UK Online Safety Act Transparency Reporting

Section 77 applies only to a provider of a service entered on Ofcom's register as Category 1, Category 2A, or Category 2B. Ofcom must give a separate notice for each categorised service, even where one provider operates several. Providers should use the July 2026 register to confirm the exact service, provider, category, and regulated part rather than report at group or brand level by default.

Ofcom published the first register on 30 June 2026 and updated it on 10 July 2026. The register identifies the services subject to the transparency regime, but it does not supply the reporting fields or deadline. Ofcom first shares a draft notice so the provider can make written representations, then issues the final notice that creates the report-specific requirements.

Schedule 8 limits the subjects Ofcom may request. Category 1 and 2B notices can require user-to-user information about the listed matters; Category 2A notices can require search-engine information. For a combined service listed in both Category 2A and Category 1 or 2B, Ofcom may require both. If the combined service is listed only in Category 2A, the notice can require only search-engine information.

Possible subjects include the incidence and dissemination of illegal or child-harmful content, assumed user exposure, reports and complaints, moderation and ranking systems, algorithms, risk assessment, safety measures, age assurance, CSEA reporting, user support, media literacy, and cooperation with public bodies. The list is a legal ceiling, not a requirement to report every item in every cycle; the final notice selects the information for that service.

For each reported figure, retain the numerator, denominator, population, time zone, date range, inclusion and exclusion rules, deduplication logic, source system, query version, owner, and known limitation. Explain material changes in methodology or coverage instead of presenting unlike periods as a trend.

Ofcom's final guidance is regulator guidance under section 78, not the notice itself. It explains how Ofcom will choose information, engage with providers, use reports, and enforce the framework. The Act, Schedule 8, the categorisation register, and the final notice control the binding obligation.

Assign one accountable report owner and a data owner for every notice item. Safety and product teams define the underlying operation; data and engineering reproduce the metric; privacy and security review disclosure risks; legal checks the notice and statutory basis; communications controls the published version. Ofcom's final guidance expects appropriate governance and sign-off by an appropriately senior accountable person.

The evidence pack should contain the notice and any pre-notice engagement, service and reporting-period scope, notice-to-field matrix, data dictionary, source-system map, query or calculation, extract, reconciliation, limitation note, reviewer sign-off, senior approval, submitted report, published report, URL, publication date, and any correction. Keep the pack at the same service-part level as the notice.

A notice attaches to one categorised service, not automatically to every product operated by the provider. For a combined service, check whether the register and notice cover the user-to-user part, the search engine, or both. Keep unrelated functions out of the denominator unless the notice includes them.

Check whether a metric can be compared across the entire reporting period. Acquisitions, launches, taxonomy changes, model changes, duplicate accounts, automated-versus-human actions, restored content, changed age-assurance methods, and incomplete historical logging can break comparability. State the break and its effect instead of silently combining unlike data.

Do not omit a requested item because it is difficult to obtain. Escalate the gap during Ofcom's engagement process, document available and unavailable data, and follow the final notice. Providers remain responsible for complete and materially accurate reports, and Ofcom says foreseeable data or resourcing failures are unlikely to excuse non-compliance.

Before the final notice, preserve data readiness and use Ofcom's engagement process to clarify service boundaries, feasibility, definitions, and likely reporting burden. After receipt, parse every requirement into a reporting matrix: requested item, Schedule 8 matter, reporting period, regulated part, definition, source, calculation, limitation, owner, reviewer, approval, submission instruction, and publication instruction.

Run a dry close using the same extraction and approval path. Resolve missing ownership and inconsistent definitions, freeze the reporting cut, reproduce and reconcile the figures, complete the narrative, obtain senior sign-off, submit to Ofcom, and publish the standalone report exactly as the notice directs. The deadline is the number of working days in the notice; the Act does not supply one universal date for every provider.

If an error is found, preserve the original, assess materiality, notify the accountable owner and Ofcom where appropriate, correct the public and submitted versions through a controlled process, and record what changed. Failure to report, missed notice items, wrong format, late submission or publication, and material inaccuracy can lead to enforcement.