Online Safety Act 2023

Sections 9, 11, 14, 26, 28 and 36

SCHEDULE 3 U.K. Timing of providers’ assessments

PART 1 U.K. Timing of illegal content risk assessments and children’s access assessments

Part 3 services already in operation at the outset of the regime provided for by this Act U.K.

1 (1) This paragraph applies in relation to a Part 3 service which is in operation immediately before the day on which the first illegal content risk assessment guidance is published.

(2) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the day on which that guidance is published.

(3) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I1 Sch. 3 para. 1 not in force at Royal Assent, see s. 240(1)

I2 Sch. 3 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

New Part 3 services which start up, and existing services which become Part 3 services, between publication of the first illegal content risk assessment guidance and the first CAA guidance U.K.

2 (1) In this paragraph “the first day”, in relation to a Part 3 service, means—

(a) the first day on which the service is a Part 3 service (being a new service), or

(b) the first day on which the service becomes a Part 3 service (having previously not been a Part 3 service).

(2) Sub-paragraphs (3) and (4) apply if, on the first day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(3) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the first day.

(4) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I3 Sch. 3 para. 2 not in force at Royal Assent, see s. 240(1)

I4 Sch. 3 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

New Part 3 services which start up when illegal content risk assessment guidance and CAA guidance are both available U.K.

3 (1) In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service is a Part 3 service (being a new service).

(2) If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) the first illegal content risk assessment of the service, and

(b) the first CAA of the service.

Commencement Information

I5 Sch. 3 para. 3 not in force at Royal Assent, see s. 240(1)

I6 Sch. 3 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Existing services which become Part 3 services when illegal content risk assessment guidance and CAA guidance are both available U.K.

4 (1) In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service becomes, or again becomes, a Part 3 service (following a period during which the service was not a Part 3 service).

(2) If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) an illegal content risk assessment of the service, and

(b) a CAA of the service.

Commencement Information

I7 Sch. 3 para. 4 not in force at Royal Assent, see s. 240(1)

I8 Sch. 3 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 2 U.K. Timing of children’s risk assessments and section 15(2) assessments

Children’s risk assessments U.K.

5 (1) In this paragraph “the relevant day”, in relation to a Part 3 service, means—

(a) the first day on which the service is treated as likely to be accessed by children, or

(b) the first day on which the service is again treated as likely to be accessed by children (following a period during which the service was not so treated).

(2) If, on the relevant day, children’s risk assessment guidance is available, a children’s risk assessment of the service must be completed within the period of three months beginning with that day.

(3) Sub-paragraph (4) applies if—

(a) on the relevant day, the first children’s risk assessment guidance has not yet been published, and

(b) immediately before the publication of that guidance, the service is still treated as likely to be accessed by children.

(4) The first children’s risk assessment of the service must be completed within the period of three months beginning with the day on which the first children’s risk assessment guidance is published.

Commencement Information

I9 Sch. 3 para. 5 not in force at Royal Assent, see s. 240(1)

I10 Sch. 3 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessments U.K.

6 (1) In this paragraph “the relevant day”, in relation to a regulated user-to-user service, means—

(a) the first day on which the service is a Category 1 service, or

(b) the first day on which the service again becomes a Category 1 service (following a period during which the service was not a Category 1 service).

(2) If, on the relevant day, section 15(2) guidance is available, a section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(3) Sub-paragraph (4) applies if—

(a) on the relevant day, the first section 15(2) guidance has not yet been published, and

(b) immediately before the publication of that guidance, the service is still a Category 1 service.

(4) The first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I11 Sch. 3 para. 6 not in force at Royal Assent, see s. 240(1)

I12 Sch. 3 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 3 U.K. Pre-existing Part 4B services

Interpretation of this Part U.K.

7 (1) In this Part, “pre-existing Part 4B service” means—

(a) an internet service which—

(i) is a video-sharing platform service by reason of the conditions in section 368S(1) and (2) of the Communications Act being met in relation to the service as a whole, and

(ii) was being provided immediately before Schedule 17 (videosharing platform services: transitional provision etc) comes into force; or

(b) a dissociable section of an internet service, where that dissociable section—

(i) is a video-sharing platform service by reason of the conditions in section 368S(1)(a) and (2) of the Communications Act being met in relation to that dissociable section, and

(ii) was being provided immediately before Schedule 17 comes into force.

(2) In sub-paragraph (1), any reference to a service provided before Schedule 17 comes into force includes a reference to a service provided in breach of the requirement in section 368V of the Communications Act.

Commencement Information

I13 Sch. 3 para. 7 not in force at Royal Assent, see s. 240(1)

I14 Sch. 3 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

8 (1) In this Part, “assessment start day”, in relation to a pre-existing Part 4B service, means— U.K.

(a) the date specified in regulations made by the Secretary of State for the purposes of this Part of this Schedule, or

(b) if the pre-existing Part 4B service ceases to be a video-sharing platform service before the date specified in the regulations, the date when that service ceases to be a video-sharing platform service.

(2) But in respect of any period during which this Schedule is fully in force and no regulations under sub-paragraph (1) have yet been made, the definition in sub-paragraph (1) has effect as if—

(a) for paragraph (a) there were substituted “the date when section 210 comes into force”, and

(b) in paragraph (b), for “specified in the regulations” there were substituted “when section 210 comes into force”.

Commencement Information

I15 Sch. 3 para. 8 not in force at Royal Assent, see s. 240(1)

I16 Sch. 3 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

9 U.K. In this Part “video-sharing platform service” has the same meaning as in Part 4B of the Communications Act (see section 368S of that Act).

Commencement Information

I17 Sch. 3 para. 9 not in force at Royal Assent, see s. 240(1)

I18 Sch. 3 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

10 U.K. Any reference in this Part to the effect of Part 1 or 2 of this Schedule is a reference to the effect that Part 1 or 2 would have if this Part were disregarded.

Commencement Information

I19 Sch. 3 para. 10 not in force at Royal Assent, see s. 240(1)

I20 Sch. 3 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Pre-existing Part 4B services which are regulated user-to-user services U.K.

Application of paragraphs 12 to 14 U.K.

11 (1) This paragraph and paragraphs 12 to 14 apply in relation to a pre-existing Part 4B service which—

(a) is within the definition in paragraph (a) of paragraph 7(1), and

(b) is also a regulated user-to-user service.

(2) If the effect of Part 1 of this Schedule is that the period within which the first illegal content risk assessment or CAA of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 12 or 13.

(3) If the effect of paragraph 6 is that the period within which the first section 15(2) assessment of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 14.

(4) But paragraphs 12 to 14 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Commencement Information

I21 Sch. 3 para. 11 not in force at Royal Assent, see s. 240(1)

I22 Sch. 3 para. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Illegal content risk assessments and children’s access assessments U.K.

12 (1) Sub-paragraphs (2) and (3) apply in relation to the service if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2) The first illegal content risk assessment of the service must be completed within the period of three months beginning with the assessment start day.

(3) The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I23 Sch. 3 para. 12 not in force at Royal Assent, see s. 240(1)

I24 Sch. 3 para. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

13 U.K. If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) the first illegal content risk assessment of the service, and

(b) the first CAA of the service.

Commencement Information

I25 Sch. 3 para. 13 not in force at Royal Assent, see s. 240(1)

I26 Sch. 3 para. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessments U.K.

14 (1) If section 15(2) guidance is available on the assessment start day, the first section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(2) If, on the assessment start day, the first section 15(2) guidance has not yet been published, the first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I27 Sch. 3 para. 14 not in force at Royal Assent, see s. 240(1)

I28 Sch. 3 para. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Regulated user-to-user services which include a pre-existing Part 4B service U.K.

Application of paragraphs 16 to 20 U.K.

15 (1) Paragraphs 16 to 20 make provision about the timing of assessments in the case of a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 7(1).

(2) In sub-paragraph (3) and paragraphs 16 to 20—

(a) “the regulated service” means the regulated user-to-user service, and

(b) “the Part 4B part” means the pre-existing Part 4B service which is included in the regulated service.

(3) If the effect of Part 1 or paragraph 6 of this Schedule is that the period within which the first illegal content risk assessment, CAA or section 15(2) assessment of the regulated service must be completed begins on a day before the assessment start day—

(a) the time for carrying out the assessment in question in relation to the Part 4B part is extended as set out in paragraph 16, 17 or 18 (whichever applies),

(b) Part 1 and paragraph 6 apply as set out in paragraph 19, and

(c) paragraph 5 applies as set out in paragraph 20.

(4) But paragraphs 16 to 20 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Commencement Information

I29 Sch. 3 para. 15 not in force at Royal Assent, see s. 240(1)

I30 Sch. 3 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Illegal content risk assessments and children’s access assessments of Part 4B part U.K.

16 (1) Sub-paragraphs (2) and (3) apply in relation to the Part 4B part if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2) The first illegal content risk assessment of the Part 4B part must be completed within the period of three months beginning with the assessment start day.

(3) The first CAA of the Part 4B part must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I31 Sch. 3 para. 16 not in force at Royal Assent, see s. 240(1)

I32 Sch. 3 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

17 U.K. If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a) an illegal content risk assessment of the Part 4B part, and

(b) a CAA of the Part 4B part.

Commencement Information

I33 Sch. 3 para. 17 not in force at Royal Assent, see s. 240(1)

I34 Sch. 3 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessments of Part 4B part U.K.

18 (1) If section 15(2) guidance is available on the assessment start day, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with that day.

(2) If, on the assessment start day, the first section 15(2) guidance has not yet been published, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I35 Sch. 3 para. 18 not in force at Royal Assent, see s. 240(1)

I36 Sch. 3 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Application of Part 1 and paragraph 6 U.K.

19 (1) This paragraph applies in relation to—

(a) an illegal content risk assessment or a CAA of the regulated service if an assessment of that kind is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 16 or 17;

(b) a section 15(2) assessment of the regulated service if a section 15(2) assessment is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 18.

References in the rest of this paragraph to an illegal content risk assessment, a CAA or a section 15(2) assessment are to an assessment of that kind to which this paragraph applies.

(2) For the purposes of this paragraph—

(a) the regulated service is “type 1” if it would still be a regulated user-to-user service even if the Part 4B part were to be assumed not to be part of the service;

(b) the regulated service is “type 2” if it would be a regulated search service if the Part 4B part were to be assumed not to be part of the service;

(c) the regulated service is “type 3” if it does not fall within paragraph (a) or (b).

(3) If the regulated service is type 1, an illegal content risk assessment, a CAA or a section 15(2) assessment is to be treated as being due at the time provided for by Part 1 or paragraph 6 only in relation to the rest of the service.

(4) In sub-paragraph (3) “the rest of the service” means any user-to-user part of the regulated service other than the Part 4B part.

(5) If the regulated service is type 2—

(a) an illegal content risk assessment is not required to be carried out at the time provided for by Part 1, but that is not to be taken to prevent an illegal content risk assessment as defined by section 26 from being due in relation to the search engine of the service at the time provided for by Part 1;

(b) a CAA is to be treated as being due at the time provided for by Part 1 only in relation to the search engine of the service;

(c) a section 15(2) assessment is not required to be carried out at the time provided for by paragraph 6.

(6) If the regulated service is type 3, no illegal content risk assessment, CAA or section 15(2) assessment is required to be carried out at the time provided for by Part 1 or paragraph 6.

Commencement Information

I37 Sch. 3 para. 19 not in force at Royal Assent, see s. 240(1)

I38 Sch. 3 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Application of paragraph 5 U.K.

20 (1) This paragraph sets out how paragraph 5 (children’s risk assessments) is to apply if a CAA is required to be carried out in accordance with—

(a) paragraph 16 or 17 (CAA of Part 4B part of a service),

(b) paragraph 19(3) (CAA of the rest of a service), or

(c) paragraph 19(5)(b) (CAA of search engine of a service).

(2) The definition of “the relevant day” is to operate by reference to the CAA that was (or was required to be) carried out, and accordingly, references to the day on which the service is to be treated as likely to be accessed by children are to be read as references to the day on which the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be) is to be treated as likely to be accessed by children.

(3) References to a children’s risk assessment of the service are to a children’s risk assessment of the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be).

Commencement Information

I39 Sch. 3 para. 20 not in force at Royal Assent, see s. 240(1)

I40 Sch. 3 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 4 U.K. Interpretation, and extension of three-month periods

Interpretation of this Schedule U.K.

21 In this Schedule—

• “CAA” means a children’s access assessment (see section 35);

• “CAA guidance” means OFCOM’s guidance under section 52(3)(b) (guidance about children’s access assessments);

• “children’s risk assessment guidance” means OFCOM’s guidance under section 99(3);

• “section 15(2) assessment” means OFCOM’s assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

• “section 15(2) guidance” means OFCOM’s guidance under section 52(1).

Commencement Information

I41 Sch. 3 para. 21 not in force at Royal Assent, see s. 240(1)

I42 Sch. 3 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

22 U.K. For the meaning of “likely to be accessed by children”, see section 37.

Commencement Information

I43 Sch. 3 para. 22 not in force at Royal Assent, see s. 240(1)

I44 Sch. 3 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

23 U.K. In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a) references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 9;

(b) references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(1).

Commencement Information

I45 Sch. 3 para. 23 not in force at Royal Assent, see s. 240(1)

I46 Sch. 3 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

24 U.K. In relation to regulated search services and the search engine of combined services—

(a) references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 26;

(b) references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(2).

Commencement Information

I47 Sch. 3 para. 24 not in force at Royal Assent, see s. 240(1)

I48 Sch. 3 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

25 U.K. In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a) references to a children’s risk assessment are to a children’s risk assessment as defined by section 11;

(b) references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

Commencement Information

I49 Sch. 3 para. 25 not in force at Royal Assent, see s. 240(1)

I50 Sch. 3 para. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

26 U.K. In relation to regulated search services and the search engine of combined services—

(a) references to a children’s risk assessment are to a children’s risk assessment as defined by section 28;

(b) references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

Commencement Information

I51 Sch. 3 para. 26 not in force at Royal Assent, see s. 240(1)

I52 Sch. 3 para. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

27 U.K. For the purposes of this Schedule, guidance of a particular kind is available at a particular time if at that time there is in existence published guidance of that kind.

Commencement Information

I53 Sch. 3 para. 27 not in force at Royal Assent, see s. 240(1)

I54 Sch. 3 para. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Extension of three-month periods U.K.

28 (1) This paragraph applies in relation to a time-limit of three months imposed by any provision of this Schedule for completing a CAA, a section 15(2) assessment or a particular kind of risk assessment.

(2) Extra time may be allowed—

(a) by agreement between OFCOM and the provider of a particular Part 3 service, or

(b) in accordance with a notice published by OFCOM specifying a longer period for CAAs, section 15(2) assessments or risk assessments of that kind (as the case may be) which relate to Part 3 services of a particular kind or size.

Commencement Information

I55 Sch. 3 para. 28 not in force at Royal Assent, see s. 240(1)

I56 Sch. 3 para. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)