UK Online Safety Act Risk Assessment Workflow

Step 1 - define the assessed service and scope boundary. Record the provider, service type, UK link, user and search functions, excluded or exempt parts, launch status, user base, business model, and dependencies. A group-wide assessment works only if it shows how the conclusions apply to each regulated service.

Step 2 - collect evidence before scoring. Use Ofcom's risk profiles, internal prevalence and reach data, complaints, reports, enforcement data, user research, threat intelligence, recommender and search testing, and evidence about children. Record missing data; absence of reports does not establish absence of risk.

Step 3 - assess each statutory risk in the form required for the service. Illegal-content assessments separate each priority-illegal-content kind and other illegal content; user-to-user assessments also cover commission or facilitation of priority offences. Children's assessments separate each kind of primary-priority and priority content harmful to children, any non-designated harmful content identified for assessment, and the relevant child age groups. Consider likelihood, severity, affected users and their characteristics, design and operation, intended and unintended use, and how content is encountered or disseminated.

Step 4 - map conclusions to proportionate measures, owners, and evidence. Compare proposed design and operational controls with the applicable in-force Ofcom code. A provider may use effective alternative measures, but it remains responsible for meeting the binding duty and should retain the evidence and rationale for the alternative.

Step 5 - approve, disclose where required, and monitor assumptions. An accountable owner should accept residual risk, fund actions, set deadlines, and define reassessment evidence. Category 1 and 2A services on Ofcom's register updated on 28 September 2026 have additional illegal-content risk-assessment record and summary duties; those duties do not apply to every Part 3 service.

For each assessed kind of content harmful to children, compare the encounter likelihood and impact evidence with Ofcom's Table 10. User-to-user providers consider the proportion and combined effect of relevant Children's Risk Profile factors; search providers use the Children's Register and their own evidence instead of counting factors. Assess likelihood and impact separately, then explain the overall level. Do not multiply invented numeric scores or use the table mechanically.

If likelihood and impact point to different levels, make a reasoned overall judgement. Where the evidence does not establish which level applies, Ofcom expects providers to choose the higher level. Substantial evidence of harmful content normally points to high risk. A prohibition in the terms, few risk factors, or adoption of code measures does not by itself establish low risk.

Record the assessment version, service facts, responsible people, applicable duty, Ofcom risk-profile reference, hazard, affected users, evidence, likelihood and impact rationale, design contribution, existing controls, residual risk, code measure or alternative, action, owner, due date, approval, and review trigger. Each score needs a written rationale and linked evidence.

Review the workflow after Ofcom code or significant risk-profile updates, feature changes, algorithm changes, user-base changes, incident trends, complaints, enforcement notices, or transparency-report cycles. Ofcom recommends reviewing risk assessments at least every 12 months, but event-driven duties can require earlier action. Decide whether current controls still reduce the identified risk, whether the evidence is sufficient, and whether the item should stay open, be escalated, or be closed.