Open
Enforcement Programme to monitor if services meet their illegal content risk assessment duties and record keeping duties under the Online Safety Act 2023.
3 March 2025
Ofcom is today opening a programme of work, or ‘enforcement programme’ to monitor whether providers are complying with their illegal content risk assessment duties and record keeping duties under the Online Safety Act (the “Act”).
The main objectives of this programme are to monitor compliance with the relevant duties in the Act, to monitor how our risk assessment guidance and record keeping guidance are being applied by industry and support the adoption of best practice.
Sections 9, 23, 26 and 34 of the Online Safety Act 2023.
On 1 April 2026, Ofcom issued formal information requests to 30 providers, covering 43 services and requesting records of more than 70 risk assessments (illegal content and children’s). Providers have until 31 July to submit their up-to-date risk assessment records to us. We will use the responses we receive to identify gaps in risk assessments and drive improvements.
Further information about these requests can be found here. Further information on the illegal content duties can be found here.
Under this programme we identified compliance concerns about the suitability and sufficiency of Snap’s Illegal Content Risk Assessment (‘ICRA’) for Snapchat. As Snap engaged constructively with Ofcom and demonstrated a willingness to make meaningful change to address our concerns, we offered Snap an opportunity to engage in compliance remediation - a short period of focused engagement, which gives a service provider a final opportunity to address or remedy compliance concerns in lieu of opening a formal investigation.
Having reviewed Snap’s revised ICRA record in respect of Snapchat, submitted to Ofcom on 1 December 2025, we have seen significant and meaningful change to Snap’s assessment of risk on the Snapchat service. As a result, we have decided to close this period of compliance remediation and take no further action at this time.
More information about this period of compliance remediation can be found here.
We have today published a report on the standards of year one online safety risk assessments and the improvements we expect to see in the way providers identify, manage and oversee online safety risks. The report can be found here.
Ofcom has today opened investigations into Kick Online Entertainment S.A, in respect of the service Motherless. This is to investigate its compliance with a statutory information request, and compliance with its illegal content risk assessment duties. The bulletins for each investigation can be found here and here.
User-to-user and search services must carry out an illegal content risk assessment. This is a legal obligation and requires service providers to assess the risks associated with priority offences and other illegal content on their services. Services must also make and keep a written record, in an easily understandable form, of all aspects of every illegal content risk assessment, including details about how the assessment was carried out and its findings.
On 16 December 2024, Ofcom published Risk Assessment Guidance and Risk Profiles to help service providers comply with the illegal content risk assessment duties. This guidance sets out a four-step risk assessment process, to help services comply with the illegal content risk assessment duties. We also published Record Keeping and Review Guidance to assist providers in meeting their record keeping and review duties.
In line with the illegal content risk assessment duties coming into force, we have decided to request records of the illegal content risk assessments from a number of providers of in-scope services. We will use the information services provide to identify possible compliance concerns, and to monitor how our illegal content risk assessment guidance and record keeping guidance are applied by industry.
We expect this programme to run for at least 12 months, during which time we may decide to open separate formal investigations if we have concerns that a service provider may not be meeting its duties under the Act. We will publish updates on progress at relevant points over this period.