UK Online Safety Act: Ofcom Delays Key Categorisation Register to July 2026
The implementation of the UK's landmark Online Safety Act has suffered a significant setback, with communications regulator Ofcom pushing back the publication of its crucial categorised services register by a full year to July 2026 — prolonging uncertainty for technology companies across Britain and beyond.
The register is a cornerstone of the new regulatory regime, determining which online platforms are designated as Category 1, 2A, or 2B, and therefore subject to the most extensive duties under the Act. The delay means tech companies must continue planning for compliance without knowing precisely which obligations will apply to them.
Background
The Online Safety Act, passed by parliament in 2023, represents the most sweeping overhaul of internet regulation in UK history. It places new duties on social media platforms, search engines, and other online services to protect users — particularly children — from harmful content. Ofcom was tasked with implementing the Act through a series of codes of practice, guidance documents, and the categorisation register.
The delay stems from a legal challenge brought by the Wikimedia Foundation against the government's categorisation regulations, which was resolved in August 2025. As a result, Ofcom must now conduct a representations process in early 2026, allowing services that may be categorised to comment on provisional decisions before the register is finalised.
Key Developments
Despite the delay, the government and Ofcom are pressing ahead with other aspects of the Act. UK Science and Technology Secretary Liz Kendall has emphasised in correspondence with industry that services should not wait for formal deadlines to act on user safety. Key milestones for April 2026 include the publication of final guidance on detecting Child Sexual Exploitation and Abuse and terrorism content.
Once the categorisation register is published — now expected in Spring 2026 — a consultation on the additional duties for categorised services will be launched. The first transparency reports from categorised services will be required in Summer 2027, and the fees regime to fund Ofcom's new regulatory role is expected to be fully operational during the 2026/27 financial year.
Why It Matters
The additional duties for categorised services are extensive, including requirements for enhanced risk assessments, transparency reporting, protections for journalistic content, and the implementation of user empowerment tools. For major platforms operating in the UK, the categorisation decision will determine the scale of their compliance obligations and the potential fines they face for non-compliance — which can reach up to £18 million or 10% of global annual turnover.
What's Next
The delay adds to a pattern of implementation challenges that have dogged the Online Safety Act since its passage. Tech companies and civil society groups alike are watching closely to see whether the final categorisation decisions reflect the Act's stated ambitions to make the UK the safest place in the world to be online. Full details of the revised timeline were published by techUK.
