UK Online Safety Act Service Scope and Categorization
First decide whether each service part is regulated. Only then test the Category 1, 2A, and 2B thresholds and compare the result with Ofcom's register.
Core Part 3 duties apply to regulated services regardless of category. Categorisation adds duties and can apply differently to the user-to-user and search parts of one combined service.
Use two separate decisions. Stage one establishes whether the product contains a regulated user-to-user service, regulated search service, or both. Stage two applies the statutory user-number and functionality thresholds to each regulated part. Ofcom, not the provider, makes the formal categorisation decision and records the result in its register of categorised services.
1
Section 1
How do scope and category tests fit together?
Stage one asks whether users can encounter content generated, uploaded, or shared by other users, whether the service is or includes a search engine, whether the service has UK links, whether Schedule 1 exempts the relevant functionality, and whether Schedule 2 excludes the service from Part 3. A combined service can contain both a regulated user-to-user part and a regulated public search engine.
Stage two uses the Online Safety Act 2023 (Category 1, Category 2A and Category 2B Threshold Conditions) Regulations 2025. Category 1 applies to a regulated user-to-user service exceeding 34 million with a content recommender system, or exceeding 7 million with both a recommender and qualifying forward-or-share functionality.
Category 2A applies to a regulated search service or search engine of a combined service exceeding 7 million , subject to the Regulations' exception for certain topic-specific searches of selected sites or databases under a relevant arrangement. Category 2B applies to a regulated user-to-user service exceeding 3 million average monthly active UK users with the specified direct-messaging functionality.
Calculate the mean monthly active UK users over the six-month period ending with the month before the assessment begins, or over the shorter operating period for a newer service. Preserve the data method, service boundary, recommender and messaging design, and search facts used in the calculation.
Record a separate Part 3 scope conclusion for each user-to-user and search part.
Apply each category threshold to the same service boundary used in the scope record.
Distinguish a provider's threshold estimate from Ofcom's formal entry on the register.
Map additional duties only to the category and service part to which they legally attach.
Binding Category 1, 2A, and 2B user-number, functionality, search, and calculation conditions.
2
Section 2
Who owns the calculation and supporting evidence?
Product and legal owners should approve the Part 3 service boundary. Data owners should produce the active-UK-user calculation, while engineering documents recommender, forwarding, sharing, messaging, and search functionality. One accountable regulatory owner should reconcile those records with Ofcom's published register.
Keep the scope memo, threshold workbook, data definitions, six-month extracts, architecture and user journeys, formal register entry, Ofcom correspondence, and assigned additional duties together. A category record without the underlying service boundary is not enough.
Name owners for scope, user metrics, functionality evidence, legal review, and Ofcom communications.
Keep monthly active UK user definitions stable and explain deduplication, bots, accounts, logged-out use, and combined-service allocation.
Save the exact version of recommender, forwarding, direct-message, and search functionality assessed.
Review the internal estimate after user growth, acquisitions, service redesign, or an Ofcom information request.
Regulation 6 specifies the average monthly active UK user calculation and reference period.
3
Section 3
Which threshold and service-boundary details matter?
A service can meet more than one category, and the parts of a combined service can be categorised differently. Ofcom's register, for example, can identify only a public search engine within a wider product as Category 2A; that does not categorise unrelated product functionality.
Threshold wording matters. The figures are exceeded, not merely met, and the functionality conditions must be present in the regulated part. The six-month average is not a single peak-month count.
Do not use categorisation as a proxy for risk: a non-categorised service can still have high illegal-content or child-safety risks and remains subject to its core duties.
Do not apply the Category 2A topic-specific search exception without checking both selected-source and relevant-arrangement conditions.
Check whether direct messages are designed so no other user can encounter them unless sender or recipient takes further action; ordinary private messaging labels do not settle the test.
Use Ofcom's register for formal status and preserve any disagreement between the register boundary and the provider's internal model for legal review.
Binding wording for exceeded thresholds, relevant functionality, the Category 2A exception, and the reference period.
4
Section 4
How should teams implement scope and categorisation decisions?
Use a gated workflow: approve Part 3 scope; calculate every potentially relevant threshold; compare with the formal register; then assign the additional duties to the exact service part. Do not pause core risk and child-access work while waiting for a category decision.
The current register, updated on 28 September 2026, makes categorisation operational for listed services. Ofcom's current materials also set category-specific expectations, including submission of current illegal-content risk-assessment records by Category 1 and 2A providers by October 2026.
Record the register publication and entry date rather than backdating category-specific work to the initial Part 3 deadlines.
Map Category 1 user-empowerment, identity-verification, news, journalistic, democratic-importance, terms, complaints, and assessment duties to the user-to-user part.
Map Category 1 and 2A fraudulent-advertising and risk-record submission duties, and Category 1, 2A, and 2B transparency-reporting duties, only after checking commencement and current Ofcom directions. Fee duties use a separate qualifying-worldwide-revenue threshold and exemptions.
Track Ofcom consultations and issued codes separately; a draft additional-duties code is not binding law.
Official register first published on 30 June 2026 and most recently updated on 28 September 2026, including category boundaries, providers, and the emerging Category 1 list.
Official register updated on 28 September 2026, threshold summary, service-part descriptions, and emerging Category 1 list.
Official examples of service-part categorisation and the distinction between a category entry and unrelated functionality.
Show 1 more
Formal category status and service-part descriptions in the register updated on 28 September 2026.