About the UK Online Safety Act
Where the regime stands
The Online Safety Act is no longer a forward-looking compliance project. The core duties are live, Ofcom is increasingly using its enforcement powers, and the most demanding obligations have just landed on the UK’s largest services.
- Illegal content duties have been in force since March 2025. Every regulated user-to-user and search service must complete and maintain an illegal content risk assessment and implement the safety measures that follow from it.
- Children’s safety duties took effect in July 2025, bringing highly effective age assurance, safer feeds and recommender system controls into force for services likely to be accessed by children.
- Categorised service duties are now here. Ofcom published its register of categorised services in July 2026, designating Category 1, 2A and 2B services alongside a list of “emerging Category 1” services on watch.
Enforcement is active and escalating. Ofcom has engaged with a range of services and commenced early, high-profile investigations. It has also treated failure to respond to a statutory information request as a breach attracting its own sanction – an approach that has real consequences for how providers handle first contact with the regulator.
Penalties are up to £18 million or 10% of qualifying worldwide revenue, whichever is higher. Ofcom can also seek business disruption measures, and senior managers face personal liability in certain circumstances.
The practical consequence. A service can be substantively compliant and still find itself in difficulty because of how it handled an information notice, documented a risk assessment or explained a design decision. Process and evidence matter as much as outcomes.