before making a significant change to the service. If a children's access assessment concludes that the service is not likely to be accessed by children, repeat it no more than 12 months later and sooner if a specified trigger occurs, including a relevant significant change, reduced age-assurance effectiveness, or evidence of a significant increase in child users.

Each calendar entry should identify the legal or regulatory trigger, affected service, date-calculation method, owner, and completed evidence. A reminder alone does not show compliance.

For assessments, retain the methodology, findings, relevant user groups and service features, chosen measures, approval, completion date, and next review trigger. For an Ofcom notice, retain the notice itself, receipt date, response deadline, preservation steps, data provenance, representations, submission evidence, and follow-up correspondence.