The Act regulates UK-linked user-to-user and search services under Part 3 and UK-linked services that publish provider pornographic content under Part 5.
Scope follows the service's functions and content flows. Exempt functions, mixed services, and separate provider-pornography duties must be recorded rather than collapsed into one product-wide label.
A is a regulated user-to-user service, a regulated search service, or a UK-linked service that publishes or displays provider pornographic content. For Part 3, identify the user-to-user or search functionality, establish a UK link, and apply Schedules 1 and 2. For Part 5, identify pornographic content published or displayed by the provider and apply that Part's separate UK-link and age-verification rules.
For a user-to-user service, ask whether content generated, uploaded, or shared by one user may be encountered by another. For a search service, ask whether the internet service is or includes a search engine. A combined service can contain both, and the Act can apply different duties to each regulated part.
A Part 3 service must have links with the United Kingdom, fall outside the relevant Schedule 1 exemption, and not be a service described in Schedule 2. The UK link can arise from significant UK use, targeting the UK market, or UK access combined with reasonable grounds to believe the relevant content presents a material risk of significant harm to people in the United Kingdom.
Part 5 is different: it covers a service with UK links when pornographic content is published or displayed by the provider. User-uploaded pornography on a Part 3 service and provider pornographic content can therefore engage different provisions and age-assurance duties.
Once scope is established, assign duties to the correct service part. Core Part 3 duties include illegal-content risk assessment and safety duties, children's access assessment, content reporting, complaints, freedom-of-expression and privacy protections, and records. Child-safety and categorised-service duties depend on later tests.
Sources (3)
Sections 3 and 4 define Part 3 service types, regulated services, combined services, UK links, and the connection to Schedule 1; Part 5 covers provider pornographic content.
Binding exemptions for specified user-to-user and search services and functionality.
Binding descriptions of services excluded from Part 3 but still regulated under Part 5.
Product and engineering should document how users create, upload, share, encounter, and search content. The provider's legal or regulatory owner should apply the Act to those facts and approve the boundary between regulated, exempt, and out-of-scope functions.
A useful scope record contains the provider entity, service map, user permissions, search sources, UK-link evidence, Schedule 1 analysis, provider-content analysis, decision date, reviewer, unresolved points, and specific reassessment triggers.
Sources (2)
Current regulator guidance for recording service facts and applying the scope sequence.
Binding rules for regulated services, UK links, exemptions, and combined services.
Common boundary errors include treating all messaging as exempt, assuming comments or reviews are too limited to count, treating an entire combined product as one service, and using company size as a scope threshold.
The Schedule 1 descriptions are conditional. For example, one-to-one live aural communication is different from text, recorded audio, group communication, or a service that adds other user-to-user functionality.
Sources (2)
Full conditions and exceptions for the service descriptions that are exempt from Part 3.
Separate scope and duties for services publishing or displaying provider pornographic content.
Produce one approved service-scope memo with a separate conclusion for every relevant service part. Link each in-scope part to its illegal-content assessment, children's access assessment, safety controls, reporting and complaints procedure, and record-keeping owner.
If the service relies on an exemption, record the feature constraints that keep it within the exemption. A later design change can remove that factual basis even when the product name and provider remain the same.
Sources (2)
Primary source for scope, service-specific duties, records, and Ofcom's regulatory powers.
Current regulator sequence from scope through the assessments and safety duties.
Record the provider, service boundary, UK-link evidence, exemption analysis, owners, and reassessment triggers for every relevant service part.
Record each function, provider, UK link, exemption condition, decision, and review trigger.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.