UK

What is the status of the Online Safety Act?

Status

The Online Safety Act ("OSA") received Royal Assent on 26 October 2023, upon which pursuant to s.240(4) OSA certain (though not all) provisions came into force, and Ofcom's powers as an online safety regulator commenced.

Since Royal Assent, the following commencement regulations have been made by the Secretary of State bringing various other provisions into force:

• The Online Safety Act 2023 (Commencement No 1) Regulations 2023 – provisions relating to the cooperation of overseas regulators (in force 22 November 2023)
• The Online Safety Act 2023 (Commencement No 2) Regulations 2023 – a number of provisions, including Ofcom's power to issue information notices, and the transition period for the VSP regime (in force 10 January 2024); and information requests in connection with an investigation into the death of a child (in force 1 April 2024)
• The Online Safety Act 2023 (Commencement No 3) Regulations 2024 – new communications offences (in force 31 January 2024)
• The Online Safety Act 2023 (Commencement No 4) Regulations 2024 – obligations for providers of adult entertainment and various enforcement powers for Ofcom in relation to those providers (in force 17 January 2025)

Importantly, however, the key risk assessment and safety duties on in-scope services do not apply until relevant Ofcom guidance/codes of practice have been finalised on a phased basis. So far, Ofcom has consulted on and published its Illegal Harms Statement, including its Risk Assessment Guidance and Risk Profiles for illegal harms, and its final draft Illegal content Codes of Practice for user-to-user and search services, which were laid before Parliament on 16 December 2024. Businesses will need to finish conducting their first illegal content risk assessments by 16 March 2025 (within 3 months of publication) and are expected to need to start complying with their illegal content safety duties from 17 March 2025. The other risk assessment and safety duties (including those related to children's harms and for categorised services) will follow.

In relation to UK-established VSPs already subject to direct Ofcom regulation (“UK VSPs”), The Online Safety Act 2023 (Pre-existing Part 4B Services Assessment Start Day) Regulations 2024 mean they also have to carry out OSA risk assessments on the same timeframes as other services caught by OSA. However, UK VSPs will not need to comply with the majority of other OSA duties until the existing UK VSP regime has been repealed, likely in Q3 2025.

Ofcom has set out expected timings for finalisation of its guidance/codes of practice (and resulting timings for complying with the relevant duties) at Ofcom’s approach to implementing the Online Safety Act.

What entity has been appointed as regulator for the purposes of the Online Safety Act?

Name: 
The Office of Communications ("Ofcom")

Website - Ofcom
National law dealing with powers and appointment