How does commencement work?

We feel that the sequencing of commencement is curious and could benefit from clarification, or indeed a flowchart. We set out in annex A the sequence of events that we think need to take place before meaningful action can be taken under this regime; in summary, once the Bill receives Royal Assent (likely mid-2022, or later) OFCOM has 6-18 months to makes its broadly based survey of the risks of platforms (clause 61), then a further six months to make guidance (clause 62) for regulated services to meet their risk assessments the approval of which is then the appointed day on which it seems the duties in the act come into force. The completion of these two steps then starts the clock for companies to do their risk assessments: they have three months from the day of publication of the risk profile or guidance, whichever is the later.  It is not clear when the obligation to take action to respond to the risk assessment comes in either, or whether any duty (for example, taking into account human rights) is independent of the risk assessment.
The sequencing of these steps with additional steps required to ensure safeguards for children or to address content harmful to adults is also unclear.  Regarding children, companies need to know whether or not they have children using the service: clause 27 says a company has three months from OFCOM’s publication of guidance under clause 28. It is not clear whether this is supposed to happen before the OFCOM guidance on the risk assessments or whether the work on risk assessment would be split to get the illegal content guidance, which applies across the board, published first. Should companies who know they’ve got children using their services want to start thinking about it before they have to?
For content harmful to adults, a platform would presumably need to know that it was Category 1 before the obligations to do a risk assessment in relation to this would bite (though the text of the timing for the risk assessment doesn’t say this; the risk assessment is specified to apply to Category 1 only). Schedule 4 gives a timeline for this: OFCOM has to do research and report within 6 months (though an extension of up to 18 months can be granted, though there is no oversight of that process in the Schedule) After receiving advice, the Secretary of State is to bring an SI forward “as soon as reasonably practicable” and then OFCOM establishes a register as soon as reasonably practicable thereafter. (There is, of course, the period for the laying of the SI before Parliament but OFCOM could presumably work on its analysis during that period and only publish its conclusions once the SI enters into force, so minimising any delay from that process.)
We presume these could run concurrently but this gives OFCOM a lot to do simultaneously. On top of that, there is the process for priority content: the system can work without it but it would be politically astute for it to be addressed quite fast. This again requires the Secretary of State to consult OFCOM – at least as regards priority content for the adults’ and children’s safety duties (cl 47(2)). None of this is clear in the draft Bill or its supporting documents and the sequencing of several of these events will have implications for the effective functioning of the regime.
There are a number of things that could expedite this process, including an instruction to OFCOM from the Secretary of State to start its generic research now and not wait until the second reading of the Bill. Analysis too of which bits of the process are conditional on prior steps and which pieces of advice from OFCOM are helpful, but not essential, would also help in defining the critical path. We think that a timeline from DCMS would assist deliberations in the PLS stage, along with confirmation that Parliament can set the Secretary of State a deadline by when to do things.