Summary

• Ofcom has published categorisation and industry guidance linked to the Online Safety Act.
• Categorised services will face additional transparency, accountability, and user protection duties.
• The UK’s platform regulation regime is moving from legislative design into supervisory delivery.

Ofcom has moved another step toward implementing the UK’s Online Safety Act regime, publishing categorisation material and a June industry bulletin that give online services a clearer view of upcoming compliance expectations.

The categorisation process will determine which services fall into groups that trigger additional duties under the Act. Ofcom’s June bulletin also covers crisis response, risk assessment alignment, fees preparation, age assurance, priority offences, categorised services, and enforcement activity. The documents show the regulator translating a politically charged law into practical supervisory machinery.

Platform operators should not treat categorisation as a narrow administrative issue. Larger or higher risk services can face additional obligations around transparency, user empowerment, accountability, fraudulent advertising, and reporting. The work is likely to reach across legal, trust and safety, product, engineering, moderation, policy, data, and communications teams.

The UK regime is arriving while online services are already adjusting to the EU’s Digital Services Act, the Digital Markets Act, data protection rules, and AI-related obligations. Platforms with UK and European footprints must manage overlapping rules that are similar in intent but different in thresholds, terminology, enforcement culture, and reporting mechanics. The operational burden will be heaviest where compliance requires product design changes and risk assessment rather than legal documentation alone.

Ofcom’s June update also links online safety regulation to live operational risk. Crisis response duties, illegal harms, children’s protection, age assurance, and enforcement are moving into the same compliance timetable. Services can no longer treat online safety as a distant legal issue waiting for final guidance; the regime is becoming active supervision.

The business impact will vary sharply. Large platforms have dedicated policy and safety teams, while smaller services may struggle to interpret duties, gather evidence, and implement product changes. The Act was designed with systemic online harm in mind, yet its compliance expectations can reach services that do not think of themselves as social media companies. Forums, marketplaces, search services, messaging features, and user to user functions may all need careful review.

Technology implementation will determine whether compliance is real or performative. Risk assessments need supporting data; moderation and reporting systems must be auditable; age assurance tools must be tested against privacy and accuracy concerns; and transparency reporting must reflect actual operational processes. Compliance cannot be bolted on after launch if the service architecture does not support it.

Ofcom will be judged on whether supervision is credible without creating avoidable uncertainty or pushing smaller services into defensive over-removal. Enforcement also needs to target serious failures rather than generate a paperwork-heavy system with limited user protection.

The Online Safety Act has entered its implementation phase. The argument is moving away from whether the UK should regulate platforms and toward how services prove, in operational detail, that they understand and manage the risks created by their products.