UK Online Safety Act Requirements

For every regulated Part 3 service, complete and keep up to date an illegal-content risk assessment, implement proportionate safety systems and processes for the applicable user-to-user or search duties, provide content-reporting and complaints procedures, address freedom of expression and privacy, and keep the records required by sections 23 or 34.

Every Part 3 service must also complete a children's access assessment. If children are likely to access the service or a part of it, complete a separate children's risk assessment, implement the applicable protection-of-children duties, keep the assessment current, and record the measures and reviews.

A service with UK links that publishes or displays provider pornographic content falls under Part 5 and must use age verification or age estimation that meets the Act's effectiveness standard so children are not normally able to encounter that content. User-uploaded pornography on a Part 3 service must be analysed under the relevant Part 3 child-safety duties.

Formal categorisation adds requirements. Category 1 duties include user empowerment, identity verification, protections and procedures for specified content, terms, complaints, and assessments. Category 1 and 2A services have fraudulent-advertising and specified risk-record duties; Category 1, 2A, and 2B services can have transparency-reporting duties. Fee duties use a separate qualifying-worldwide-revenue threshold and exemptions. Confirm the current commencement, notice, and code for each deliverable.

The provider should assign one accountable executive or senior owner for the service-level program and named operational owners for scope, risk assessments, moderation, search, recommender systems, age assurance, reporting, complaints, terms, privacy, records, and regulator responses.

The evidence set should show the approved service boundary, assessments, risk-to-control mapping, code or alternative-measure rationale, implementation and testing, terms and user journeys, complaints outcomes, review dates, incidents, and any information supplied to Ofcom.

The most common mapping error is applying the right topic to the wrong service part. User-to-user and search duties use different statutory language, and provider pornographic content has a separate Part 5 regime.

Another error is treating categorisation as the start of compliance. Core Part 3 duties apply to regulated services whether or not Ofcom places them in Category 1, 2A, or 2B.

Build the requirements register in order: scope; illegal-content assessment; core safety, reporting, complaints, privacy, and record duties; children's access; child-safety duties; provider pornography; formal category; and any Ofcom notice or information request.

Existing-service deadlines in 2025 have passed. New or changed services must use the Act and Ofcom guidance's event-based timing, including assessment before significant changes and the applicable three-month periods after a service or duty comes into scope.