--- title: "UK Online Safety Act Risk Assessment Template" canonical_url: "https://www.sorena.io/artifacts/uk/online-safety-act/online-safety-risk-assessment-template" source_url: "https://www.sorena.io/artifacts/uk/online-safety-act/online-safety-risk-assessment-template" author: "Sorena AI" description: "Practical UK Online Safety Act risk assessment template covering service profile, harms inventory, controls, residual risk, child access, child safety." published_at: "2026-02-21" updated_at: "2026-02-21" keywords: - "UK Online Safety Act risk assessment template" - "illegal content risk assessment template" - "children risk assessment template" - "child access assessment template" - "risk assessment template" - "illegal harms" - "child access assessment" - "children risk assessment" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # UK Online Safety Act Risk Assessment Template Practical UK Online Safety Act risk assessment template covering service profile, harms inventory, controls, residual risk, child access, child safety. *Template* *Risk Assessments* ## Risk Assessment Template A useful template forces teams to connect harms, controls, metrics, and owners. Do not let the assessment become a static legal memo. It should be a working control document that changes product decisions. UK OSA implementation creates at least three distinct but linked assessment layers for many services: the illegal content risk assessment, the child access assessment, and where relevant the children risk assessment. One template can support all three if it preserves the differences between them. ## Template section one: service profile and scope logic Start with the service description, service parts, user base, UK link, likely-to-be-accessed-by-children logic, and category exposure assumptions. Without this, the rest of the assessment floats free from the statutory context. A reviewer should be able to understand exactly which service or service part the assessment covers. - Service name, owner, and assessed version - User-to-user, search, or provider pornography classification - Child access determination and rationale - Assessment date, approver, and next review trigger *Recommended next step* *Placement: after the template, evidence, or documentation block* ## Keep Risk Assessment Template in one governed evidence system SSOT can take Risk Assessment Template from reusing this material inside a governed evidence system to a reusable workflow inside Sorena. Teams working on Risk Assessment can keep owners, evidence, and next steps aligned without copying this guide into separate documents. - [Open SSOT for Risk Assessment Template](/solutions/ssot.md): Start from Risk Assessment Template and keep documents, evidence, and control records in one governed system. - [Talk through Risk Assessment](/contact.md): Review your current process, evidence gaps, and next steps for Risk Assessment Template. ## Template section two: harms, controls, and residual risk List the relevant illegal harms, child harms, or both. Then map the existing controls, identify control gaps, assign remediation owners, and record the residual risk position after those controls are considered. The best templates separate preventive, detective, responsive, and governance controls. - Harm scenario and affected users - Control mapping by product, moderation, and policy layer - Effectiveness evidence and known failure modes - Residual risk rating with remediation deadline ## Template section three: governance and evidence Record how the assessment will be kept live after approval. The regime moves quickly, so stale assessments are a major weakness. Metrics, change triggers, and evidence locations should be part of the template itself. This is what turns a template into an operating tool. - Owner for monthly or quarterly review - Data sources for moderation, complaints, age assurance, and trust signals - Board or committee escalation thresholds - Location of evidence, approvals, and follow-up actions ## Primary sources - [Online Safety Act 2023](https://www.legislation.gov.uk/ukpga/2023/50/contents?ref=sorena.io) - Primary legislation for scope, duties, risk assessment, enforcement, transparency, and complaints provisions. - [Online Safety Act explainer](https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer?ref=sorena.io) - Current government implementation status, deadlines, and plain language explanation of the regime. - [ICO audit guide for the Age Appropriate Design Code](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/age-appropriate-design/?ref=sorena.io) - Audit scope and control themes for children's data, including age assurance, privacy settings, geolocation, profiling, and nudge techniques. ## Related Topic Guides - [UK Online Safety Act Age Assurance Options | Age Estimation, Verification, and Child Access Controls](/artifacts/uk/online-safety-act/age-assurance-options.md): Grounded age assurance guide for the UK Online Safety Act covering January 2025 pornography guidance, highly effective age assurance. - [UK Online Safety Act Applicability Test | Regulated Service, Exemptions, and UK Scope](/artifacts/uk/online-safety-act/applicability-test.md): Grounded UK Online Safety Act applicability test covering regulated user-to-user and search services, Schedule 1 exemptions, provider pornography scope. - [UK Online Safety Act Checklist | Scope, Risk, Child Safety, Moderation, and Evidence](/artifacts/uk/online-safety-act/checklist.md): Audit-ready UK Online Safety Act checklist covering service scope, illegal risk assessment, child access and child risk assessment, moderation, complaints. - [UK Online Safety Act Children Safety Duties | Child Access, Child Risk, and Age Assurance](/artifacts/uk/online-safety-act/children-safety-duties.md): Grounded guide to UK Online Safety Act children safety duties covering section 81 timing, children access assessments, children risk assessments. - [UK Online Safety Act Compliance Program | Governance, Controls, and Ofcom Readiness](/artifacts/uk/online-safety-act/compliance.md): Program design guide for UK Online Safety Act compliance covering governance, scope, assessments, moderation, age assurance, complaints, metrics. - [UK Online Safety Act Content Moderation and Appeals | Complaints, Terms Enforcement, and Redress](/artifacts/uk/online-safety-act/content-moderation-and-appeals.md): Grounded guide to UK Online Safety Act moderation and appeals requirements covering sections 21, 32, 71, and 72, complaints design, terms enforcement. - [UK Online Safety Act Deadlines and Compliance Calendar | 2023 to 2026 Milestones](/artifacts/uk/online-safety-act/deadlines-and-compliance-calendar.md): Grounded UK Online Safety Act calendar covering 26 October 2023 enactment, 31 January 2024 offences, 16 December 2024 illegal harms codes. - [UK Online Safety Act Enforcement and Penalties | Ofcom Notices, Penalties, and Escalation](/artifacts/uk/online-safety-act/enforcement-and-penalties.md): Grounded UK Online Safety Act enforcement guide covering Ofcom information notices, senior manager naming, confirmation decisions. - [UK Online Safety Act FAQ | Scope, Child Duties, Categories, and Ofcom Enforcement](/artifacts/uk/online-safety-act/faq.md): Practical FAQ on the UK Online Safety Act covering who is in scope, what changed in 2025, child access and risk assessments, age assurance, category duties. - [UK Online Safety Act Illegal Content Duties | Illegal Harms, Priority Offences, and Risk Assessments](/artifacts/uk/online-safety-act/illegal-content-duties-explained.md): Grounded guide to UK Online Safety Act illegal content duties covering user-to-user and search services, illegal content risk assessments. - [UK Online Safety Act Penalties and Fines | GBP 18 Million, 10 Percent Revenue, and Liability](/artifacts/uk/online-safety-act/penalties-and-fines.md): Grounded penalty guide for the UK Online Safety Act covering the GBP 18 million or 10 percent worldwide revenue cap. - [UK Online Safety Act Requirements | Sections, Deadlines, Controls, and Evidence](/artifacts/uk/online-safety-act/requirements.md): Detailed UK Online Safety Act requirements guide mapping scope, illegal content duties, child safety duties, terms enforcement, complaints, categorisation. - [UK Online Safety Act Risk Assessments Playbook | How to Run Illegal and Children Risk Reviews](/artifacts/uk/online-safety-act/risk-assessments-playbook.md): Operational playbook for UK Online Safety Act risk assessments covering sequencing, ownership, evidence collection, control design. - [UK Online Safety Act Service Scope and Categorization | Category 1, 2A, 2B, and Part 3 Logic](/artifacts/uk/online-safety-act/service-scope-and-categorization.md): Grounded service scope and categorisation guide for the UK Online Safety Act covering Part 3 logic, likely to be accessed by children, Category 1, 2A. - [UK Online Safety Act vs EU Digital Services Act | Scope, Child Safety, and Enforcement Differences](/artifacts/uk/online-safety-act/online-safety-act-vs-dsa.md): Practical comparison of the UK Online Safety Act and the EU Digital Services Act covering regulated service models, illegal content frameworks. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/uk/online-safety-act/online-safety-risk-assessment-template