UK Online Safety Act — Categorised Services Register

What this countdown tracks

The clock above counts down to Ofcom's publication of the first register of categorised services under the UK Online Safety Act 2023, expected around July 1, 2026. The register names which Part-3 user-to-user and search services fall into Category 1, 2A, or 2B — the trigger for the heaviest set of duties under the OSA, including transparency reporting, user-empowerment tools, and adult-content/pornographic-content controls.

About this regulation

The Online Safety Act 2023 received Royal Assent on 26 October 2023. Ofcom is implementing the regime in phases through 2024–2027. Phase 1 (illegal content) and Phase 2 (children) duties are already in force. Phase 3 — the categorised-services duties — kicks in once Ofcom designates which services meet the Schedule 11 thresholds set out in the secondary legislation laid by DSIT in March 2025 and updated through 2025–2026.

Category 1 captures the largest user-to-user services with content-recommendation algorithms — typically over 7 million UK users (or 3 million plus the algorithm condition). Category 2A applies to large search services. Category 2B captures user-to-user services with high-risk functionalities such as direct-message-from-strangers or live-streaming, with thresholds at 3 million UK users. Once a service is on the register, Ofcom can require detailed transparency reports, user-empowerment defaults (mute, block, content filters), and pornographic-content age-verification.

What changes

After the register publishes (expected ~July 2026):

• Designated Category 1 services must offer adult users tools to filter abusive content and unverified accounts.
• Annual transparency reports become mandatory for designated services.
• "Fraudulent advertising" duties bite for Category 1 and 2A services.
• Category 1 services must take down content that breaches their own terms of service consistently.
• Ofcom can impose fines up to £18m or 10% of global turnover for breach of these duties.

Past milestones

• March 2025: Secondary legislation on Schedule 11 thresholds laid in Parliament.
• 2024–2025: Ofcom Phase 1 and Phase 2 codes of practice published.
• October 2023: Royal Assent of the Online Safety Act.
• January 2023: Bill returns from Lords with major amendments.
• May 2021: Original Online Safety Bill published.

How to follow

Official guidance, codes, and the categorisation register publish at ofcom.org.uk/online-safety. DSIT updates appear on gov.uk/government/organisations/department-for-science-innovation-and-technology. Industry coverage from Politico UK, the Times tech desk, the Guardian Tech, Wired UK, and the Center for Democracy & Technology UK.

Related countdowns

Pair this with peer regulatory milestones: EU AI Act enforcement 2026, EU CRA application 2027, DMA first review 2026, DPDP Phase 2 consent manager 2026, and California SB 253 first reports 2026.

FAQ

When does Ofcom publish the categorisation register? Expected around July 1, 2026, after the secondary legislation thresholds finalize. Where does the OSA apply? Services with significant UK user bases, regardless of where the company is based. Why does this matter? It is the moment large platforms — Meta, TikTok, X, YouTube, Reddit — formally enter the strictest tier of UK content-regulation duties. What's the penalty for breach? Up to £18m or 10% of qualifying global turnover, plus business-disruption measures and personal liability for senior managers in some cases.