UK Online Safety Act Risk Assessment Workflow

Run the workflow as online-safety triage: first confirm whether the service is in scope, then check whether children are likely to access it, identify the relevant duty or risk type, decide the mitigation or control, record evidence, assign an owner, and set the next review date. If the service is not in scope, close the item; if it is in scope and the risk is unresolved, escalate before implementation.

A useful template captures service type, user group, risk type, child-access result, code measure, mitigation owner, evidence, review date, and unresolved assumptions. Each field should support a decision, not just store a label.

Review the workflow after Ofcom code updates, feature changes, algorithm changes, user-base changes, incident trends, complaints, enforcement notices, or transparency-report cycles. Use each review to decide whether the current controls still reduce the identified risk, whether the evidence is sufficient, and whether the item should stay open, be escalated, or be closed.