Requirements GuideControl Mapping

UK Online Safety Act Requirements

Translate the Act into control obligations, not generic compliance themes.

This page maps the live duty set into owners, evidence, and review points so the work can be executed.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

The UK OSA requirements set is layered. Every program should map baseline scope and illegal harms duties first, then child-access and child-safety duties where relevant, then category-specific duties if the service is categorised, and finally the enforcement and information notice response capabilities that sit across the whole program.

Section 1

Base requirements for all in-scope services

Base requirements include service scoping, illegal content risk assessment, systems and processes to mitigate illegal activity, takedown and moderation design, and usable reporting and complaints procedures. Search and user-to-user services share the same general structure but not identical section numbering.

These controls should exist even if the service is not large.

Scope register and service classification memo
Illegal content risk assessment and updates
Moderation, reporting, and complaints procedures
Evidence retention for decisions, metrics, and control testing

Recommended next step

Turn UK Online Safety Act Requirements into an operational assessment

Assessment Autopilot can take UK Online Safety Act Requirements from turning the requirements into assigned actions to a reusable workflow inside Sorena. Teams working on UK Online Safety Act can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for UK Online Safety Act Requirements

Start from UK Online Safety Act Requirements and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through UK Online Safety Act

Review your current process, evidence gaps, and next steps for UK Online Safety Act Requirements.

Explore next step

Section 2

Additional requirements where children are likely to access the service

Where children are likely to access the service, the program must add child access analysis, children risk assessment, age assurance or age gating decisions where used, and product controls that actually prevent exposure to harmful content.

This work should also account for ICO child-data expectations, especially around privacy defaults, profiling, and geolocation.

Child access assessment and rationale
Children risk assessment and age-banded harm analysis
Age assurance design, testing, and privacy review
Child-safe product defaults and high-risk feature controls

Section 3

Additional requirements for categorised services and enforcement readiness

Category 1, 2A, and 2B services have additional transparency and accountability exposure once categorised. Across the program, providers also need to be ready for information notices, senior manager naming, transparency reporting, and financial penalty exposure.

This means the controls map should include both duty controls and regulator-response controls.