Ofcom Delays Online Safety Act Categorisation Register Until July 2026 Amid Legal Challenges
The UK's media regulator Ofcom has pushed back publication of its crucial Online Safety Act categorisation register to July 2026, extending a period of regulatory uncertainty for technology companies and raising questions about the pace of the landmark legislation's implementation.
Background
The Online Safety Act (OSA), passed in October 2023, is being rolled out in phases by Ofcom. The categorisation register is a critical component of the Act, identifying which online services fall into Categories 1, 2A, and 2B — the classifications that determine the most extensive regulatory duties a platform must comply with. These obligations include mandated transparency reporting, enhanced risk assessments, protections for journalistic content, and options for user identity verification.
Key Developments
Ofcom announced the delay was partly triggered by a legal challenge from the Wikimedia Foundation, which prompted a re-evaluation of the categorisation process. The regulator will now run a "representations process" in early 2026 to allow services to provide input on their provisional categorisation before the register is finalised.
The delay comes despite pressure from the Secretary of State for Science, Innovation and Technology, Rt Hon Liz Kendall MP, who urged Ofcom to "explore ways to expedite processes, particularly around user empowerment duties," while recognising the need for a robust regime.
Meanwhile, child safety duties under the Act came into effect in July 2025, requiring platforms likely to be accessed by children to implement "highly effective" age assurance measures to prevent access to harmful content such as pornography and material promoting self-harm. Ofcom has the power to enforce these duties with fines of up to £18 million or 10% of global revenue.
Industry Concerns
The delay has drawn mixed reactions from the technology sector. While some companies welcome additional preparation time, industry body techUK warned that the postponement "extends a period of uncertainty, making it harder to plan for obligations such as transparency reporting and ID verification," which "could complicate strategic planning for organisations already facing significant operational and regulatory challenges."
Privacy advocates have also raised concerns about provisions within the Act that could empower Ofcom to require technology companies to scan encrypted messages for child abuse and terrorist material. The encrypted messaging service Signal has warned it would withdraw from the UK if forced to implement what it describes as a "backdoor" into its systems.
Why It Matters
The Online Safety Act represents one of the most significant pieces of digital regulation in UK history. Its full implementation will reshape how social media platforms, search engines, and other online services operate in Britain, with major implications for free speech, child safety, and privacy.
What's Next
Ofcom is expected to publish the categorisation register in July 2026, following the representations process. Companies provisionally categorised under the Act will have the opportunity to challenge their classification before it is finalised. The regulator's next major milestone is the full implementation of duties for categorised services later in 2026.
