Ofcom Delays Online Safety Act Categorisation Register Until July 2026 After Legal Challenge
The UK's online safety regulator Ofcom has delayed the publication of its categorisation register — a cornerstone of the Online Safety Act's implementation — by a full year to July 2026, following a legal challenge from the Wikimedia Foundation that has thrown the regulatory timetable into disarray and left thousands of online platforms in a prolonged state of uncertainty about their compliance obligations.Background
The Online Safety Act, which received Royal Assent in October 2023, represents the UK's most ambitious attempt to regulate the internet. The legislation imposes a tiered system of duties on online platforms, with the most stringent obligations falling on the largest and most harmful services. The categorisation register is the mechanism by which Ofcom determines which platforms fall into Categories 1, 2A, and 2B — a classification that determines the extent of their regulatory duties, including transparency reporting, age verification, and content moderation requirements.
The register was originally due to be published in mid-2025, but Ofcom announced a delay to allow for further consultation and to address legal challenges. The Wikimedia Foundation, which operates Wikipedia, mounted a legal challenge arguing that the categorisation criteria were disproportionate and would impose unreasonable burdens on non-commercial platforms that operate very differently from the social media giants the Act was primarily designed to regulate. The challenge has been one of several legal and procedural complications that have slowed the Act's implementation.
The UK's approach to online safety regulation has been closely watched internationally. The European Union's Digital Services Act, which came into force in 2024, provides a parallel framework for EU-based platforms, and there has been significant interest in how the two regimes will interact — particularly for platforms that operate across both jurisdictions. Ireland, as the EU's primary tech regulatory hub (home to the European headquarters of Google, Meta, and many other major platforms), has a particular stake in how the UK's regime develops.
Key Developments
Ofcom confirmed the delay to July 2026 in a statement that acknowledged the impact on industry planning. The regulator stated: "We understand that this change to our roadmap will impact on industry, and we remain committed to providing as much certainty as possible as we continue our work to implement the new regime." The delay means that platforms will not know their regulatory category — and therefore the full extent of their obligations — until at least the second half of 2026.
The postponement affects a wide range of platforms, from major social media companies to smaller UK-based services. Category 1 platforms — those with the highest user numbers and the greatest potential for harm — face the most onerous obligations, including mandatory transparency reports, senior manager accountability, and proactive content moderation duties. The delay gives these platforms more time to prepare, but also extends the period during which harmful content can circulate without the full force of the regulatory framework in place.
On 7 May 2026, the Ministry of Defence held an industry day in London focused on its Digital and IT Professional Services (DIPS) 2.0 framework, organised in partnership with techUK. The event signals the government's parallel effort to modernise its own digital procurement, even as the broader regulatory landscape for the tech sector remains in flux.
Why It Matters
The delay to the categorisation register is more than a procedural inconvenience — it reflects the genuine difficulty of regulating a global, fast-moving industry through national legislation. The Online Safety Act was designed to make the UK the safest place in the world to be online; the reality is that its implementation has been slower and more contested than its architects anticipated. This is the second major delay to the Act's implementation timetable, following earlier postponements to the codes of practice for illegal content and child safety.
For the UK tech sector — centred on London's Silicon Roundabout and with a significant presence in Edinburgh, Manchester, and Belfast — the uncertainty is a genuine business concern. Companies need to know their regulatory obligations to plan their compliance programmes, hire the right staff, and make investment decisions. A year's delay to the categorisation register means a year of planning in the dark. Unlike the EU's Digital Services Act, which has been implemented on a clearer timetable, the UK's approach has been characterised by repeated revisions — a pattern that risks undermining confidence in the regulatory framework as a whole.
Local Impact
For the UK and Ireland's tech sectors, the delay has mixed implications. Larger platforms with dedicated compliance teams can absorb the uncertainty more easily than smaller UK-based startups, which may lack the resources to maintain parallel compliance programmes for multiple regulatory regimes. In Dublin, where many of the world's largest tech companies have their European headquarters, the delay creates additional complexity: these companies must comply with both the EU's Digital Services Act and the UK's Online Safety Act, and the two regimes do not always align neatly. Belfast's growing tech sector — which includes a number of cybersecurity and fintech firms — will be watching the categorisation process closely, as it will determine whether any of their products or services fall within the Act's scope.
What's Next
Ofcom has committed to publishing the categorisation register in July 2026. Following publication, platforms will have a period to review their classification and, if necessary, challenge it through the appeals process. The full suite of Online Safety Act obligations is not expected to be in force until late 2026 at the earliest. Readers should watch for: the outcome of the Wikimedia Foundation's legal challenge; Ofcom's publication of updated implementation guidance; and any government response to growing industry frustration with the pace of implementation.
Sources: techUK — Online Safety Act categorisation register delayed; Taylor Wessing — UK tech regulatory policy 2026
