Keep the completed 2025 implementation dates separate from deadlines created by a launch, a significant service change, categorisation, a fee year, or an Ofcom notice.
The controlling date depends on the service, duty, and trigger. Record whether an entry is a statutory deadline, an Ofcom expectation, a consultation date, or an internal target.
For Part 3 services already in scope during the first implementation wave, the main deadlines were 16 March 2025 for illegal-content risk assessments, 16 April 2025 for children's access assessments, and 24 July 2025 for children's risk assessments where the service was likely to be accessed by children. The illegal-content safety duties applied from 17 March 2025 and the children's safety duties from 25 July 2025. The began for regulated user-to-user services on 7 April 2026. A later service must calculate its dates from its own trigger rather than reuse the 2025 dates.
For the first cohort of Part 3 user-to-user and search services, record 16 March 2025 as the illegal-content risk-assessment deadline and 17 March 2025 as the date the illegal-content safety duties took effect. These are separate milestones.
Record 16 April 2025 as the first children's access-assessment deadline. A service found likely to be accessed by children then had until 24 July 2025 to complete its first children's risk assessment, and the children's safety duties applied from 25 July 2025.
Part 5 services that publish or display regulated provider pornographic content followed a separate timetable. Their highly effective age-assurance duty took effect on 17 January 2025. Do not derive a Part 5 deadline from the Part 3 children's timetable.
From 7 April 2026, regulated user-to-user services must report detected and unreported child sexual exploitation and abuse content under the statutory reporting regime. UK providers report all such content; providers outside the UK report UK-linked content. The April 2026 regulations do not yet commence the duty for search services, and content already reported to a qualifying foreign agency is not reported again.
Sources (4)
Lists the 2025 assessment deadlines and the dates on which the illegal-content, children's safety, and Part 5 age-assurance duties took effect.
Explains the three-month timing model for provider assessments and the separate timing rules for children's risk assessments.
Confirms the 16 April 2025 first-cohort deadline and the three-month deadline for a service that came into scope after 16 January 2025.
Confirms the 7 April 2026 commencement for regulated user-to-user services, the UK-link rule for overseas providers, the later commencement for search services, and the reporting workflow.
Use Ofcom's register to confirm the categorised service and registered part. Category 1 and Category 2A providers must now give Ofcom a copy of an illegal-content risk-assessment record, and any applicable children's risk-assessment record, as soon as reasonably practicable after making or revising it. Ofcom expects current records by October 2026 and published summaries by November 2026; those months are regulator expectations, not substitutes for the statutory 'as soon as reasonably practicable' test.
A 31 July 2026 deadline applies only to providers that received Ofcom's April 2026 formal information request for risk-assessment records. For the 2027/28 fee year, the notification window for new fee-liable providers closed on 30 September 2026. Existing fee-payers received a rolling information request for updated service details and 2025 qualifying worldwide revenue, also due on 30 September 2026; retain the request and response evidence.
Ofcom's 30 September 2026 update confirms that the 2026/27 tariff has been published and that it intends to issue invoices throughout October 2026. The 2027/28 notification window closed on 30 September 2026; Ofcom expects that year's tariff in March 2027 and invoices from April 2027. Use each invoice for the provider's actual payment deadline and check the applicable instalment terms. Treat dates for consultations and proposed additional safety measures as planning entries until the relevant final measure and legal process are complete.
Sources (3)
Confirms publication of the register and that final categorisation decisions have been issued to providers.
States the risk-record duties for Category 1 and Category 2A providers and Ofcom's October and November 2026 expectations.
Confirms the 30 September 2026 notification deadline for new fee-liable providers and the current invoice and payment timetable.
A Part 3 service that becomes available to UK users after the relevant guidance has been published generally has three months from the day it comes into scope to complete its first illegal-content risk assessment and children's access assessment.
Ofcom's quick guide describes a three-month children's risk-assessment period after launch. Its detailed Children's Risk Assessment Guidance, paragraph 2.21, measures that period from the positive children's access-assessment conclusion, including for a new service.
Record both dates, plan to the earlier deadline where they differ, and seek Ofcom clarification before relying on the later one. For other trigger events, calculate the deadline under Schedule 3 using the actual event.
Complete the relevant risk assessment before making a significant change to the service. If a children's access assessment concludes that the service is not likely to be accessed by children, repeat it no more than 12 months later and sooner if a specified trigger occurs, including a relevant significant change, reduced age-assurance effectiveness, or evidence of a significant increase in child users.
Sources (4)
Confirms the three-month deadline after launch and the requirement to complete an illegal-content risk assessment before a significant change.
Gives the launch-based summary of children's risk-assessment timing; compare detailed guidance paragraph 2.21, which uses the positive access-assessment conclusion. Also confirms the pre-change assessment requirement.
Explains the three-month first assessment, annual reassessment, and earlier reassessment triggers.
Published 24 April 2025. Measures three months from a children's access assessment concluding that the new or reassessed service is likely to be accessed by children.
Each calendar entry should identify the legal or regulatory trigger, affected service, date-calculation method, owner, and completed evidence. A reminder alone does not show compliance.
For assessments, retain the methodology, findings, relevant user groups and service features, chosen measures, approval, completion date, and next review trigger. For an Ofcom notice, retain the notice itself, receipt date, response deadline, preservation steps, data provenance, representations, submission evidence, and follow-up correspondence.
Sources (3)
Binding source for assessment timing, record-keeping, information powers, categorised-service duties, and enforcement notices.
Explains Ofcom's information notices, response requirements, and the consequences of failing to provide complete and accurate information.
Provides Ofcom's current calendar of duties, actions, consultations, and expected implementation dates.
Connect each statutory, notice-specific, and internal date to the affected service, an owner, and the evidence that closes the entry.
Turn calendar triggers into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.