UK Online Safety Act Illegal Content Risk Assessment

User-to-user providers assess the risk of users encountering each kind of priority illegal content and other illegal content, and the risk of the service being used to commit or facilitate a priority offence. Search providers assess the risk of users encountering priority illegal content and other illegal content in or via search results. Sections 9 and 26 set the detailed elements for each service type.

The assessment must consider the service's user base, functionalities, algorithmic systems, business model, governance, proactive technology, user tools, intended and unintended uses, and how easily, quickly, and widely content may spread. It must also consider Ofcom's current risk profiles. Rate likelihood and impact using evidence that reflects the actual service.

Use Ofcom's illegal-content risk tables to calibrate each rating, with separate likelihood and impact reasoning. For user-to-user services, assess image-based child sexual abuse material (CSAM), CSAM URLs and grooming separately as well as overall child sexual exploitation and abuse (CSEA) risk; search services need only the overall CSEA assessment. The linked workflow explains the high, medium, low and negligible-risk criteria, how to handle conflicting evidence, and when to choose the higher level.

Services already in scope had to complete the first assessment by 16 March 2025. A new user-to-user or search service, or an existing service that newly comes into scope, must complete it within three months of starting or changing the service.

The provider must take appropriate steps to keep the assessment up to date. Complete a new assessment before a significant change to the service's design or operation. Review sooner when Ofcom significantly changes a relevant risk profile or when incidents, complaints, enforcement, research, or performance data show that the current risk picture may be wrong. Ofcom recommends review at least every 12 months.

The assessment is an input to the illegal-content safety duties. User-to-user providers need proportionate systems and processes designed to prevent users encountering priority illegal content, mitigate identified harm and offence risks, minimise how long priority illegal content remains, swiftly take down illegal content when aware of it, and effectively mitigate and manage the risk that the service is used to commit or facilitate priority offences. Search providers must use proportionate systems and processes to minimise encounter risk in or via search results and manage assessed risks.

Providers may follow applicable measures in Ofcom's codes of practice or use alternative measures that meet the legal duties. Keep the assessment record, the code mapping or alternative-measure rationale, implementation evidence, tests, terms or public statement, content-reporting route, complaints procedure, and review record. Ofcom can request these records.