UK Online Safety Act Online Safety Risk Assessment Template

Use a separate controlled record for each illegal-content or children's risk assessment and keep the children's access assessment identifiable as its own decision. Existing services had first-assessment deadlines of 16 March 2025 for illegal content, 16 April 2025 for children's access, and 24 July 2025 for children's risk where triggered. For a new or newly in-scope service, record the applicable three-month period; for a significant change, approve the relevant assessment before release.

For each material risk, record the content or harm kind separately, the encounter or dissemination pathway, affected users and characteristics, likelihood evidence, severity evidence, service-design contribution, existing controls, control test, residual risk, in-force Ofcom code measure or documented effective alternative, action, owner, deadline, and monitoring trigger. For illegal-content assessments, include each priority-illegal-content kind, other illegal content, and, for user-to-user services, commission or facilitation of priority offences.

The evidence index should state the source system, date range, query or test method, version, limitations, retention location, and the conclusion supported. A score without a written rationale and retrievable evidence does not let a later reviewer reconstruct the decision.

Finish with unresolved assumptions, rejected controls and reasons, dependencies, interim restrictions, approval conditions, any required public summary, and event-driven review triggers. Planned work is an action, not an operating control.

Keep each field decision-relevant. Service facts establish scope; evidence fields establish what is known; risk rows show the statutory analysis; control rows show what operates now; action rows show work still due; approval and review fields show who accepted the result and when it must be reopened.

Review the template when a completed assessment cannot be reproduced, a required statutory factor has nowhere to be recorded, actions are mistaken for operating controls, or reviewers cannot tell which evidence supports a conclusion. Reopen the assessment itself whenever the applicable accuracy or significant-change trigger is met.