Online safety: Ofcom publishes its register of categorised services

Ofcom's third phase of implementing the UK's Online Safety Act is in full swing as it has now published its register of categorised services, as well as a slew of draft guidance and code practice measures appliable to such services, for consultation (here and here).

Under the OSA, certain categorised services are subject to a number of additional obligations, including increased transparency, additional risk assessments, requirements to implement greater user controls and measures to tackle fraudulent advertising.

At the end of last week Ofcom published a number of documents to support compliance with these additional obligations. Amongst others, this includes:

• Guidance on completing the additional risk assessment duties for Category 1 providers, both user empowerment assessments and freedom of expression and privacy impact assessments. In relation to user empowerment assessments, Ofcom has proposed using a similar 4 step approach to align with its guidance on the existing illegal content and content harmful to children risk assessment requirements.
• Additional duties codes of practice for Category 1 providers. Proposed measures include various user empowerment controls (such as the option to not encounter relevant content (e.g. suicide or self-harm) and options to block or mute other users' accounts), policies and processes to protect content of democratic importance and journalist content, and complaints procedures.
• Guidance on the additional terms of services requirements for Category 1 providers.
• Guidance on the user verification duties for Category 1 providers.
• Fraudulent advertising codes of practice for Category 1 and Category 2A providers, which sets out measures these providers should implement to prevent users from encountering fraudulent advertising. 

These documents are subject to consultation, which closes on 2 October 2026. Ofcom expects to publish a statement setting out its final decision and next steps by mid-2027.

What with these additional obligations, as well as on-going consultations for changes to existing code of practice measures (such as in relation to intimate image abuse and crisis protocols), and the UK governments recent proposals for further changes to the OSA (such as social media ban and possible extension of requirements to AI chat bots), there is a lot going on in this space. And the compliance burden for online services in the UK just keeps growing!