Ofcom Plan of Work 2026/27: the compliance calendar for telecoms and online services operators
In short: Ofcom Plan of Work 2026/27, published on 20 March 2026, maps the year’s regulatory deliverables for telecoms and online services operators. Key items: the connectivity work programme in spring 2026, the Online Safety Act categorisation register and additional duties consultation in July 2026, four clustered spectrum decisions, and UK preparations for WRC-27.
The compliance calendar for UK telecoms and online services operators in the year ahead runs through one document. Ofcom Plan of Work 2026/27, published as a statement on 20 March 2026 after consultation closed on 5 February 2026, sets out the deliverables the regulator intends to ship across the financial year that began on 1 April 2026. Read against the Three-Year Plan 2025-2028 published the year before, the Plan organises a dense and operationally demanding year for compliance teams.
Key findings from the Ofcom Plan of Work 2026/27
- The Plan organises Ofcom’s work around four priorities carried forward from the Three-Year Plan: internet and post we can rely on; media we trust and value; we live a safer life online; and enabling wireless in the UK economy. Source: Ofcom Statement.
- The connectivity work programme will be published in spring 2026 and will focus on four areas: urban areas and shared public spaces; in-building connectivity; connectivity on trains; and rural connectivity. Source: Ofcom Statement.
- Online Safety Act 2023 work in 2026/27 is dominated by the categorisation register (expected July 2026), the consultation on additional duties for categorised services (expected July 2026), the statement on additional safety measures strengthening the Illegal Harms and Protection of Children Codes, and the first transparency reports under section 77. Source: Ofcom Statement.
- The spectrum agenda is clustered around four decisions: an approach to authorisations in the 2 GHz MSS band, a statement on the upper block of 1.4 GHz for mobile, a review of current use and future demand for sub-1 GHz spectrum, and a consultation on a designated radio services Code of Practice in Q1 2026/27. Source: Ofcom Statement.
- The international spectrum workstream centres on UK preparation for WRC-27 (late 2027), with a Call for Input on UK positions expected in Q2 2026/27. Source: Ofcom Statement.
| Priority | Deliverable | Indicative timing |
|---|---|---|
| Internet and post | Connectivity work programme covering urban and shared spaces, in-building, trains, rural | Spring 2026 |
| Internet and post | Ofcom preparation for new duties under the Cyber Security and Resilience Bill (Royal Assent expected late 2026) | Through 2026/27 |
| Safer life online | Representations process for in-scope categorised services | Early 2026 |
| Safer life online | Publication of the categorisation register identifying Category 1, 2A and 2B services | July 2026 |
| Safer life online | Consultation on additional duties for categorised services (fraudulent advertising, terms of service, user empowerment, identity verification, news publisher content) | July 2026 |
| Safer life online | FCA-Ofcom joint work on fraudulent advertising codes via the DRCF (draft codes consultation no earlier than January 2026; duties in force first half 2027 at earliest) | Through 2026/27 |
| Safer life online | Statement on additional safety measures strengthening the Illegal Harms and Protection of Children Codes | 2026/27 |
| Safer life online | First transparency reports under section 77 OSA 2023 (after categorisation register issues; first reports due by summer 2027) | From late 2026 |
| Enabling wireless | Statement on the upper block of the 1.4 GHz band for mobile (1492-1517 MHz) | FY 2025/26 end / early 2026/27 |
| Enabling wireless | Approach to authorisations in the 2 GHz MSS band (Viasat and EchoStar licences expire May 2027) | Consultation in 2026/27 |
| Enabling wireless | Review of current use and future demand for sub-1 GHz spectrum | 2026/27 |
| Enabling wireless | Consultation on a designated radio services Code of Practice | Q1 2026/27 |
| Enabling wireless | Call for Input on UK positions for WRC-27 | Q2 2026/27 |
| Media we trust | Standards code consultation for on-demand programme services | 2026/27 |
| Media we trust | Final code of practice for connected TV accessibility | 2026/27 |
The Three-Year Plan spine and the four priorities
Ofcom’s general duties under section 3 of the Communications Act 2003 require it to further the interests of citizens and consumers across the sectors it regulates. The Plan of Work is the annual articulation of how the regulator proposes to discharge those duties in a given year. It is not an instrument that creates obligations: those flow from the underlying statutes. But it is the firmest indication operators receive of where regulatory attention and resource will go.
The Three-Year Plan 2025-2028, published on 28 March 2025, organised Ofcom’s longer-term ambition around four priorities. The Ofcom Plan of Work 2026/27 carries those same four priorities through into the second year of that cycle, with the substantive deliverables refined as workstreams have progressed. For operators, the practical effect is continuity at the strategic level and concrete deliverable dates at the operational level. The cross-reference also matters because DSIT’s Statement of Strategic Priorities, designated on 27 April 2026 under section 2A of the Communications Act 2003, sits over the top and binds Ofcom to have regard to growth, investment and infrastructure deployment in setting its annual priorities.
Internet and post: a reorganised connectivity programme and security build
The most structural change inside the Ofcom Plan of Work 2026/27 sits in the connectivity workstream. Ofcom will publish a connectivity work programme in spring 2026 organised around four areas: urban areas and shared public spaces; in-building connectivity; connectivity on trains; and rural connectivity. The reorganisation consolidates work that previously ran across multiple parallel reviews into a smaller number of larger workstreams. For mobile network operators, in-building deployers, transport operators and rural connectivity providers, the practical implication is fewer touchpoints with the regulator but each one carries more weight.
Alongside the connectivity programme, Ofcom continues its Telecommunications (Security) Act 2021 oversight and is preparing for new duties under the Cyber Security and Resilience Bill (introduced 12 November 2025, currently in the House of Lords after Commons Report stage, Royal Assent expected late 2026). The CSR Bill extends regulator oversight to data centres and other critical infrastructure operators. Operators inside the existing TSA 2021 framework should treat 2026/27 as a year in which the security perimeter expands rather than tightens. The fixed network workstreams continue, with copper retirement and the Telecoms Access Review 2026-31 remedies bedding in.
Safer life online: the operational year for Online Safety Act enforcement
2026/27 is the year the Online Safety Act 2023 regime moves from build to operation. The categorisation register, due in July 2026 following a representations process for in-scope services in early 2026, identifies which services fall into Category 1, Category 2A and Category 2B. Categorisation is the trigger for the extended duties under Part 7 of the Act: transparency reporting under section 77, fraudulent advertising duties, user empowerment, terms of service consistency, journalistic and democratic content protections, and identity verification. The consultation on those additional duties is also expected in July 2026.
In parallel, Ofcom will publish a statement on additional safety measures to strengthen the Illegal Harms and Protection of Children Codes. The Illegal Harms Codes were issued in December 2024 under section 41 OSA 2023 and the Protection of Children duties followed in 2025. The strengthening exercise reflects what Ofcom has learned from the first year of supervision and from its active investigation programme. The transparency reporting clock is the load-bearing constraint inside the Ofcom Plan of Work 2026/27: once notices issue under section 77, categorised services have a defined window to produce their first reports, and the first reports are due by summer 2027.
Operators outside the U2U and search service definitions still need to engage. Services that fall just below categorisation thresholds will face transparency pressure from market dynamics even before the regulator’s clock applies to them, and the additional duties consultation will set reference points for the regime as a whole. For services facing investigation, Ofcom continues to use the enforcement tools described in our earlier post on section 135 and 137A information notices.
The fraudulent-advertising duties under sections 38, 39 and 40 of the OSA 2023 are also the focus of coordinated work with the Financial Conduct Authority. The duties bind Category 1 user-to-user services and Category 2A search services to put proportionate systems and processes in place to prevent users encountering fraudulent paid-for adverts and to remove such adverts when they become aware of them. The offences within scope at section 40 include Fraud Act 2006 offences and FSMA financial promotions offences. Ofcom has indicated it will not consult on the draft codes of practice before January 2026, and the duties are unlikely to come into force before the first half of 2027. The FCA contributes the supervisory intelligence on what authorised and misleading financial-services promotions look like in practice, building on its earlier engagement with Google, Bing, Meta, X and TikTok to limit paid-for financial-services advertising on those platforms to FCA-authorised firms. The coordination runs through the Digital Regulation Cooperation Forum, which brings together Ofcom, the ICO, the FCA and the CMA. For the payments-side reading of how the FCA approaches this work in 2026/27, see our analysis of the FCA work programme 2026.
Enabling wireless: a clustered spectrum year
The spectrum agenda in the Ofcom Plan of Work 2026/27 clusters around four decisions of structural importance. Ofcom will publish a statement on the upper block of the 1.4 GHz band (1492-1517 MHz) for mobile use before, or at the start of, the new financial year. The 2 GHz MSS band workstream addresses what happens when the existing Viasat and EchoStar licences expire in May 2027: Ofcom is considering its future approach to authorisations alongside the EU’s parallel review, with a consultation in 2026/27. The sub-1 GHz demand review revisits the use and future demand for low-band spectrum that historically anchors mobile coverage and is now contested by satellite direct-to-device propositions.
The fourth decision is the designated radio services Code of Practice. Ofcom will consult on the draft Code of Practice in Q1 2026/27 (April to June 2026), setting out how designated radio services should comply with their obligations under the Wireless Telegraphy Act 2006 framework. The Code is anchored on the radio selection services regime; an earlier consultation has already addressed the principles and methods for Ofcom’s recommendations on designation. International work is also material: Ofcom leads the UK preparations for WRC-27 (late 2027) and expects to issue a Call for Input on UK positions in Q2 2026/27. For mobile, satellite, broadcasting and PMR users with international interests, the WRC cycle is the lens through which UK spectrum policy interacts with the global framework set by the ITU Radio Regulations.
Commercial and operational implications
For compliance teams at telecoms operators, the Ofcom Plan of Work 2026/27 marks out the year’s regulatory programme. The connectivity work programme reorganisation changes the venue and weight of regulator engagement on mobile and fixed connectivity matters: the four-area structure concentrates the conversation. TSA 2021 work continues on the existing timetable, with the CSR Bill expanding the security perimeter as it progresses through Parliament. The Telecoms Access Review 2026-31 remedies require ongoing operational implementation by Openreach and the access seekers that rely on them.
For online services operators, the operational lift in 2026/27 is the OSA build-out. Services likely to fall inside the categorisation register need the transparency reporting infrastructure, the user empowerment tooling and the journalistic content protections ready to ship by the time their notices arrive. Services unlikely to be categorised still face the baseline illegal content and child safety duties, and the strengthened Codes raise the floor. For spectrum users, the four-decision cluster means the year carries unusually high regulatory density on band-specific issues, and the WRC-27 Call for Input is the entry point for any operator with international spectrum interests. Operators considering a market entry or scope variation can refer to our regulatory perimeter and market entry guide.
Viewpoint
Two features of the Ofcom Plan of Work 2026/27 strike me as the structural change worth tracking. The first is the reorganisation of the connectivity workstream into four areas. In the past, mobile-coverage matters spread across multiple parallel reviews, and operators had to engage on each of them on a separate timetable. Consolidating into four areas changes the operational shape of regulator engagement: fewer touchpoints, each with more weight, and a cleaner internal structure for compliance and regulatory affairs teams to mirror. The second is that the OSA regime is now genuinely operational. Categorisation is no longer a future event. Notices will issue. Transparency reports will be due. The category of operator most exposed is the one that has not yet built the supporting infrastructure on the assumption that the timeline would slip again. From my regulatory practice at Bratby Law, the firms that come through the first cycle of an enforcement regime best are the ones that treat the regulator’s published calendar as the operative constraint, rather than the floor.
Frequently asked questions
When was Ofcom Plan of Work 2026/27 published?
Ofcom published the final statement on 20 March 2026, following the proposed Plan of Work issued for consultation on 5 December 2025. The consultation closed on 5 February 2026. The Plan covers the financial year that started on 1 April 2026 and ends on 31 March 2027.
What are the four priorities in the Ofcom Plan of Work 2026/27?
The four priorities, carried forward from the Three-Year Plan 2025-2028, are: internet and post we can rely on; media we trust and value; we live a safer life online; and enabling wireless in the UK economy. Each priority groups the underlying workstreams the regulator runs against the relevant statutory framework.
When will the Online Safety Act categorisation register be published?
Ofcom expects to publish the categorisation register in July 2026, identifying which user-to-user and search services meet the thresholds for Category 1, 2A and 2B. Categorisation triggers the additional duties under Part 7 of the Online Safety Act 2023, including transparency reporting under section 77. Services that meet the thresholds will have the opportunity to comment on provisional decisions through a representations process running in early 2026.
What spectrum decisions will Ofcom take in 2026/27?
The Ofcom Plan of Work 2026/27 sets out four spectrum decisions: a statement on the upper block of the 1.4 GHz band for mobile (1492-1517 MHz); the approach to authorisations in the 2 GHz MSS band ahead of licence expiries in May 2027; a review of current use and future demand for sub-1 GHz spectrum; and a consultation on a designated radio services Code of Practice in Q1 2026/27. Ofcom will also issue a Call for Input on UK positions for WRC-27 in Q2 2026/27.
For the investment and transactions reading of the same Plan, see our earlier analysis on what the Plan means for telecoms investment and transactions. For advice on aligning your compliance programme against the Ofcom Plan of Work 2026/27, contact Rob Bratby at Bratby Law.
