Artifact GuideUKRegulated Service Scope

UK Online Safety Act Regulated Service Scope

Q: Which services are in scope?

A Part 3 user-to-user service is an internet service through which content generated, uploaded, or shared by one user may be encountered by another user. A Part 3 search service is an internet service that is, or includes, a search engine. A combined service can contain both parts, and each part may have different duties. Part 5 separately covers an internet service on which the provider publishes or displays regulated provider pornographic content. A service may therefore be outside the Part 3 user-to-user and search definitions but still have Part 5 duties. The provider's location is not decisive. A service has UK links if it has a significant number of UK users, targets the UK market, or is capable of UK use and there are reasonable grounds to believe that UK users face a material risk of significant harm from content on or accessible through it. Map each product function and identify who creates content, who can encounter it, and whether a search engine presents results. Apply the UK-links test to the service facts, including UK users, marketing, language, commercial targeting, and the identified harm route. Record separate conclusions for user-to-user, search, combined-service, and provider-pornography parts.

Decide whether the service, or a distinct part of it, is regulated before mapping duties. The answer depends on its functionality, UK links, and statutory exemptions.

This guide separates baseline scope from later questions about child access, categorisation, risk assessment, and reporting.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

A under the UK Online Safety Act can be operated from outside the UK. Start with the product's actual functions: user-to-user interaction, a search engine, or provider-published pornographic content. Then test the Act's UK-link rules and exemptions. Do not use user count or categorisation thresholds as the first scope test.

Search this module

Find a question or answer quickly

3 of 3 questions

Question 1

Which services are in scope?

A Part 3 is an internet service through which content generated, uploaded, or shared by one user may be encountered by another user. A Part 3 is an internet service that is, or includes, a search engine. A combined service can contain both parts, and each part may have different duties.

Part 5 separately covers an internet service on which the provider publishes or displays . A service may therefore be outside the Part 3 user-to-user and search definitions but still have Part 5 duties.

The provider's location is not decisive. A service has if it has a significant number of UK users, targets the UK market, or is capable of UK use and there are reasonable grounds to believe that UK users face a material risk of significant harm from content on or accessible through it.

Map each product function and identify who creates content, who can encounter it, and whether a search engine presents results.
Apply the UK-links test to the service facts, including UK users, marketing, language, commercial targeting, and the identified harm route.
Record separate conclusions for user-to-user, search, combined-service, and provider-pornography parts.

Citations

Online Safety Act 2023

Defines user-to-user services, search services, combined services, and related concepts.

Online Safety Act 2023

Sets the UK-links test for regulated user-to-user and search services.

Online Safety Act 2023

Introduces the Part 5 duties for regulated provider pornographic content.

Question 2

Which exclusions and edge cases need a closer check?

Schedule 1 exempts specified services or parts of services, including email, SMS and MMS, one-to-one live aural communications, limited functionality, certain internal business services, and services provided by public bodies or qualifying education and childcare providers. Each exemption has conditions. An exempt function does not automatically exempt the rest of a combined product.

Comments and reviews on provider content can fall within the limited-functionality exemption only if the statutory conditions are met. File storage, group messaging, forums, dating, gaming, social media, and content-sharing features can be user-to-user services even when interaction is not the product's main purpose. Apply the definitions to the actual journey rather than the marketing label.

Test every relied-on exemption against its full statutory conditions and document which service part it covers.
Reassess scope before launching messaging, sharing, comments, public profiles, feeds, search, or UK targeting.
Escalate borderline classifications where users, providers, and third parties contribute content in different parts of the same service.

Citations

Online Safety Act 2023

Lists exempt user-to-user and search services and the conditions attached to each exemption.

UK Government - Online Safety Act explainer

Gives official examples of covered services, exempt services, and the Act's application to providers outside the UK.

Question 3

What should the scope record contain?

The scope record should be short enough to review but detailed enough to reproduce the decision. Include a service map, the relevant statutory definition, UK-links evidence, every exemption considered, the provider entity, and the product owner. State any assumptions and the event that will trigger reassessment.

Scope is only the gateway. If a Part 3 service is regulated, the provider must address illegal-content duties and complete a children's access assessment. Categorisation, transparency reporting, and some additional duties are later questions; a service can be regulated without appearing on Ofcom's categorised-services register.

Keep dated screenshots, feature descriptions, user-flow evidence, UK audience data, and the approved scope rationale.
Assign review triggers for product changes, acquisitions, new UK launches, user growth, and new evidence about harm.
Link the result to the illegal content risk assessment and children's access assessment rather than treating the scope memo as the compliance outcome.

Citations

Ofcom - Online safety regulatory documents and guidance

Provides the current Ofcom guidance set for risk assessments, record keeping, child access, age assurance, and codes.

Online Safety Act 2023

Establishes Ofcom's register of categorised services, which is separate from the baseline regulated-service test.

Recommended next step