UK Online Safety Act Regulated Service Scope

For a user-to-user service, ask whether content generated, uploaded, or shared by one user may be encountered by another. For a search service, ask whether the internet service is or includes a search engine. A combined service can contain both, and the Act can apply different duties to each regulated part.

A Part 3 service must have links with the United Kingdom, fall outside the relevant Schedule 1 exemption, and not be a service described in Schedule 2. The UK link can arise from significant UK use, targeting the UK market, or UK access combined with reasonable grounds to believe the relevant content presents a material risk of significant harm to people in the United Kingdom.

Part 5 is different: it covers a service with UK links when pornographic content is published or displayed by the provider. User-uploaded pornography on a Part 3 service and provider pornographic content can therefore engage different provisions and age-assurance duties.

Once scope is established, assign duties to the correct service part. Core Part 3 duties include illegal-content risk assessment and safety duties, children's access assessment, content reporting, complaints, freedom-of-expression and privacy protections, and records. Child-safety and categorised-service duties depend on later tests.

Product and engineering should document how users create, upload, share, encounter, and search content. The provider's legal or regulatory owner should apply the Act to those facts and approve the boundary between regulated, exempt, and out-of-scope functions.

A useful scope record contains the provider entity, service map, user permissions, search sources, UK-link evidence, Schedule 1 analysis, provider-content analysis, decision date, reviewer, unresolved points, and specific reassessment triggers.

Common boundary errors include treating all messaging as exempt, assuming comments or reviews are too limited to count, treating an entire combined product as one service, and using company size as a scope threshold.

The Schedule 1 descriptions are conditional. For example, one-to-one live aural communication is different from text, recorded audio, group communication, or a service that adds other user-to-user functionality.

Produce one approved service-scope memo with a separate conclusion for every relevant service part. Link each in-scope part to its illegal-content assessment, children's access assessment, safety controls, reporting and complaints procedure, and record-keeping owner.

If the service relies on an exemption, record the feature constraints that keep it within the exemption. A later design change can remove that factual basis even when the product name and provider remain the same.