UK

What is the status of the Online Safety Act?

Status

The Online Safety Act ("OSA") received Royal Assent on 26 October 2023, upon which pursuant to s.240(4) OSA certain (though not all) provisions came into force, and Ofcom's powers as an online safety regulator commenced.

Since Royal Assent, the following commencement regulations have been made by the Secretary of State bringing various other provisions into force:

• The Online Safety Act 2023 (Commencement No 1) Regulations 2023 – provisions relating to the cooperation of overseas regulators (in force 22 November 2023)
• The Online Safety Act 2023 (Commencement No 2) Regulations 2023 – a number of provisions, including Ofcom's power to issue information notices, and the transition period for the VSP regime (in force 10 January 2024); and information requests in connection with an investigation into the death of a child (in force 1 April 2024)
• The Online Safety Act 2023 (Commencement No 3) Regulations 2024 – new communications offences (in force 31 January 2024)
• The Online Safety Act 2023 (Commencement No 4) Regulations 2024 – obligations for providers of adult entertainment and various enforcement powers for Ofcom in relation to those providers (in force 17 January 2025)
• The Online Safety Act 2023 (Commencement No 5) Regulations 2025 – obligations for user-to-user service providers to report CSEA content to the NCA, and associated criminal offences and enforcement-related provisions (in force 3 November 2025 – the same date as the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2025, accessible here , also come into force
• The Online Safety Act 2023 (Commencement No 6) Regulations 2025 – repeal of Part 4B of the Communications Act 2003 relating to UK VSPs (in force 25 July 2025) (see “Note: VSP regime in transition” below) 

Importantly however, the key risk assessment and safety duties on in-scope organisations only become applicable once relevant Ofcom guidance/codes of practice have been finalised on a phased basis.  

Illegal harms - Ofcom has consulted on and published its Illegal Harms Statement, including its Risk Assessment Guidance and Risk Profiles for illegal harms, and its Illegal content Codes of Practice for user-to-user and search services. Businesses were required to finish their first illegal content risk assessments by 16 March 2025 and to start complying with their illegal content safety duties from 17 March 2025.

Providers of pornographic services - Ofcom has published guidance on age assurance for publishers of pornographic content. Age assurance duties for these providers became applicable from 17 January 2025.

Children’s safety – all user-to-user and search services were required to conduct a “children’s access assessment” by 16 April 2025 to determine whether the children’s safety duties apply to them. Ofcom has consulted on and published its Children’s Harms Statement, including its Children’s Risk Assessment Guidance and Children’s Risk Profiles, and its Protection of Children Codes of Practice for user-to-user and search services. The children’s risk assessment deadline was 24 July 2025, and the children’s safety duties were applicable from 25 July 2025.

Note: VSP regime in transition - In relation to UK-established VSPs already subject to direct Ofcom regulation (“UK VSPs”), The Online Safety Act 2023 (Pre-existing Part 4B Services Assessment Start Day) Regulations 2024 meant they also hadve to carry out OSA risk assessments on the same timeframes as other services caught by OSA. However, UK VSPs were not required to comply with the majority of other OSA duties until the existing UK VSP regime  was repealed by s.210 OSA, which came into force pursuant to the Online Safety Act 2023 (Commencement No 6) Regulations 2025 on 25 July 2025.

A timeline for Ofcom’s publication and/or finalisation of other guidance and codes can be found here. Ofcom will also continue to review and iterate the guidance and codes it has already published.

What entity has been appointed as regulator for the purposes of the Online Safety Act?

Name: 
The Office of Communications ("Ofcom")

Website - Ofcom
National law dealing with powers and appointment