Artifact GuideUKRisk Assessments Playbook

UK Online Safety Act Risk Assessments Playbook

Risk Assessments Playbook decisions under the UK Online Safety Act should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page explains how a Risk Assessments Playbook helps teams running user-to-user services and search services likely to be accessed by children decide whether the UK Online Safety Act applies, who owns each action, what evidence to keep, and when to escalate.

Section 1

How should a Risk Assessments Playbook workflow run under the UK Online Safety Act?

Run the workflow as online-safety triage: service scope, user group, risk duty, code mapping, mitigation, evidence, owner, deadline, and Ofcom escalation.

Capture the request, product, role, data flow, jurisdiction, and deadline.
Check the source-linked rule and route exceptions before implementation.
Record the action taken, owner, reviewer, evidence location, and next review date.
Keep a plain-language output that support, product, legal, security, and compliance teams can all understand.

Sources for this answer

Online Safety Act: Protection of Children Codes of Practice - explanatory memorandum

Explains Ofcom's Protection of Children Codes of Practice, supporting playbook steps that map child-safety duties to code measures, mitigations, and review evidence.

Children's code strategy: interim impact review

Shows how ICO child-privacy reviews can inform age-appropriate evidence and review triggers in an Online Safety Act risk-assessment playbook.

UK Government - Online Safety Act explainer

Confirms the Act's overall platform duties, supporting the playbook's scope triage before code mapping and mitigation assignment.

Section 2

What fields should the Risk Assessments Playbook template capture?

A useful template captures service type, user group, risk type, child-access result, code measure, mitigation owner, evidence, review date, and unresolved assumptions.

Source URL and source quote.
Entity, product, service, system, data category, and user group.
Decision result, control action, owner, reviewer, due date, and escalation reason.
Evidence attachment, approval note, exception note, and review cadence.

Sources for this answer

Children's code strategy: interim impact review

Template field support for Risk Assessments Playbook.

UK Government - Online Safety Act explainer

Template field support for Risk Assessments Playbook.

Online Safety Act - Illegal Content Codes of Practice 2024: explanatory memorandum

Template field support for Risk Assessments Playbook.

Section 3

How should teams review and improve the Risk Assessments Playbook workflow?

Review the workflow after Ofcom code updates, feature changes, algorithm changes, user-base changes, incident trends, complaints, enforcement notices, or transparency-report cycles.

Track recurring exception categories and update intake questions.
Remove fields that never affect the decision.
Add fields when reviews show missing source evidence or unclear ownership.
Make sure the workflow points teams to the current Ofcom guidance, owner, and review date for each decision.

Sources for this answer

Online Safety Act: Protection of Children Codes of Practice - explanatory memorandum

Review support for Risk Assessments Playbook.

Children's code strategy: interim impact review

Review support for Risk Assessments Playbook.

UK Government - Online Safety Act explainer

Review support for Risk Assessments Playbook.

Online Safety Act - Illegal Content Codes of Practice 2024: explanatory memorandum

Review support for Risk Assessments Playbook.

Recommended next step

Turn UK Online Safety Act Risk Assessments Playbook into assigned work

Use this UK Online Safety Act guide to turn Risk Assessments Playbook into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK Online Safety Act

Turn Risk Assessments Playbook into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK Online Safety Act source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step