This report sets out Ofcom’s analysis of risk assessment records from the first year of the duties being in force and sets out the improvements we expect to see next year.
The duties to complete illegal content risk assessments and children’s risk assessments require providers of in-scope services to properly consider and record risks to UK users and children, and the steps needed to properly mitigate them.
In 2025, we requested and received 104 risk assessment records under our risk assessment enforcement programmes. Our analysis of the records revealed notable issues in the way providers conducted risk assessments and kept records.
This technical document is aimed at helping service providers produce higher quality risk assessments by showcasing examples of good practice and identifying areas for improvement.
The five areas of improvement we highlight are:
- Assess all kinds of illegal and harmful content
- Improve analysis of features, functionalities and other characteristics
- Demonstrate confidence in controls
- Base decisions on relevant evidence
- Implement appropriate risk governance
We will be providing supervised service providers with bespoke feedback on where their risk assessment records have fallen short and, in 2026, will request for relevant providers to send us their illegal content and children’s risk assessment records between 1 May and 31 July. We will take enforcement action where necessary improvements have not been made.