Ofcom has announced that it has launched a new enforcement programme to address companies’ non-compliance with their duties to carry out risk assessments under the Online Safety Act 2023 (“OSA”).

Risk assessments are a central feature of the OSA. We have previously commented on the content and nature of illegal content risk assessments and children’s access risk assessments – both of which all services that fall within the scope of the OSA must complete – here and here.

In the case of illegal harms risk assessments – the deadline for which was 16 March 2025 – services are required to follow a four-step process of: (1) understanding the kinds of illegal content that need to be assessed; (2) assessing the risk of harm; (3) deciding on measures to implement to address identified risks and keeping records; and (4) reporting, reviewing and updating the risk assessment.

Services have until 16 April 2025 to complete their children’s access risk assessments which follow a two-step process of: (1) assessing whether children are normally able to access the service; and (2) if so, assessing whether the service has a significant number of UK users who are children, or is of a kind that is likely to attract a significant number of UK users who are children.

Ofcom’s new enforcement programme coincides with the deadline for competing illegal harms risk assessments and will “scrutinise the compliance of sites and apps that may present particular risks of harm from illegal content due to their size or nature”. This might be, for example, because they have a significant number of users in the UK or that there is a particular risk that their users might encounter harmful content. Ofcom has announced that it has written to a number of such providers and requested records of their illegal content risk assessments by 31 March 2025.

Ofcom will assess the risk assessments from these services “to identify possible compliance concerns, and to monitor how [its] illegal content risk assessment guidance and record keeping guidance are applied by the industry”. Ofcom has also put services on notice that if it has concerns that certain services are not meeting their duties under the OSA, it may open separate formal investigations.

Commenting on the new programme, Suzanne Cater, Enforcement Director at Ofcom, stated: “regardless of size or location, all services in scope of the Online Safety Act must carry out a proper illegal harms risk assessment – a vital first step in protecting their users and making their platforms safer by design. We’ve identified a number of online services that may present particular risks of harm to UK users from illegal content – including large platforms as well as smaller sites – and are requiring them to provide their illegal harms risk assessment to us this month. We’re ready to take swift action against any provider who fails to comply”.

The enforcement programme is expected to run for at least the next year, during which Ofcom will publish updates on its progress.

To read more, click here.