UK Online Safety Act FAQ

First map who provides the service, who generates content, who can encounter it, whether a search engine presents results, whether the provider publishes pornographic content, and which functions are distinct parts. Apply the UK-links test and every relevant Schedule 1 exemption. User count does not decide baseline scope.

For a regulated Part 3 service, complete and maintain the illegal content risk assessment and children's access assessment. If children are likely to access the service or part, complete the children's risk assessment and child-safety controls. Apply age assurance where the Act or Ofcom code requires it. Categorisation and transparency reporting are additional layers for services on Ofcom's register.

Existing Part 3 services had to complete their first illegal content risk assessment by 16 March 2025 and first children's access assessment by 16 April 2025. Services likely to be accessed by children had to complete their first children's risk assessment by 24 July 2025 and apply child-protection measures from 25 July 2025. Part 5 provider-pornography age-assurance duties took effect on 17 January 2025.

These dates are not a safe calendar for a new or changed service. New services generally have three months for the relevant initial assessments, while significant changes can require assessment before launch. Negative children's access conclusions must be repeated within 12 months or sooner when triggered, and risk assessments must be kept up to date.

Category 1, 2A, and 2B status adds duties but does not create baseline scope. Ofcom published its register on 10 July 2026. Transparency reporting applies after an annual Ofcom notice to a categorised-service provider; Ofcom's current roadmap places first reports in 2027.

UK data-protection law applies alongside online-safety duties when safety systems process personal data. Age assurance, moderation, profiling, and recommender controls may require a lawful-basis analysis, data protection impact assessment, transparency, minimisation, security, retention, and rights handling. The Children's Code has its own scope test.