EveryAILaw.comDoes UK Online Safety Act 2023 require Risk Assessment?
United Kingdom • phased enforcement
Yes — 2 provisions
Requirements at a glance
This regulation imposes 9 specific requirements for Risk Assessment across 2 provisions:
- Illegal content risk assessment — Assess risks of AI systems generating or amplifying illegal content
- Children's risk assessment — Assess risks of AI-generated content reaching children
- Mitigation measures — Implement proportionate measures to mitigate identified risks
- Illegal content risk assessment — Suitable and sufficient assessment of the risk of users encountering priority and other illegal content in search content, taking into account risks presented by the service's algorithms and by how it indexes, organises and presents results (s.26(2), (5)(a))
- Children's risk assessment — Where the service is likely to be accessed by children, a further assessment covering primary priority, priority and non-designated content harmful to children, with separate consideration by age group and explicit assessment of predictive search functionality (s.28(2), (5)(a), (5)(c))
- Keep assessments current — Duty to keep each assessment up to date, including when Ofcom significantly changes an applicable risk profile (ss.26(3), 28(3))
- Reassess before significant change — Further assessment before any significant change to the design or operation of the service, covering the impacts of that change (ss.26(4), 28(4))
- Assessment timing — Assessments carried out at the times set out in Schedule 3
- Records — Records of risk assessments kept under s.34(2) and (9)
Risk Assessment for AI Systems #
Part 3 Chapter 2 duties, covering user-to-user services only; the parallel search-service duties sit in Chapter 3 (ss.26, 28) and are tracked separately. Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(c), (d)), but Ofcom compliance deadlines fell later — illegal-harms risk assessments due 16 Mar 2025, children's risk assessments due 24 Jul 2025.
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Assess risks of AI systems generating or amplifying illegal content |
| Children's risk assessment | Assess risks of AI-generated content reaching children |
| Mitigation measures | Implement proportionate measures to mitigate identified risks |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Up to GBP 18M or 10% global turnover |
Sources: Online Safety Act 2023
Risk Assessment for Search Services #
Part 3 Chapter 3 mirrors the Chapter 2 user-to-user duties for search services, but the assessed risks are search-specific: s.26(5)(a) requires risks presented by the service's algorithms and by the way it indexes, organises and presents search results, and s.28(5)(c) names predictive search functionality explicitly. That makes these the duties that bite on AI-driven ranking and AI-generated search summaries. Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(j)).
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Suitable and sufficient assessment of the risk of users encountering priority and other illegal content in search content, taking into account risks presented by the service's algorithms and by how it indexes, organises and presents results (s.26(2), (5)(a)) |
| Children's risk assessment | Where the service is likely to be accessed by children, a further assessment covering primary priority, priority and non-designated content harmful to children, with separate consideration by age group and explicit assessment of predictive search functionality (s.28(2), (5)(a), (5)(c)) |
| Keep assessments current | Duty to keep each assessment up to date, including when Ofcom significantly changes an applicable risk profile (ss.26(3), 28(3)) |
| Reassess before significant change | Further assessment before any significant change to the design or operation of the service, covering the impacts of that change (ss.26(4), 28(4)) |
| Assessment timing | Assessments carried out at the times set out in Schedule 3 |
| Records | Records of risk assessments kept under s.34(2) and (9) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Greater of GBP 18M or 10% of qualifying worldwide revenue (Sch. 13 para. 4) |