Published:
17 October 2024
Last updated:
8 May 2026
Please see the new timings for the Online Safety deliverables outlined here: Ofcom's approach to implementing the Online Safety Act
The Online Safety Act makes companies that operate a wide range of online services legally responsible for keeping people, especially children, safe online. If you provide an online service, there are actions you must take when duties come into force. This page explains the important milestones.
The first new duties are now in force. For more information, you can read our:
- Online Safety Act compliance guide for providers of online services where you can find how to check if the rules apply to you, the steps you must take, regulatory documents and guidance, and our quarterly industry bulletin
- Illegal content duties under the Online Safety Act for information on the illegal content duties
- Protection of children duties under the Online Safety Act for information on the children's safety duties
- roadmap for what’s next
All dates reflect our current expected timings and this page contains the latest dates available. Some dates could change as we continue to address issues raised by stakeholders and the Government puts in place the necessary secondary legislation. To stay updated on Online Safety roadmap dates, subscribe to our online safety briefing.
What are you looking for?
The tables below contains key milestones, some are compulsory duties whilst responding to consultations is optional. The 'To note' table sets out additional milestones you may be interested in.
Duties and actions
This table sets out the main Online Safety duties and what this means in practice for your online service. If you do not meet the deadlines for compliance, Ofcom can take enforcement action against your service under the Online Safety Act 2023. Please note, all dates reflect our current expected timelines and may change.
- Start Date: The date or timeframe that this milestone will occur.
- Milestone: The main Online Safety milestones you will need to act on.
- Description/Action: The milestone and any action you must take.
- Who should act?: This outlines who the milestone is relevant to.
- All OS services: All user-to-user services and search services in scope of the Act.
- VSP services: This refers to Notified Video Sharing Platforms (all pre-existing, UK established VSPs – platforms that meet the scope and jurisdiction criteria under Part 4B of the Communications Act 2003).
- OS Categorised Services: A small proportion of services will be categorised and designated as category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation by Government. For ease of use we refer to ‘categorised services’ in the table.
- Publishers of pornographic content: This means pornography services in scope of the duties in Part 5 of the Act.
- OS Services likely to be accessed by children: All regulated user-to-user services and search services that are ‘likely to be accessed by children’ (and have to comply with duties relating to protection of children) within the meaning of the Act.
- Completion date: Deadline or end date for the milestone.
You can search for keywords such as the type of service you are (e.g ‘All OS services’), relevant legal duties (‘risk assessment’) or topics ('children').
Duties and actions
| Start Date | Milestone | Description/Action | Who should act? | Completion date | Useful links |
|---|---|---|---|---|---|
| 16 December 2024 | Ofcom publishes illegal content risk assessment guidance and first version of illegal harms codes of practice | Carry out illegal content risk assessment | All OS services including VSPs |
16 March 2025 |
Statement: Protecting people from illegal harms online
Time for tech firms to act: UK online safety regulation comes into force
|
| 16 January 2025 | Ofcom publishes highly effective age assurance and children’s access assessments guidance | All user-to-user and search services must complete a Children’s Access Assessment | Part 3 services |
16 April 2025 |
|
| 16 January 2025 | Ofcom publishes final guidance on age assurance for pornography providers | Part 5 services are required to take steps to implement highly effective age assurance immediately |
Publishers of pornographic content (services in scope of part 5 duties) |
Duties came into effect 17 January 2025 |
|
| 17 January 2025 | Government commences online safety duties on age assurance for publishers of pornographic content | Comply with age assurance duties. | Publishers of pornographic content (services in scope of part 5 duties) | N/A | Implementing the Online Safety Act: Protecting children from online pornography |
| January 2025 | Ofcom publishes children's access assessment guidance | Carry out children's access assessment | All OS services including VSPs |
16 April 2025 |
Quick guide to children’s access assessments |
| 17 March 2025 | Illegal content Codes of Practice comes into force | Comply with the illegal content safety duties | All OS services | N/A | Quick guide to illegal content codes of practice |
| 24 April 2025 | Ofcom publishes children's risk assessment guidance and first version of the Protection of Children Codes of Practice | Carry out children's risk assessment | OS services likely to be accessed by children, including VSPs |
24 July 2025 |
Quick guide to children’s risk assessments: protecting children online
|
| 25 July 2025 | Protection of Children Codes of Practice come into force | Comply with children safety duties | OS services likely to be accessed by children | N/A | A quick guide to Children’s Safety Codes |
| 21 July 2025 | Ofcom publishes final guidance on transparency reporting for categorised services | Services to note available guidance with a view to prepare for reporting requirements. Requirements will only apply categorised services | All OS services (transparency duties will only apply to categorised services) | N/A | Statement: transparency reporting guidance Annex A: Draft transparency guidance |
| December 2025 to April 2026 | Fees regime comes into force and the notification window for the initial 2026/7 charging year opens | Providers should notify Ofcom of their liability to pay fees | All providers which meet the Qualifying Worldwide Revenue threshold, and which are not otherwise exempt | The Notification window for the initial 2026/7 charging year will close in April 2026. | Online safety fees: what the duties are and how to comply with them |
| February 2026 | Ofcom publishes final super-complaints guidance | Eligible organisations will be able to raise a 'super-complaint' with Ofcom | Organisations eligible to bring a super-complaint | February 2026 | Statement and guidance for super-complaints under the Online Safety Act 2023 |
| 7 April 2026 | Duty to report child sexual abuse (CSEA) content to the National Crime Agency (NCA) | The Online Safety Act requires that all regulated service providers must report all detected and unreported CSEA content present on their services to the NCA. If a service is based outside the UK, the requirement is to report CSEA content that is UK-linked. | The duty applies to all regulated user-to-user and search services; however, this is not being commenced for search services until a later date. | Ongoing duty | This webpage details the duty to report child sexual exploitation and abuse (CSEA) content: know the rules and how to comply. |
| April 2026 | Fees regime (QWR) | Deadline for submission of Qualifying Worldwide Revenue (QWR) Returns by fee-liable providers in respect of the 2026/27 charging year | Fees liable providers | 11 April | Online safety fees: what the duties are and how to comply with them |
| April 2026 | Certain services formally notified (RFI) by Ofcom for their illegal content and children’s risk assessment records | Relevant services submit their risk assessment records to Ofcom | Services formally notified by RFI | May to July | n/a |
| May 2026 | Ofcom finalises additional safety measures on perceptual hash matching for intimate image abuse. | Implement use of proactive technology to prevent illegal intimate images from reaching users in line with our final statement. | All OS services | Autumn 2026 subject to parliamentary process | Ofcom fast-tracks decision on measures to block illegal intimate images |
| June 2026 | Ofcom issues final statement on new priority offences (serious self-harm and cyber flashing) | Ensure relevant updates are made in line with changes to regulatory documents including updating risk assessments for new priority illegal harms. | All OS services | Autumn 2026 subject to parliamentary process | Consultation: New priority offences - serious self-harm and cyberflashing. |
| June 2026 | Ofcom finalises additional safety measures on crisis response | Comply with any new Illegal Harms Code measures and Protection of Children measures. | All OS services | Autumn 2026 subject to parliamentary process | Online safety fees: what the duties are and how to comply with them |
| June to September 2026 | Fees regime 2027/28 charging year | Notification window for 2027/28 charging year will open for new fee liable | All new fee liable providers | TBC | Online safety fees: what the duties are and how to comply with them |
| July 2026 | Ofcom publishes register of categorised services | The register will determine which services are categorised. Services will have the opportunity to respond to consultations about the additional duties for categorised services, and will need to prepare to comply with those duties as they come into force. After publication of the register of categorised services, we will also provide an update on timelines for transparency reporting. | OS Categorised services | TBC: Ofcom's approach to implementing the Online Safety Act contains the latest update on timings for the Register | Online service categorisation: information notices |
| Autumn 2026 | Ofcom publishes the Additional Safety Measures statement | Comply with the illegal content and children safety duties | All OS services | N/A | TBC |
| September 2026 | Ofcom expects to publish the 2026/27 tariff and issue invoices for the 2026/27 charging year. | Providers pay invoices for 2026/27 charging year (with possibility of payments in instalments for those liable to pay more than £75,000) | Fee liable providers | March 2027 | Online safety fees: what the duties are and how to comply with them |
| October 2026 | Subject to publication of the register of categorised services around July 2026. | Providers of relevant services need to provide Ofcom with up-to-date risk assessment records. | Category 1 and 2a services. | October 2026 | TBC |
| November 2026 | Subject to publication of the register of categorised services around July 2026. | Providers of relevant services need to publish summaries of risk assessments. | Category 1 and 2a services. | November 2026 | TBC |
Consultations
This table sets out when our upcoming consultation will be published and the deadline for submitting a response. Please note, all dates reflect our current timelines and may change.
- Start Date: The date or timeframe that this milestone will occur.
- Milestone: The main Online Safety consultations you may wish to read and respond to.
- Description/Action: Further details and suggested action for this consultation.
- Who is this most relevant to?: While our consultations are public and we accept responses from anyone, we have explained the types of services the consultation proposals are particularly relevant to, to help services understand when they are most likely to want to read the consultation and respond.
- All OS services: All user-to-user services and search services in scope of the Act.
- VSP services: This refers to Notified Video Sharing Platforms (all pre-existing, UK established VSPs – platforms that meet the scope and jurisdiction criteria under Part 4B of the Communications Act 2003).
- OS Categorised Services: A small proportion of services will be categorised and designated as category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation by Government in 2025. For ease of use we refer to ‘categorised services’ in the table.
- Publishers of pornographic content: This means pornography services in scope of the duties in Part 5 of the Act.
- OS Services likely to be accessed by children: All regulated user-to-user services and search services that are ‘likely to be accessed by children’ (and have to comply with duties relating to protection of children) within the meaning of the Act
- Completion date: Deadline or end date for the consultation response.
You can search for keywords such as the type of service you are or the topic of a consultation.
Consultations
| Start Date | Milestone | Description/Action | Who will this be of most interest to? | Completion date | Useful links |
|---|---|---|---|---|---|
| 24 October 2024 | Consultation on fees and penalties | Give feedback on fees consultation (optional) | All OS Services including VSPs | 9 January 2025 | Online Safety - fees and penalties |
| 16 December 2024 | Consultation: Technology Notices | Give feedback on CSEA/terrorism consultation (optional) | All OS services including VSPs, and providers of online safety technologies | 10 March 2025 (5pm) | Consultation: Technology Notices |
| 25 February 2025 | Consultation on draft Guidance: A safer life online for women and girls | Give feedback on consultation (optional) | All OS services including VSPs, excluding publishers of pornographic content (services in scope of part 5 duties) | 23 May 2025 | Consultation on draft Guidance: A safer life online for women and girls |
| June 2025 | Consultation on additional measures for Codes of Practice (illegal harms and protection of children) | Give feedback on additional measures consultation (optional) | All OS services including VSPs | 20 October 2025 | Consultation: Online Safety - Additional Safety Measures |
| 18 July 2025 | Consultation on draft Guidance: Qualifying Worldwide Revenue (online safety fees and penalties) | Give feedback on consultation (optional) | All OS services including VSPs with expected qualifying worldwide revenue above £250m | 10 September 2025 (5pm) | Consultation on draft Guidance: Qualifying Worldwide Revenue |
| 1 September 2025 | Consultation on draft Notification Guidance (online safety fees) | Give feedback on consultation (optional) | All OS services including VSPs with expected qualifying worldwide revenue above £250m | 1 October 2025 (5pm) | Consultation: Online safety fees – Notification Guidance |
| 8 September 2025 | Consultation: Draft guidance for super-complaints under the Online Safety Act 2023 | Give feedback on consultation (optional) | All OS Services | 3 November 2025 | Consultation: Draft guidance for super-complaints under the Online Safety Act 2023 |
| 15 September 2025 | Consultation on recommendations for how to promote Media Literacy | Give feedback on consultation (optional) | Online platforms, broadcasters and streaming services | 8 December | How to promote Media Literacy: Consultation on recommendations for online platforms, broadcasters and services |
| October 2025 to March 2026 | Call for evidence on additional duties for categorised services | Relevant services to provide evidence to inform additional duties’ consultation (optional) | Relevant services | TBC | Implementing the Online Safety Act: Additional duties for ‘categorised’ online services |
| 24 March 2026 | Consultation on new priority offences – serious self-harm and cyberflashing | Give feedback on new priority offences consultation (optional) | All OS services | Friday 24th April (5pm) | Consultation on new priority offences – serious self-harm and cyberflashing |
| July 2026 | Consultation on additional duties for categorised services | Give feedback on consultation (optional) | Relevant services including categorised services. | TBC | TBC |
To note
This table sets out dates of other Online Safety milestones you may wish to note. Please note, all dates reflect our current timelines and may change.
- Start Date: The date or timeframe that this milestone will occur.
- Milestone: The main Online Safety milestones to note.
- Description/Action: Further details and suggested action.
- Who should take note?: We have explained the types of services the milestones or proposals are particularly relevant to.
- All OS services: All user-to-user services and search services in scope of the Act.
- VSP services: This refers to Notified Video Sharing Platforms (all pre-existing, UK established VSPs – platforms that meet the scope and jurisdiction criteria under Part 4B of the Communications Act 2003).
- OS Categorised Services: A small proportion of services will be categorised and designated as category 1, 2A or 2B services if they meet certain thresholds set out in secondary legislation by Government. For ease of use we refer to ‘categorised services’ in the table.
- Publishers of pornographic content: This means pornography services in scope of the duties in Part 5 of the Act.
- OS Services likely to be accessed by children: All regulated user-to-user services and search services that are ‘likely to be accessed by children’ (and have to comply with duties relating to protection of children) within the meaning of the Act.
- Completion date: Deadline or end date for the milestone.
You can search for keywords such as the type of service you are, type of publication or topic.
To note
| Start Date | Milestone | Description/Action | Who should take note? | Completion date | Useful links |
|---|---|---|---|---|---|
| July 2025 | Ofcom publishes Researcher Access report | Services to note Researcher Access report (optional) | All OS services including VSPs | N/A | Researchers’ access to information from regulated online services |
| 25 July 2025 | Repeal of the VSP regime | VSPs to become fully subject to the OS Act | VSPs | N/A | Repeal of the VSP regime: what you need to know - Ofcom |
| December 2025 | Ofcom updates Online Safety Information Powers Guidance regarding Data Preservation Notices and Coroner Information Notices | Review the guidance and understand how to comply with Data Preservation Notices and Coroner Information Notices | All OS services | N/A | Statement: Data Preservation Notices |
| February 2026 | Ofcom publishes final super-complaints guidance | Eligible organisations will be to raise super-complaints with Ofcom | Eligible organisations | February 2026 | TBC |
| May 2026 | Ofcom publishes final Technology Notices advice and guidance | Ofcom’s Online Safety Technology Notice advice recommends to the Secretary of State how to set minimum standards of accuracy for accredited technologies that could be used by a Notice, and the guidance sets out how we propose to exercise our technology notice function. | All OS services | May 2026 | Statement: Technology Notices |
| June 2026 | Ofcom publishes age assurance statuary report | This report will assess how services have used age assurance and how effective it has been for the purpose of complying with their duties under the Act | All OS services | July 2026 | TBC |
| July 2026 | Ofcom publishes age assurance statuary report | This report will assess how services have used age assurance and how effective it has been for the purpose of complying with their duties under the Act | All OS services | July 2026 | TBC |
| October 2026 | Ofcom publishes content harmful to children statutory report | This report will summarise our findings on the incidence and severity of content harmful to children | All OS services | October 2026 | TBC |
| November 2026 | Ofcom publishes Online Information Advisory Committee report | Ofcom’s Online Information Advisory Committee will publish its first statutory report | All OS services | 1 November 2026 | TBC |
| January 2027 | Ofcom publishes app stores statutory report | This report will assess the role app stores play in children encountering harmful content and evaluate the use and effectiveness of age assurance by app store providers | All OS services | January 2027 | TBC |
Resources
- Ofcom's approach to implementing the Online Safety Act - Ofcom
- New rules for online services: what you need to know - Ofcom
- Ofcom Regulation Checker
- Repeal of the VSP regime - what you need to know.
- Adults only - what to do if your online service allows pornography
- Implementing the Online Safety Act: Additional duties for ‘categorised’ online services - Ofcom