UK Online Safety Act Illegal Content Risk Assessment

Sections 9 and 26 require providers of regulated user-to-user and search services to carry out a suitable and sufficient illegal-content risk assessment. Assess each of the 18 kinds of priority illegal content separately and assess other illegal content that users may encounter. A user-to-user service must also assess the risk that it is used to commit or facilitate a priority offence. Ofcom's risk profiles are mandatory inputs, not substitutes for the service's own assessment.

Define how each offence or content kind can arise in the service: creation, upload, sharing, messaging, recommendation, search, indexing, monetisation, contact, or off-platform coordination. Consider the user base; likelihood and severity of harm; the number and characteristics of people affected; functionalities and algorithmic systems; the business model; intended and unintended use; and how the service's design, operation, and existing controls increase or reduce risk.

Evidence should combine Ofcom risk profiles with internal data such as prevalence and reach, user reports, complaints, moderation and search samples, recommender tests, enforcement outcomes, threat intelligence, user research, and known blind spots. Low reporting can reflect poor detection or inaccessible reporting, so record uncertainty.

Map every material risk to proportionate design and operational measures, the relevant in-force Ofcom code measure or a documented effective alternative, an owner, test evidence, residual risk, and monitoring threshold. Ofcom guidance recommends a review at least every 12 months, while the Act requires the assessment to remain up to date and requires a further assessment before a significant change.

Record the provider, service boundary, assessment type and version, content or offence kind, encounter or dissemination pathway, affected groups, likelihood and impact evidence, design contribution, data limitations, existing controls, control test, residual risk, code measure or alternative, action, owner, due date, approval, and review trigger.

Review when there is reason to suspect the assessment is inaccurate and before a significant service change. Triggers include new messaging or group features, a recommender or search change, monetisation, generative-AI functions, a new market, a material user-base shift, a control failure, new offence evidence, or a significant Ofcom risk-profile change. Category 1 and 2A providers must also reflect their registered service boundary and provide Ofcom with the record as soon as reasonably practicable after making or revising it. Following publication of the categorised-services register on 30 June 2026, Ofcom said providers should supply their latest records by October 2026, or confirm where Ofcom already holds an up-to-date record.