UK Online Safety Act Illegal Content Risk Assessment
Every regulated user-to-user and search service needs a suitable and sufficient assessment of its illegal-content risks.
Assess on the applicable timetable, retain the reasoning, map risks to proportionate measures, and reassess before significant changes or when evidence shows the assessment may be inaccurate.
Every Part 3 user-to-user and search service must complete and record a suitable and sufficient . Existing services had to complete the first assessment by 16 March 2025; a new or newly in-scope service generally has three months. Keep the assessment up to date and assess a significant design or operational change before making it. Use the findings to choose proportionate safety measures, owners, tests, and monitoring.
1
Section 1
How should an illegal content risk assessment run?
Sections 9 and 26 require providers of regulated user-to-user and search services to carry out a suitable and sufficient illegal-content risk assessment. Assess each of the 18 kinds of separately and assess other illegal content that users may encounter. A user-to-user service must also assess the risk that it is used to commit or facilitate a priority offence. Ofcom's risk profiles are mandatory inputs, not substitutes for the service's own assessment.
Define how each offence or content kind can arise in the service: creation, upload, sharing, messaging, recommendation, search, indexing, monetisation, contact, or off-platform coordination. Consider the user base; likelihood and severity of harm; the number and characteristics of people affected; functionalities and algorithmic systems; the business model; intended and unintended use; and how the service's design, operation, and existing controls increase or reduce risk.
Evidence should combine Ofcom risk profiles with internal data such as prevalence and reach, user reports, complaints, moderation and search samples, recommender tests, enforcement outcomes, threat intelligence, user research, and known blind spots. Low reporting can reflect poor detection or inaccessible reporting, so record uncertainty.
Map every material risk to proportionate design and operational measures, the relevant in-force Ofcom code measure or a documented effective alternative, an owner, test evidence, residual risk, and monitoring threshold. Ofcom guidance recommends a review at least every 12 months, while the Act requires the assessment to remain up to date and requires a further assessment before a .
Scope: provider, service boundary, user-to-user or search function, UK link, users, features, business model, and assessment version.
Risk row: content or offence kind, pathway, likelihood, impact, affected groups, design contribution, existing controls, evidence, and uncertainty.
Decision row: residual risk, code measure or alternative, action, owner, due date, interim restriction, approver, and acceptance reason.
Explains Ofcom's illegal-content codes of practice and the related duties that an illegal-content risk assessment workflow should map to owners and evidence.
Provides official context on which services the Online Safety Act covers; the assessment method comes from sections 9 and 26 and Ofcom's risk-assessment guidance.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Covers the separate protection-of-children codes and helps distinguish a children's risk assessment from this illegal-content assessment.
Online Safety Act
2
Section 2
How do you judge likelihood, impact and the overall risk level?
Use Ofcom's illegal-content General Risk Level Table separately for each kind of . For user-to-user services, assess the relevant risk-profile factors and their combined effect; 'many', 'several' and 'few' are relative to the number of factors for that harm. Search services instead use the Register of Risks and their own evidence to judge likelihood.
Assess impact using the severity of harm, actual or potential numbers affected, vulnerable groups and dissemination pathways, including harm to people who do not use the service. Severe impact can justify high risk even where few people are affected. User numbers and sharing potential inform the judgement but do not determine the rating by themselves.
Record likelihood and impact separately, then explain the overall rating. If they diverge, weigh the evidence rather than averaging scores. Where evidence does not establish the appropriate level, Ofcom expects providers to err on the side of caution and select the higher level. The tables guide judgement rather than prescribe a mechanical calculation.
Ofcom expects user-to-user services also to assess image-based child sexual abuse material (CSAM), CSAM URLs and grooming separately, in addition to the overall child sexual exploitation and abuse (CSEA) assessment. Use the dedicated tables: image/video generation or sharing, anonymous text/link sharing and one-to-one contact with children can affect the rating even before harm materialises. Search services need only the overall CSEA assessment.
High risk: significant evidence of encounters, many relevant risk factors without effective controls, substantial illegal content or offence facilitation, actual harm to many people, or severe impact even on a small number of people. Substantial illegal content or actual harm to many individuals is a strong indicator even when controls exist.
Medium risk: evidence of encounters or likely encounters, several relevant factors without demonstrated effective risk reduction, a moderate amount of illegal content or offence facilitation, or moderate harm. Evidence of a moderate amount or harm to a moderate number normally indicates at least medium risk.
Low risk: evidence supports no occurrence and no or few relevant factors, or comprehensive controls demonstrably reduce risk very effectively; impact must remain limited. Occasional incidents with high severity rule out a low rating, and following code measures alone does not establish low risk.
Negligible or no risk: evidence shows the harm is impossible or extremely unlikely through the service. Where relevant factors exist and the harm is possible, comprehensive evidence is normally needed to justify this conclusion.
Part 3 paragraphs 3.1-3.10 and Table 13 explain likelihood, impact and overall risk calibration; the following tables cover image-based CSAM, CSAM URLs and grooming for user-to-user services.
3
Section 3
Which fields belong in each assessment row?
Record the provider, service boundary, assessment type and version, content or offence kind, encounter or dissemination pathway, affected groups, likelihood and impact evidence, design contribution, data limitations, existing controls, control test, residual risk, code measure or alternative, action, owner, due date, approval, and review trigger.
Keep and other illegal content identifiable by kind and pathway.
Record both inherent risk and residual risk so the claimed effect of existing controls is visible.
Label estimates, sampling, detection limits, missing markets or features, and other uncertainty beside the conclusion affected.
Do not count a planned mitigation as an operating control; give it an owner, deadline, interim control, and completion test.
Confirms the Act's implementation status and links to the current regulator material used alongside the template.
The Online Safety Act 2023 (the Act) protects children and adults online.
4
Section 4
When should the assessment be reviewed?
Review when there is reason to suspect the assessment is inaccurate and before a significant service change. Triggers include new messaging or group features, a recommender or search change, monetisation, generative-AI functions, a new market, a material user-base shift, a control failure, new offence evidence, or a significant Ofcom risk-profile change. Category 1 and 2A providers must also reflect their registered service boundary and provide Ofcom with the record as soon as reasonably practicable after making or revising it. Following publication of the categorised-services register on 30 June 2026, Ofcom said providers should supply their latest records by October 2026, or confirm where Ofcom already holds an up-to-date record.
Re-run prevalence, reach, search, recommender, reporting, and moderation tests affected by the change.
Compare incidents and complaints with the risks and control assumptions in the approved assessment.
Escalate high-severity plausible harms when evidence is missing rather than assigning a low likelihood by default.
Version the changed evidence, conclusion, mitigation, residual risk, approval, and effective date.
Explains that code measures vary with the illegal-harm risks identified and that providers using alternatives must keep a record of how they meet the duties.
Provides official service-scope and implementation context; it does not replace the statutory assessment test or Ofcom's detailed method.
Provides official context on which services the Online Safety Act covers; the assessment method comes from sections 9 and 26 and Ofcom's risk-assessment guidance.
Provides official service-scope context for the provider and service-boundary fields.
Show 1 more
Provides official scope context; the event-driven review rules are set by sections 9 and 26 and Ofcom guidance.
"The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online."
Current regulator guidance on the 18 priority-illegal-content kinds, assessment method, evidence, controls, records, reviews, and Category 1 and 2A duties.
Supports separate risk rows, evidence and uncertainty, control decisions, written records, and ongoing review.
Supports the additional July 2026 Category 1 and 2A record-submission, service-boundary, update, and public-summary duties.
Explains the code-of-practice framework, alternative measures, record keeping, and how recommended measures vary with assessed illegal-harm risk.
Explains Ofcom's illegal-content codes of practice and the related duties that an illegal-content risk assessment workflow should map to owners and evidence.
Explains that code measures vary with the illegal-harm risks identified and that providers using alternatives must keep a record of how they meet the duties.
Part 3 paragraphs 3.1-3.10 and Table 13 explain likelihood, impact and overall risk calibration; the following tables cover image-based CSAM, CSAM URLs and grooming for user-to-user services.