Search Legislation

Online Safety Act 2023

 Help about what version

What Version

 Help about advanced features

Advanced Features

Changes over time for: SCHEDULE 3

 Help about opening options

Alternative versions:

Changes to legislation:

There are currently no known outstanding effects for the Online Safety Act 2023, SCHEDULE 3. Help about Changes to Legislation

Close

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Sections 9, 11, 14, 26, 28 and 36

SCHEDULE 3U.K.Timing of providers’ assessments

This schedule has no associated Explanatory Notes

PART 1U.K.Timing of illegal content risk assessments and children’s access assessments

Part 3 services already in operation at the outset of the regime provided for by this ActU.K.

1(1)This paragraph applies in relation to a Part 3 service which is in operation immediately before the day on which the first illegal content risk assessment guidance is published.

(2)The first illegal content risk assessment of the service must be completed within the period of three months beginning with the day on which that guidance is published.

(3)The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I1Sch. 3 para. 1 not in force at Royal Assent, see s. 240(1)

I2Sch. 3 para. 1 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

New Part 3 services which start up, and existing services which become Part 3 services, between publication of the first illegal content risk assessment guidance and the first CAA guidanceU.K.

2(1)In this paragraph “the first day”, in relation to a Part 3 service, means—

(a)the first day on which the service is a Part 3 service (being a new service), or

(b)the first day on which the service becomes a Part 3 service (having previously not been a Part 3 service).

(2)Sub-paragraphs (3) and (4) apply if, on the first day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(3)The first illegal content risk assessment of the service must be completed within the period of three months beginning with the first day.

(4)The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I3Sch. 3 para. 2 not in force at Royal Assent, see s. 240(1)

I4Sch. 3 para. 2 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

New Part 3 services which start up when illegal content risk assessment guidance and CAA guidance are both availableU.K.

3(1)In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service is a Part 3 service (being a new service).

(2)If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a)the first illegal content risk assessment of the service, and

(b)the first CAA of the service.

Commencement Information

I5Sch. 3 para. 3 not in force at Royal Assent, see s. 240(1)

I6Sch. 3 para. 3 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Existing services which become Part 3 services when illegal content risk assessment guidance and CAA guidance are both availableU.K.

4(1)In this paragraph “the first day”, in relation to a Part 3 service, means the first day on which the service becomes, or again becomes, a Part 3 service (following a period during which the service was not a Part 3 service).

(2)If, on the first day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a)an illegal content risk assessment of the service, and

(b)a CAA of the service.

Commencement Information

I7Sch. 3 para. 4 not in force at Royal Assent, see s. 240(1)

I8Sch. 3 para. 4 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 2U.K.Timing of children’s risk assessments and section 15(2) assessments

Children’s risk assessmentsU.K.

5(1)In this paragraph “the relevant day”, in relation to a Part 3 service, means—

(a)the first day on which the service is treated as likely to be accessed by children, or

(b)the first day on which the service is again treated as likely to be accessed by children (following a period during which the service was not so treated).

(2)If, on the relevant day, children’s risk assessment guidance is available, a children’s risk assessment of the service must be completed within the period of three months beginning with that day.

(3)Sub-paragraph (4) applies if—

(a)on the relevant day, the first children’s risk assessment guidance has not yet been published, and

(b)immediately before the publication of that guidance, the service is still treated as likely to be accessed by children.

(4)The first children’s risk assessment of the service must be completed within the period of three months beginning with the day on which the first children’s risk assessment guidance is published.

Commencement Information

I9Sch. 3 para. 5 not in force at Royal Assent, see s. 240(1)

I10Sch. 3 para. 5 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessmentsU.K.

6(1)In this paragraph “the relevant day”, in relation to a regulated user-to-user service, means—

(a)the first day on which the service is a Category 1 service, or

(b)the first day on which the service again becomes a Category 1 service (following a period during which the service was not a Category 1 service).

(2)If, on the relevant day, section 15(2) guidance is available, a section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(3)Sub-paragraph (4) applies if—

(a)on the relevant day, the first section 15(2) guidance has not yet been published, and

(b)immediately before the publication of that guidance, the service is still a Category 1 service.

(4)The first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I11Sch. 3 para. 6 not in force at Royal Assent, see s. 240(1)

I12Sch. 3 para. 6 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 3U.K.Pre-existing Part 4B services

Interpretation of this PartU.K.

7(1)In this Part, “pre-existing Part 4B service” means—

(a)an internet service which—

(i)is a video-sharing platform service by reason of the conditions in section 368S(1) and (2) of the Communications Act being met in relation to the service as a whole, and

(ii)was being provided immediately before Schedule 17 (videosharing platform services: transitional provision etc) comes into force; or

(b)a dissociable section of an internet service, where that dissociable section—

(i)is a video-sharing platform service by reason of the conditions in section 368S(1)(a) and (2) of the Communications Act being met in relation to that dissociable section, and

(ii)was being provided immediately before Schedule 17 comes into force.

(2)In sub-paragraph (1), any reference to a service provided before Schedule 17 comes into force includes a reference to a service provided in breach of the requirement in section 368V of the Communications Act.

Commencement Information

I13Sch. 3 para. 7 not in force at Royal Assent, see s. 240(1)

I14Sch. 3 para. 7 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

8(1)In this Part, “assessment start day”, in relation to a pre-existing Part 4B service, means—U.K.

(a)the date specified in regulations made by the Secretary of State for the purposes of this Part of this Schedule, or

(b)if the pre-existing Part 4B service ceases to be a video-sharing platform service before the date specified in the regulations, the date when that service ceases to be a video-sharing platform service.

(2)But in respect of any period during which this Schedule is fully in force and no regulations under sub-paragraph (1) have yet been made, the definition in sub-paragraph (1) has effect as if—

(a)for paragraph (a) there were substituted “the date when section 210 comes into force”, and

(b)in paragraph (b), for “specified in the regulations” there were substituted “when section 210 comes into force”.

Commencement Information

I15Sch. 3 para. 8 not in force at Royal Assent, see s. 240(1)

I16Sch. 3 para. 8 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

9U.K.In this Part “video-sharing platform service” has the same meaning as in Part 4B of the Communications Act (see section 368S of that Act).

Commencement Information

I17Sch. 3 para. 9 not in force at Royal Assent, see s. 240(1)

I18Sch. 3 para. 9 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

10U.K.Any reference in this Part to the effect of Part 1 or 2 of this Schedule is a reference to the effect that Part 1 or 2 would have if this Part were disregarded.

Commencement Information

I19Sch. 3 para. 10 not in force at Royal Assent, see s. 240(1)

I20Sch. 3 para. 10 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Pre-existing Part 4B services which are regulated user-to-user servicesU.K.

Application of paragraphs 12 to 14U.K.

11(1)This paragraph and paragraphs 12 to 14 apply in relation to a pre-existing Part 4B service which—

(a)is within the definition in paragraph (a) of paragraph 7(1), and

(b)is also a regulated user-to-user service.

(2)If the effect of Part 1 of this Schedule is that the period within which the first illegal content risk assessment or CAA of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 12 or 13.

(3)If the effect of paragraph 6 is that the period within which the first section 15(2) assessment of the service must be completed begins on a day before the assessment start day, the time for carrying out that assessment is extended as set out in paragraph 14.

(4)But paragraphs 12 to 14 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Commencement Information

I21Sch. 3 para. 11 not in force at Royal Assent, see s. 240(1)

I22Sch. 3 para. 11 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Illegal content risk assessments and children’s access assessmentsU.K.

12(1)Sub-paragraphs (2) and (3) apply in relation to the service if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2)The first illegal content risk assessment of the service must be completed within the period of three months beginning with the assessment start day.

(3)The first CAA of the service must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I23Sch. 3 para. 12 not in force at Royal Assent, see s. 240(1)

I24Sch. 3 para. 12 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

13U.K.If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a)the first illegal content risk assessment of the service, and

(b)the first CAA of the service.

Commencement Information

I25Sch. 3 para. 13 not in force at Royal Assent, see s. 240(1)

I26Sch. 3 para. 13 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessmentsU.K.

14(1)If section 15(2) guidance is available on the assessment start day, the first section 15(2) assessment of the service must be completed within the period of three months beginning with that day.

(2)If, on the assessment start day, the first section 15(2) guidance has not yet been published, the first section 15(2) assessment of the service must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I27Sch. 3 para. 14 not in force at Royal Assent, see s. 240(1)

I28Sch. 3 para. 14 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Regulated user-to-user services which include a pre-existing Part 4B serviceU.K.

Application of paragraphs 16 to 20U.K.

15(1)Paragraphs 16 to 20 make provision about the timing of assessments in the case of a regulated user-to-user service which includes a pre-existing Part 4B service within the definition in paragraph (b) of paragraph 7(1).

(2)In sub-paragraph (3) and paragraphs 16 to 20

(a)the regulated service” means the regulated user-to-user service, and

(b)the Part 4B part” means the pre-existing Part 4B service which is included in the regulated service.

(3)If the effect of Part 1 or paragraph 6 of this Schedule is that the period within which the first illegal content risk assessment, CAA or section 15(2) assessment of the regulated service must be completed begins on a day before the assessment start day—

(a)the time for carrying out the assessment in question in relation to the Part 4B part is extended as set out in paragraph 16, 17 or 18 (whichever applies),

(b)Part 1 and paragraph 6 apply as set out in paragraph 19, and

(c)paragraph 5 applies as set out in paragraph 20.

(4)But paragraphs 16 to 20 do not apply if the service ceases to be a regulated user-to-user service on the assessment start day.

Commencement Information

I29Sch. 3 para. 15 not in force at Royal Assent, see s. 240(1)

I30Sch. 3 para. 15 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Illegal content risk assessments and children’s access assessments of Part 4B partU.K.

16(1)Sub-paragraphs (2) and (3) apply in relation to the Part 4B part if, on the assessment start day, illegal content risk assessment guidance is available but the first CAA guidance has not yet been published.

(2)The first illegal content risk assessment of the Part 4B part must be completed within the period of three months beginning with the assessment start day.

(3)The first CAA of the Part 4B part must be completed within the period of three months beginning with the day on which the first CAA guidance is published.

Commencement Information

I31Sch. 3 para. 16 not in force at Royal Assent, see s. 240(1)

I32Sch. 3 para. 16 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

17U.K.If, on the assessment start day, illegal content risk assessment guidance and CAA guidance are both available, both of the following must be completed within the period of three months beginning with that day—

(a)an illegal content risk assessment of the Part 4B part, and

(b)a CAA of the Part 4B part.

Commencement Information

I33Sch. 3 para. 17 not in force at Royal Assent, see s. 240(1)

I34Sch. 3 para. 17 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Section 15(2) assessments of Part 4B partU.K.

18(1)If section 15(2) guidance is available on the assessment start day, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with that day.

(2)If, on the assessment start day, the first section 15(2) guidance has not yet been published, a section 15(2) assessment of the Part 4B part must be completed within the period of three months beginning with the day on which the first section 15(2) guidance is published.

Commencement Information

I35Sch. 3 para. 18 not in force at Royal Assent, see s. 240(1)

I36Sch. 3 para. 18 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Application of Part 1 and paragraph 6U.K.

19(1)This paragraph applies in relation to—

(a)an illegal content risk assessment or a CAA of the regulated service if an assessment of that kind is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 16 or 17;

(b)a section 15(2) assessment of the regulated service if a section 15(2) assessment is due to be carried out in relation to the Part 4B part of the service in accordance with paragraph 18.

References in the rest of this paragraph to an illegal content risk assessment, a CAA or a section 15(2) assessment are to an assessment of that kind to which this paragraph applies.

(2)For the purposes of this paragraph—

(a)the regulated service is “type 1” if it would still be a regulated user-to-user service even if the Part 4B part were to be assumed not to be part of the service;

(b)the regulated service is “type 2” if it would be a regulated search service if the Part 4B part were to be assumed not to be part of the service;

(c)the regulated service is “type 3” if it does not fall within paragraph (a) or (b).

(3)If the regulated service is type 1, an illegal content risk assessment, a CAA or a section 15(2) assessment is to be treated as being due at the time provided for by Part 1 or paragraph 6 only in relation to the rest of the service.

(4)In sub-paragraph (3) “the rest of the service” means any user-to-user part of the regulated service other than the Part 4B part.

(5)If the regulated service is type 2—

(a)an illegal content risk assessment is not required to be carried out at the time provided for by Part 1, but that is not to be taken to prevent an illegal content risk assessment as defined by section 26 from being due in relation to the search engine of the service at the time provided for by Part 1;

(b)a CAA is to be treated as being due at the time provided for by Part 1 only in relation to the search engine of the service;

(c)a section 15(2) assessment is not required to be carried out at the time provided for by paragraph 6.

(6)If the regulated service is type 3, no illegal content risk assessment, CAA or section 15(2) assessment is required to be carried out at the time provided for by Part 1 or paragraph 6.

Commencement Information

I37Sch. 3 para. 19 not in force at Royal Assent, see s. 240(1)

I38Sch. 3 para. 19 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Application of paragraph 5U.K.

20(1)This paragraph sets out how paragraph 5 (children’s risk assessments) is to apply if a CAA is required to be carried out in accordance with—

(a)paragraph 16 or 17 (CAA of Part 4B part of a service),

(b)paragraph 19(3) (CAA of the rest of a service), or

(c)paragraph 19(5)(b) (CAA of search engine of a service).

(2)The definition of “the relevant day” is to operate by reference to the CAA that was (or was required to be) carried out, and accordingly, references to the day on which the service is to be treated as likely to be accessed by children are to be read as references to the day on which the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be) is to be treated as likely to be accessed by children.

(3)References to a children’s risk assessment of the service are to a children’s risk assessment of the Part 4B part of the service, the rest of the service or the search engine of the service (as the case may be).

Commencement Information

I39Sch. 3 para. 20 not in force at Royal Assent, see s. 240(1)

I40Sch. 3 para. 20 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

PART 4U.K.Interpretation, and extension of three-month periods

Interpretation of this ScheduleU.K.

21In this Schedule—

  • CAA” means a children’s access assessment (see section 35);

  • CAA guidance” means OFCOM’s guidance under section 52(3)(b) (guidance about children’s access assessments);

  • children’s risk assessment guidance” means OFCOM’s guidance under section 99(3);

  • “section 15(2) assessment” means OFCOM’s assessment under section 14 (assessments related to the adult user empowerment duty set out in section 15(2));

  • section 15(2) guidance” means OFCOM’s guidance under section 52(1).

Commencement Information

I41Sch. 3 para. 21 not in force at Royal Assent, see s. 240(1)

I42Sch. 3 para. 21 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

22U.K.For the meaning of “likely to be accessed by children”, see section 37.

Commencement Information

I43Sch. 3 para. 22 not in force at Royal Assent, see s. 240(1)

I44Sch. 3 para. 22 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

23U.K.In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a)references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 9;

(b)references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(1).

Commencement Information

I45Sch. 3 para. 23 not in force at Royal Assent, see s. 240(1)

I46Sch. 3 para. 23 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

24U.K.In relation to regulated search services and the search engine of combined services—

(a)references to an illegal content risk assessment are to an illegal content risk assessment as defined by section 26;

(b)references to illegal content risk assessment guidance are to OFCOM’s guidance under section 99(2).

Commencement Information

I47Sch. 3 para. 24 not in force at Royal Assent, see s. 240(1)

I48Sch. 3 para. 24 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

25U.K.In relation to regulated user-to-user services (or in the case of combined services, the user-to-user part of such services)—

(a)references to a children’s risk assessment are to a children’s risk assessment as defined by section 11;

(b)references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

Commencement Information

I49Sch. 3 para. 25 not in force at Royal Assent, see s. 240(1)

I50Sch. 3 para. 25 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

26U.K.In relation to regulated search services and the search engine of combined services—

(a)references to a children’s risk assessment are to a children’s risk assessment as defined by section 28;

(b)references to children’s risk assessment guidance are to be read as references to guidance about such children’s risk assessments.

Commencement Information

I51Sch. 3 para. 26 not in force at Royal Assent, see s. 240(1)

I52Sch. 3 para. 26 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

27U.K.For the purposes of this Schedule, guidance of a particular kind is available at a particular time if at that time there is in existence published guidance of that kind.

Commencement Information

I53Sch. 3 para. 27 not in force at Royal Assent, see s. 240(1)

I54Sch. 3 para. 27 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Extension of three-month periodsU.K.

28(1)This paragraph applies in relation to a time-limit of three months imposed by any provision of this Schedule for completing a CAA, a section 15(2) assessment or a particular kind of risk assessment.

(2)Extra time may be allowed—

(a)by agreement between OFCOM and the provider of a particular Part 3 service, or

(b)in accordance with a notice published by OFCOM specifying a longer period for CAAs, section 15(2) assessments or risk assessments of that kind (as the case may be) which relate to Part 3 services of a particular kind or size.

Commencement Information

I55Sch. 3 para. 28 not in force at Royal Assent, see s. 240(1)

I56Sch. 3 para. 28 in force at 10.1.2024 by S.I. 2023/1420, reg. 2(z35)

Back to top

Options/Help

Print Options

You have chosen to open The Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open The Whole Act as a PDF

The Whole Act you have selected contains over 200 provisions and might take some time to download.

Would you like to continue?

You have chosen to open the Whole Act

The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open the Whole Act without Schedules

The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

You have chosen to open Schedules only

The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.

Would you like to continue?

Close

Legislation is available in different versions:

Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.

Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.

Close

See additional information alongside the content

Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.

Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.

Close

Opening Options

Different options to open legislation in order to view more content on screen at once

Close

Explanatory Notes

Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.

Close

More Resources

Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • correction slips
  • links to related legislation and further information resources
Close

Timeline of Changes

This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.

Close

More Resources

Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • correction slips

Click 'View More' or select 'More Resources' tab for additional information including:

  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • links to related legislation and further information resources