OSA implementation timeline

We have provided below a high-level timeline for the key implementation milestones of the Online Safety Act 2023 along with a detailed table, available at the bottom of the page as a PDF, which lists the status and timescales (to the best of our knowledge) for each individual component of the regime.

Check out our resources section for a full list of links to all the related consultation and policy publications, final regulatory documents and the latest on Ofcom's enforcement and investigations.

This page was last updated on 22 October 2025

• December 2024: Ofcom published its illegal harms statement including its risk assessment guidance, record keeping and review guidance, illegal content judgements guidance and enforcement guidance. The illegal harms codes of practice for user-to-user and search services were laid in Parliament for approval. The risk assessment duties came into force, with services having three months to complete their first risk assessment. Ofcom has now started an enforcement programme related to this.

• January 2025: Ofcom published its age assurance and children’s access statement, including the child access assessment guidance and the age assurance guidance for part 3 and part 5 providers. The children’s access assessment duties came into force, with services having three months to complete their assessment. Ofcom has now started an enforcement programme related to the age assurance duties for part 5 providers.
  
• 16 March 2025: illegal harms duties in force. All providers must complete an illegal harms risk assessment and from this date (when the illegal harms codes are expected to be in force) must take measures to ensure compliance with them.
  
• April 2025: Ofcom published its protecting children from harms online statement, including its risk assessment guidance. The children's codes of practice for user-to-user and search services were laid in Parliament for approval. The children's risk assessment duties came into force, with services having three months to complete their first risk assessment.
  
• May 2025: DSIT published its final statement of strategic priorities for online safety.
  
• 25 July 2025: child safety duties in force. Services likely to be accessed by children must have completed a “suitable and sufficient” children’s risk assessment and implement the safety measures required (including age assurance).

Further detail is provided in the latest version of Ofcom’s roadmap and in our detailed table, attached below.