Online Safety Act 2023: time to prepare as UK's Ofcom confirms start of illegal content duties

Ofcom has published an updated roadmap that sets out its progress in implementing the Online Safety Act 2023 (OSA) since it became law a year ago and presents its implementation plans for 2025. The online safety regulator has confirmed that it will publish its code of practice on illegal content duties in December. It expects the illegal content safety provisions to come into force in March 2025. However, publication of the register of categorised services will be delayed.

Ofcom's phased approach

Ofcom's implementation of the OSA takes a phased approach that will continue into 2026. The regulator has also set out its main expected important dates for compliance; noting, however, that these could change as it continues to engage with stakeholders and the government prepares the necessary secondary legislation. 

Phase one: illegal harms

Ofcom is due to publish the first edition of its illegal harms codes of practice and illegal-content risk assessment guidance in December. This will mark the start of the duty on all in-scope services to carry out an illegal content risk assessment to evaluate the risk of illegal content appearing on their service. This must be completed by mid-March 2025, in time to start fulfilling the illegal content safety requirements, which Ofcom expects to come into force that same month, once the codes have been approved by Parliament.

As soon as this happens, Ofcom will be able to enforce against non-compliance and, in that vein, it also plans to publish its final enforcement guidance, together with its final record keeping and review guidance, in December.

Further proposals to strengthen the codes, including suggestions received during the consultation period, will be published in spring 2025. 

Phase two: child safety and other content

The second phase will cover child safety, pornography and the protection of women and girls. Publication of Ofcom's final age-assurance guidance for publishers of pornographic content should follow in January 2025. The regulator expects the government to commence part 5 of the OSA around the same time, at which point these publishers' duties will be enforceable and Ofcom will start to monitor compliance.

Ofcom plans to release its final children's access assessment guidance in January 2025, from which point all in-scope service providers will have three months to assess whether their service is likely to be accessed by children, that is, by April 2025. Ofcom plans to publish its protection of children codes of practice and risk assessment guidance in April 2025, from which point services likely to be accessed by children will have three months to carry out a children's risk assessment, that is, by July 2025.

The regulator also plans to introduce its draft guidance on protecting women and girls online in February 2025.

Phase three: categorised services

The final stage of implementation covers categorisation and additional duties for categorised services. This relates to the additional duties for services that are designated category 1, 2A or 2B.

According to the original roadmap, Ofcom had planned to publish the register of categorised services, setting out which services fall into which category, by the end of this year. However, this is dependent on the government setting the thresholds for categorisation in secondary legislation, which has not yet transpired. Therefore, publication of the register has been delayed, and Ofcom does not now expect to publish it until summer 2025.

Ofcom has, however, published a note on online service categorisation explaining the steps it will take to issue information notices to relevant providers to gather data to help it decide which services should be categorised and into which categories. These notices will be issued in draft form first and in final form once the secondary legislation is passed.

The regulator has also reprioritised its work on the duties of categorised services to ensure that it delivers "most quickly in the areas that we expect to be particularly beneficial in protecting user". Ofcom expects the transparency duties to be among the most effective and intends to start issuing draft transparency notices to services within a few weeks of the register of categorised services being finalised.

The draft codes of practice on the other duties on categorised services are expected by early 2026 at the latest.

Ofcom ready for enforcement

The regulator says that its preference is to work with in-scope services to encourage voluntary compliance. However, it also says that it will take enforcement action when necessary. It expects its early enforcement of the new rules to focus on ensuring that services adequately assess risk and put in place measures to protect users, especially children, from serious harms like child sexual abuse, pornography and fraud.

Peter Kyle, the science secretary, recently wrote to Ofcom saying that the government fully supports the regulator using its enforcement powers. The secretary of state also requested information on whether the regulator is considering any further measures to counter disinformation online in the next version of the illegal harms code of practice, given the prolific spread of misleading content in recent times.

Ofcom's chief, Melanie Dawes, in a letter to Parliament's select committees, published at the same time as the updated roadmap, said that the regulator's already established supervisory teams of interdisciplinary experts are developing an understanding of certain particularly critical services, including large services with significant reach and smaller, but high-risk, services.

Ofcom wants services to understand their duties now, have plans in place for compliance next year and identify accountable senior staff.

Osborne Clarke comment

Other than the delay in relation to the register of categorised services, the rest of the roadmap is on schedule. For all services caught by the OSA, now is the time to prepare as there will be only three months in which to undertake and conclude the illegal content risk assessment once the guidance on how to do so is published in December.

Anna Matsiienko, Knowledge Paralegal at Osborne Clarke, assisted in producing this Insight.