Use one operating playbook to assign assessment inputs, challenge weak evidence, approve mitigations, and reopen decisions when the service changes.
The playbook coordinates the work; it does not merge the Act's separate illegal-content, children's access, and children's risk-assessment duties.
A risk-assessment playbook sets the operating rules around the Part 3 legal assessments: who opens them, which evidence each team supplies, how risks are challenged, who approves controls, and what reopens the record. Use it for every regulated user-to-user and search service, while keeping the illegal-content assessment, children's access assessment, and any children's risk assessment identifiable as separate outputs with their own statutory tests and deadlines.
Intake opens a versioned assessment for a defined service, a new or newly in-scope service, or a proposed . Legal or regulatory owners confirm the applicable duty and deadline; product and engineering describe the design; trust and safety supplies harm and enforcement evidence; data teams quantify prevalence, reach, recommender exposure, search pathways, complaints, and uncertainty; privacy, security, accessibility, and child-safety specialists test proposed controls.
A challenge meeting tests scope, missing evidence, foreseeable misuse, groups at greater risk, design choices that amplify harm, control dependencies, and the residual-risk conclusion. Unsupported conclusions return for more evidence rather than converting uncertainty into a low score.
Approval links each material risk to a current control, owner, delivery date, monitoring signal, and in-force Ofcom code measure or documented effective alternative. The Act sets the binding duty; Ofcom codes describe a compliance route, guidance explains Ofcom's approach, and consultations do not impose current requirements. The accountable owner approves only after urgent actions and launch gates are explicit.
Operations monitors the assumptions. Product change, new harm evidence, control failure, or an Ofcom update creates a review ticket and identifies which assessment versions must be reopened.
Sources (5)
Binding source for the assessment duties, written records, review duties, and service-specific distinctions that the operating playbook must preserve.
Supports the new-service period, pre-change assessment gate, service-specific evidence requirements, and recommended 12-month review cadence.
Explains Ofcom's Protection of Children Codes of Practice, supporting playbook steps that map child-safety duties to code measures, mitigations, and review evidence.
Online Safety Act
Shows how ICO child-privacy reviews can inform age-appropriate evidence and review triggers in an Online Safety Act risk-assessment playbook.
Children's code
Confirms the Act's overall platform duties, supporting the playbook's scope triage before code mapping and mitigation assignment.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Maintain an assessment register with service, assessment type, version, statutory provision, owner, approval date, next scheduled review, event-driven review trigger, significant-change decision, open actions, and evidence location. Within each assessment, keep separate rows for each content or harm pathway and each materially affected user group.
Sources (3)
ICO observations on children's privacy practices in sampled platforms.
Children's code
Government overview of the Online Safety Act.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Official explanation of the illegal-content codes and alternative-measure records.
Online Safety Act
Review the playbook when assessments repeatedly miss the same evidence, actions remain overdue, control tests cannot be reproduced, or product teams bypass the significant-change gate. Review the underlying statutory assessment whenever the Act's accuracy or significant-change trigger is met; an annual calendar alone is not enough.
Sources (4)
Official explanation of the protection-of-children codes.
Online Safety Act
ICO observations on children's privacy practices in sampled platforms.
Children's code
Government overview of the Online Safety Act.
The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online.
Official explanation of the illegal-content codes and alternative-measure records.
Online Safety Act
Use the playbook to assign evidence, challenge conclusions, approve controls, monitor assumptions, and reopen assessments when the service changes.
Assign the assessment inputs, reviewers, control owners, approvals, actions, and review triggers.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Children's code"
"Online Safety Act"
"The Online Safety Act 2023 (the Act) is a new set of laws that protects children and adults online."
"UK GDPR and the DPA 2018"
"Online Safety Act"
Decide whether children are likely to access a regulated service or part of it, document the evidence, and identify when a children's risk assessment follows.
Route and decide Online Safety Act complaints, record the required response, and distinguish an internal review from an Ofcom complaint or super-complaint.
Assess illegal-content risks by offence kind, likelihood, severity, affected users, service design, controls, evidence, and review triggers.
Decide whether an online service is a regulated user-to-user service, search service, combined service, or exempt service under the UK Online Safety Act.
Compare age verification and age estimation methods by assurance, privacy, accessibility, bias, evasion risk, and operational evidence.
When Online Safety Act services need age assurance, what highly effective age assurance means, and how safety duties interact with data protection.
Choose an age-assurance method for an Online Safety Act duty by testing effectiveness, privacy, accessibility, evasion risk, and the consequence of error.
Test whether a service is covered by the UK Online Safety Act by checking service functionality, UK links, exemptions, and the duties that follow.
Apply the UK Online Safety Act Category 1, 2A, and 2B thresholds, calculate active UK users, and use Ofcom's register first published in June 2026 and most recently updated in September.
Verify UK Online Safety Act scope, assessments, controls, reporting, complaints, records, child safety, and category-specific work.
Apply the UK Online Safety Act children's access, risk-assessment, safety, age-assurance, reporting, complaints, and record-keeping duties.
Build a UK Online Safety Act compliance program from service scope through assessments, controls, evidence, review, and Ofcom response.
Design UK Online Safety Act moderation, content-reporting, complaints, and review processes for illegal content and content harmful to children.
UK Online Safety Act compliance dates for risk assessments, child safety, categorised services, fees, and event-based deadlines.
How Ofcom investigates Online Safety Act breaches, issues decisions, requires remedies, imposes penalties, and seeks court orders.
Standalone answers and decision paths for UK Online Safety Act scope, risk assessments, child protection, age assurance, categories, reporting, and enforcement.
Apply the Online Safety Act and UK data protection law together for age assurance, moderation, profiling, recommender systems, and safety-data sharing.
Understand the illegal-content risk assessment, safety, reporting, complaints, record-keeping, and review duties for regulated user-to-user and search services.
Build moderation, content-reporting, and complaints procedures for regulated services, and understand where the Online Safety Act does and does not require an appeal.
How Ofcom assesses Online Safety Act concerns, gathers information, investigates suspected breaches, and reaches enforcement decisions.
The Online Safety Act penalty ceiling, qualifying worldwide revenue, daily penalties, penalty factors, and payment consequences.
Understand which user-to-user, search, combined, and provider-pornography services the UK Online Safety Act regulates and which exemptions narrow scope.
See which UK Online Safety Act requirements apply to Part 3 services, child-accessible services, provider pornography, and categorised services.
A field-by-field template for recording service facts, statutory risks, evidence, controls, residual risk, approval, and reassessment triggers.
Run illegal-content and children's risk assessments in the right order, with evidence for risks, controls, governance, and reassessment triggers.
Understand when a named senior manager or corporate officer can face personal liability for Online Safety Act information offences and how to control the risk.
Decide whether a service is regulated, whether it is user-to-user or search, which exemptions apply, and whether Ofcom categorisation adds duties.
Move from UK Online Safety Act service scope to Category 1, 2A, or 2B threshold analysis without confusing categorisation with basic coverage.
Understand who must publish an Online Safety Act transparency report, what an Ofcom notice controls, and how to prepare traceable reporting data.
Compare UK Online Safety Act and EU DSA scope, service classes, child-safety and platform duties, dates, evidence, exemptions, and enforcement.
A practical scope test for user-to-user, search, and provider-pornography services under the UK Online Safety Act, including UK links and exemptions.
How the UK Online Safety Act, UK GDPR, Data Protection Act 2018, and Children's Code apply together to safety technologies and children's data.
Ofcom information notices, investigations, representations, confirmation decisions, penalties, remediation, and court-based service restrictions.
The two-stage UK Online Safety Act children's access assessment, evidence, timing, reassessment triggers, and next duties.
UK Online Safety Act illegal content risk assessment scope, required elements, deadlines, review triggers, records, and resulting safety measures.
Classify user-to-user, search, and combined services under the UK Online Safety Act, apply the UK-links and exemption tests, and identify the next duties.
Who receives Ofcom transparency notices, what Schedule 8 can require, the 2026 notice process, first-report timing, and evidence controls.
How UK Online Safety Act duties shape content moderation, user reporting, complaints, reinstatement, terms, records, and human oversight.
How Category 1, 2A, and 2B thresholds work, how Ofcom categorises services, and what the register updated in September 2026 means.
When section 110 can make a named senior manager liable for an Online Safety Act information offence, the available defences, and the controls to keep.
When UK Online Safety Act services need highly effective age assurance, what Ofcom expects, and how UK data protection law applies.