UK Online Safety Act Service Classification Workflow

Start with the service's functions. Map user posts, comments, messages, groups, livestreams, uploads, reviews, recommender feeds, and search features. A service may contain both user-to-user and search functions, and an exemption for one function does not automatically exempt a mixed service.

Next test the UK link: whether the service has a significant number of UK users, targets the UK market, or is capable of use in the UK and presents a material risk of significant harm to individuals in the UK. Keep the user, marketing, distribution, language, and harm evidence behind the conclusion.

Apply the Act's exclusions and exemptions to the precise service or content at issue. Email, SMS and MMS, one-to-one live aural communications, internal business services, limited-function services, provider content, and news-publisher content each have defined conditions; the product label alone does not decide the result.

Record Part 3 status before considering categorisation. Under the 2025 threshold regulations, Category 1 covers a user-to-user part with more than 34 million average monthly active UK users plus a content recommender, or more than 7 million plus a recommender and forward-or-share functionality. Category 2A covers a non-vertical search engine with more than 7 million average monthly active UK users. Category 2B covers a user-to-user part with more than 3 million average monthly active UK users plus qualifying direct messaging. Apply the statutory measurement rules and then check Ofcom's current register. The register illustrates the boundaries: Facebook's user-to-user part is Category 1, ChatGPT Search is Category 2A without that finding extending to non-search chatbot content, and services such as Airbnb and Discord are Category 2B.

Capture the provider, service name and boundary, feature map, user-content pathways, search functionality, UK-link evidence, each exemption considered, mixed-service treatment, Part 3 result, children's-access trigger, categorisation metrics, measurement period, threshold provision, Ofcom-register status, assumptions, reviewer, approval, and change triggers.

Reassess classification after a new user-content or search function, material change in UK users or targeting, acquisition or entity change, exemption-relevant design change, threshold-period update, or Ofcom register update. A combined service can have its user-to-user part in Category 1 or 2B and its public search engine in Category 2A, so record the regulated part to which each additional duty applies.