Step 2, demand compliance.
Step 3, upon not hearing of compliance, levy fines.
Step 4, upon non payment of fines, declare in breach of (2).
Step 5, block site from UK using DNS, in the same manner as torrent sites etc.
5 was always the goal, 2 to 4 are largely just performative.
The UK government has lost control of what happen in the physical world on their own island so now the bureaucrats play a fantasy game where they are gonna enforce their rules and dominion in their former colonies or the digital world.
Unless by "democracy" you mean "sleepwalking administration everyone hates" the current UK government is unusually undemocratic.
As we saw in the case of the Winter fuel Payments : if a policy is unpopular with voters, it is abandoned. The Online Safety Act is popular, so it will stay.
The winter fuel payments were very unpopular with a very vocal part of the population, while any benefits were very thinly distributed on the rest of the electorate.
The cost of the online safety act is very small and almost invisible distributed across everyone. Any major effects (leaking of personal data) can be blamed on the victims (most people assume that only perverts will have to verify their age). Another effect where security conscious people will be excluded from online discussions is probably in invisible (if not a benefit) to most people.