This page summarizes the UK Online Safety Act requirements in plain English: in-scope services must reduce illegal content risks, protect children from harmful and age-inappropriate content, give adults more control on Category 1 services, provide reporting and complaints routes, and meet Ofcom's record-keeping and enforcement expectations.
Requirements depend on the regulated service part, child-access result, content and risk, provider-pornography status, formal category, and current Ofcom instruments.
Start by identifying the service and its regulated parts. All regulated Part 3 user-to-user and search services have illegal-content, children's access assessment, reporting, complaints, privacy, freedom-of-expression, record, and review duties. Child-accessible services, provider-pornography services, and formally categorised services have additional requirements.
For every regulated Part 3 service, complete and keep up to date an illegal-content risk assessment, implement proportionate safety systems and processes for the applicable user-to-user or search duties, provide content-reporting and complaints procedures, address freedom of expression and privacy, and keep the records required by sections 23 or 34.
Every Part 3 service must also complete a children's access assessment. If children are likely to access the service or a part of it, complete a separate children's risk assessment, implement the applicable protection-of-children duties, keep the assessment current, and record the measures and reviews.
A service with UK links that publishes or displays provider pornographic content falls under Part 5 and must use age verification or age estimation that meets the Act's effectiveness standard so children are not normally able to encounter that content. User-uploaded pornography on a Part 3 service must be analysed under the relevant Part 3 child-safety duties.
Formal categorisation adds requirements. Category 1 duties include user empowerment, identity verification, protections and procedures for specified content, terms, complaints, and assessments. Category 1 and 2A services have fraudulent-advertising and specified risk-record duties; Category 1, 2A, and 2B services can have transparency-reporting duties. Fee duties use a separate qualifying-worldwide-revenue threshold and exemptions. Confirm the current commencement, notice, and code for each deliverable.
Sources (2)
Primary legislation for Part 3, Part 5, categorised-service, Ofcom, record, information, and enforcement requirements.
Current issued codes and guidance for illegal-content, child-safety, assessment, content-judgement, and record duties.
The provider should assign one accountable executive or senior owner for the service-level program and named operational owners for scope, risk assessments, moderation, search, recommender systems, age assurance, reporting, complaints, terms, privacy, records, and regulator responses.
The evidence set should show the approved service boundary, assessments, risk-to-control mapping, code or alternative-measure rationale, implementation and testing, terms and user journeys, complaints outcomes, review dates, incidents, and any information supplied to Ofcom.
Sources (2)
Binding record-keeping and review requirements for user-to-user and search providers.
Official context for meeting online-safety and data-protection responsibilities together when controls process personal data.
The most common mapping error is applying the right topic to the wrong service part. User-to-user and search duties use different statutory language, and provider pornographic content has a separate Part 5 regime.
Another error is treating categorisation as the start of compliance. Core Part 3 duties apply to regulated services whether or not Ofcom places them in Category 1, 2A, or 2B.
Sources (2)
Binding distinctions among service types, duties, content, child access, provider pornography, and categories.
Official data-protection context where age-assurance requirements and children's privacy overlap.
Build the requirements register in order: scope; illegal-content assessment; core safety, reporting, complaints, privacy, and record duties; children's access; child-safety duties; provider pornography; formal category; and any Ofcom notice or information request.
Existing-service deadlines in 2025 have passed. New or changed services must use the Act and Ofcom guidance's event-based timing, including assessment before significant changes and the applicable three-month periods after a service or duty comes into scope.
Sources (2)
Current regulator sequence for scope, illegal-content duties, children's access, and protection-of-children work.
Current illegal-content assessment and category-specific risk-record submission expectations.
Assign each applicable duty to a service part, control owner, evidence record, review trigger, and current legal or regulatory source.
Record each duty trigger, service part, owner, control evidence, and review action.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.