The UK’s Online Safety Act is law, but questions remain. Loopholes like VPN use, slow action by tech firms, and new risks from AI show the act still has much work to do.