Classify the service from its functions and UK links, apply the statutory exemptions, and keep Part 3 scope separate from Category 1, 2A, or 2B status.
Most safety duties do not wait for categorisation. Categorisation adds duties only after the threshold process and Ofcom register apply to the service.
Start with the service's actual functions, not its product label. A user-to-user service lets users encounter content generated, uploaded, or shared by other users; a search service is or includes an internet search engine. Then test the UK link and every relevant exemption. After settling Part 3 scope, compare the service with the 2025 category thresholds and Ofcom's register. Formal Category 1, 2A, or 2B status comes from the register, not a provider's self-label.
Start with the service's functions. Map user posts, comments, messages, groups, livestreams, uploads, reviews, recommender feeds, and search features. A service may contain both user-to-user and search functions, and an exemption for one function does not automatically exempt a mixed service.
Next test the UK link: whether the service has a significant number of UK users, UK users form a target market, or it is capable of use by individuals in the UK and there are reasonable grounds to believe that its relevant user-generated or search content presents a material risk of significant harm to people in the UK. Keep the user, marketing, distribution, language, and harm evidence behind the conclusion.
Apply the Act's exclusions and exemptions to the precise service or content at issue. Email, SMS and MMS, one-to-one live aural communications, internal business services, limited-function services, provider content, and news-publisher content each have defined conditions; the product label alone does not decide the result.
Record Part 3 status before considering categorisation. Under the 2025 threshold regulations, Category 1 covers a user-to-user part with more than 34 million average monthly active UK users plus a content recommender, or more than 7 million plus a recommender and forward-or-share functionality. covers a search engine with more than 7 million average monthly active UK users, subject to the specified exception for topic-specific searches of selected sites or databases under a relevant arrangement. Category 2B covers a user-to-user part with more than 3 million average monthly active UK users plus qualifying direct messaging. Apply the statutory measurement rules and then check Ofcom's current register. The register illustrates the boundaries: Facebook's user-to-user part is Category 1, ChatGPT Search is Category 2A without that finding extending to non-search chatbot content, and services such as Airbnb and Discord are Category 2B.
Sources (7)
Binding UK-links tests, including the reasonable-grounds and relevant-content conditions.
Binding source for regulated user-to-user and search services, service duties, and the distinction between baseline and categorised-service duties.
Binding secondary legislation for Category 1, 2A, and 2B user-number, functionality, service-characteristic, and measurement conditions.
Confirms the register first published on 30 June 2026 and updated on 28 September 2026, formally categorised services, threshold summaries, and service-part boundaries.
Supports a risk- and evidence-based classification workflow for deciding which Online Safety Act duties a service must operationalize.
Providers must use risk and evidence-based approaches to ensure there is no room for illegal content and activity on their platforms.
Joint regulator statement on coordinating online-safety and data-protection duties.
Online safety and data protection can interact in a variety of ways.
Official overview of the Act and related regulatory materials.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Capture the provider, service name and boundary, feature map, user-content pathways, search functionality, UK-link evidence, each exemption considered, mixed-service treatment, Part 3 result, children's-access trigger, categorisation metrics, measurement period, threshold provision, Ofcom-register status, assumptions, reviewer, approval, and change triggers.
Sources (3)
Joint regulator statement on coordinating online-safety and data-protection duties.
Online safety and data protection can interact in a variety of ways.
Official overview of the Act and related regulatory materials.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Official overview of the Act and related regulatory materials.
The Online Safety Act 2023 (the Act) protects children and adults online.
Reassess classification after a new user-content or search function, material change in UK users or targeting, acquisition or entity change, exemption-relevant design change, threshold-period update, or Ofcom register update. A combined service can have its user-to-user part in Category 1 or 2B and its public search engine in , so record the regulated part to which each additional duty applies.
Sources (4)
Official overview of the Act and related regulatory materials.
Providers must use risk and evidence-based approaches to ensure there is no room for illegal content and activity on their platforms.
Joint regulator statement on coordinating online-safety and data-protection duties.
Online safety and data protection can interact in a variety of ways.
Official overview of the Act and related regulatory materials.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Official overview of the Act and related regulatory materials.
The Online Safety Act 2023 (the Act) protects children and adults online.
Record the service boundary, UK links, exemptions, threshold evidence, Ofcom status, owners, and events that reopen the classification.
Record the functions, UK links, exemptions, user calculation, register status and reassessment owner.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Providers must use risk and evidence-based approaches to ensure there is no room for illegal content and activity on their platforms."
"Online safety and data protection can interact in a variety of ways."
"The Online Safety Act 2023 (the Act) protects children and adults online."
"The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online."
"Online Safety Act"
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Organise recurring Online Safety Act risk assessments across product, safety, data, engineering, legal, and governance teams.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.