Key takeaways
The Ofcom Online Safety Act implementation roadmap sets out the full timeline for bringing the Online Safety Act 2023 into force. Ofcom published an updated roadmap on 8 May 2026 covering milestones from March 2026 to May 2027.
Illegal harms duties have been in force since 2024. Children's safety duties came into force in January 2025. As of May 2026, Ofcom had launched investigations into nearly 100 services for potential non-compliance.
In March 2026, Ofcom consulted on new priority offences: encouraging or assisting serious self-harm and cyberflashing. Both were added to the Online Safety Act as priority offences by the government in December 2025. Ofcom's statement on these new offences was expected in June 2026.
In 2025, Ofcom completed its guidance on highly effective age assurance and developed the industry fees framework -- requiring in-scope platforms to pay fees to fund Ofcom's regulatory work. Ofcom also launched a consultation on additional safety measures including livestreaming and automated content moderation.
Ofcom's compliance priorities for 2026 focus on: improving protections for children, tackling illegal hate and terror content, and protecting women and girls from intimate image abuse.
Reviewed: June 2026Key facts
|
What the Online Safety Act roadmap is
The Ofcom Online Safety Act implementation roadmap is the official timeline for bringing the Online Safety Act 2023 into effect. Ofcom publishes and updates the roadmap on its website to inform regulated services, industry, consumers and policymakers about when specific duties, codes of practice, guidance documents and regulatory milestones will arrive.
The roadmap was first published when Ofcom began implementing the Act and has been updated as milestones are reached and new priorities are identified. The version current as of June 2026 was updated on 8 May 2026 and covers the period from March 2026 to May 2027. It focuses on implementation deliverables -- the codes, guidance, statutory reports and advice to the Secretary of State that the Act requires Ofcom to produce.
What has already been implemented
Illegal harms duties
The Online Safety Act's illegal harms duties -- requiring user-to-user services and search engines to risk assess for, and take steps to prevent and minimise, 17 categories of priority illegal content -- came into force in 2024. Ofcom published the illegal harms codes of practice alongside this, providing the framework that platforms must follow to demonstrate compliance.
Children's safety duties
The children's safety duties under the Act -- requiring services likely to be accessed by children to protect them from harmful content, restrict algorithm recommendations and implement age-appropriate design -- came into force in January 2025. Ofcom published children's safety codes of practice and guidance.
Age assurance guidance
In 2025, Ofcom completed its guidance on implementing highly effective age assurance. This guidance sets out what Ofcom considers to be age assurance that meets the Act's requirements -- distinguishing between robust age verification (technical barriers that reliably prevent access by minors) and weaker approaches such as self-declaration. The guidance is particularly relevant to pornography services and services hosting other adult content that children should not access.
Industry fees
In 2025, Ofcom developed the industry fees framework under the Online Safety Act. This framework requires in-scope online services to pay fees to Ofcom to fund its regulatory work under the Act. The fees are scaled to the size and type of service -- the largest platforms pay the most. This ensures Ofcom's online safety regulation is funded by the industry it regulates, not by taxpayers.
Enforcement: nearly 100 investigations
Ofcom has taken an active enforcement approach from the outset. By May 2026, Ofcom had launched investigations into nearly 100 services for potential non-compliance with their online safety duties. These include the investigations into pornography websites for age verification failures that resulted in fines of 600,000 pounds (May 2026) and a further fine in June 2026 -- the first enforcement actions under the Act.
New priority offences: self-harm and cyberflashing
In December 2025, the government used the Act's powers to add two new priority offences to the illegal harms framework. The first is encouraging or assisting serious self-harm -- content that facilitates or promotes acts of serious self-harm, which had previously been a non-priority offence. The second is cyberflashing -- the non-consensual sending of sexual images, which was also elevated to priority status.
In March 2026, Ofcom opened a consultation on updating its regulatory documents to reflect these new priority offences. The consultation covered updates to Risk Assessment Guidance, Risk Profiles, the Register of Risks, Codes of Practice, Illegal Content Judgements Guidance and Record Keeping and Review Guidance. The consultation closed on 24 April 2026 and Ofcom expected to publish its statement in June 2026.
Ofcom's 2026 compliance priorities
Ofcom published its compliance priorities for 2026 alongside the updated roadmap. The three focus areas are: improving protections for children (building on the children's codes and the government's June 2026 announcement of social media restrictions for under-16s); tackling illegal hate and terror content (ensuring platforms have effective systems to identify and remove terrorist and extremist content); and protecting women and girls from intimate image abuse (including non-consensual intimate image sharing, cyberflashing and other gendered online harms).
Ofcom told major services used by children in March 2026 to meet clear expectations on effective age checks, protections against grooming and child sexual abuse material, safer feeds and recommendations, and proper testing and risk assessment before new products are launched.
What is still to come on the roadmap
The roadmap published on 8 May 2026 covers milestones through to May 2027. The remaining deliverables include further codes of practice covering additional aspects of the Act (including provisions not yet covered by the illegal harms and children's codes), guidance on specific topics such as livestreaming and automated content moderation, and statutory reports to the Secretary of State required under the Act.
The roadmap does not cover Ofcom's ongoing compliance monitoring and enforcement work -- that is addressed separately through Ofcom's annual compliance priorities and its published enforcement actions. The roadmap is specifically for the statutory implementation deliverables that the Act requires Ofcom to produce.
Related guides
Disclaimer: This guide is for informational purposes only. Kael Tripton Ltd is not regulated by the FCA. Information sourced from Ofcom, legislation.gov.uk and GOV.UK. Verify at ofcom.org.uk.
Frequently asked questions
What is Ofcom's Online Safety Act roadmap?
The Ofcom Online Safety Act implementation roadmap is the official timeline for bringing the Online Safety Act 2023 into effect. It sets out when Ofcom will publish codes of practice, guidance, statutory reports and other regulatory documents required under the Act. The roadmap was last updated on 8 May 2026 and covers milestones from March 2026 to May 2027.
When did the Online Safety Act come into force?
The Online Safety Act received Royal Assent in October 2023. Illegal harms duties came into force in 2024 when Ofcom published the illegal harms codes of practice. Children's safety duties came into force in January 2025. Enforcement began immediately upon duties coming into force -- Ofcom had launched investigations into nearly 100 services by May 2026.
What are the new priority offences added to the Online Safety Act?
In December 2025, the government added two new priority offences: encouraging or assisting serious self-harm (content promoting self-harm acts, previously a non-priority offence) and cyberflashing (non-consensual sending of sexual images, also elevated from non-priority). Ofcom consulted on updating its regulatory documents to reflect these changes in March-April 2026, with a statement expected June 2026.
What are Ofcom's online safety compliance priorities for 2026?
Ofcom's three compliance priorities for 2026 are: improving protections for children (including effective age checks, anti-grooming measures, safer algorithms); tackling illegal hate and terror content; and protecting women and girls from intimate image abuse including cyberflashing and non-consensual intimate image sharing.
Has Ofcom taken any enforcement action under the Online Safety Act?
Yes. Ofcom launched investigations into nearly 100 services by May 2026. It fined a pornography website 600,000 pounds in May 2026 and a second site in June 2026 -- the first enforcement actions under the Act -- for failing to implement effective age verification as required to protect children from adult content.
What is the Online Safety Act industry fees framework?
The industry fees framework requires in-scope online services to pay fees to Ofcom to fund its regulatory work under the Online Safety Act. Fees are scaled by service size and type. This ensures online safety regulation is funded by the industry being regulated. The framework was developed in 2025 and applies to regulated user-to-user services and search engines accessible to UK users.
Where can I find the Ofcom Online Safety Act roadmap?
The roadmap is published at ofcom.org.uk/online-safety/illegal-and-harmful-content/roadmap-to-regulation. Ofcom updates it as milestones are reached. The version current as of June 2026 was updated on 8 May 2026.
What happens after the Online Safety Act roadmap is complete?
The roadmap covers statutory implementation deliverables -- codes, guidance and reports required by the Act. Once the initial implementation is complete, Ofcom's work shifts to ongoing compliance monitoring, enforcement, and periodic reviews of codes of practice as technology and harms evolve. The Online Safety Act gives Ofcom powers to update codes as needed.
