May 2026's State Opening of Parliament and Ofcom's published priorities for the year ahead mark the Online Safety Act's transition from launch spectacle to steady-state supervision. The age-check switch-on of July 2025 was the headline; what follows is the grind that actually changes industries: audits of "highly effective" claims, children's risk-assessment reviews, and the first substantial enforcement cases working through the pipeline.
From deployment to demonstration
Year-one compliance meant deploying something. Year-two compliance means demonstrating it works: effectiveness metrics for age-assurance methods, evidence that circumvention is addressed, records tying risk assessments to mitigations. Services that bought a checkbox in 2025 are discovering that Ofcom's questionnaires ask for data the checkbox never produced.
Evidence is the moat
This is where architecture pays twice. WeVerify's age checks produce evidence by construction: method, confidence, liveness result, timestamp, sealed and retrievable, while retaining no personal data beyond the result. The same evidence discipline runs through the whole platform, because the regulatory pattern is universal: whether the supervisor is Ofcom, AMLA or a data-protection authority, "show me" is the request that decides outcomes.