EveryAILaw.comDoes UK Online Safety Act 2023 require Risk Assessment?
United Kingdom • phased enforcement
Yes — 2 provisions
Requirements at a glance
This regulation imposes 9 specific requirements for Risk Assessment across 2 provisions:
- Illegal content risk assessment — Carry out a suitable and sufficient assessment of risks of users encountering priority or other illegal content, considering service algorithms and dissemination; keep it current and reassess before significant service changes (s. 9).
- Children's risk assessment — If the service is likely to be accessed by children, assess the statutory categories of harmful content and relevant design or algorithmic risk factors; keep the assessment current and reassess before significant service changes (s. 11).
- Assessment record — Make and keep the required written record of each risk assessment (s. 23(2)). Safety mitigation duties are separately in ss. 10 and 12.
- Illegal content risk assessment — Suitable and sufficient assessment of the risk of users encountering priority and other illegal content in search content, taking into account risks presented by the service's algorithms and by how it indexes, organises and presents results (s.26(2), (5)(a))
- Children's risk assessment — Where the service is likely to be accessed by children, a further assessment covering primary priority, priority and non-designated content harmful to children, with separate consideration by age group and explicit assessment of predictive search functionality (s.28(2), (5)(a), (5)(c))
- Keep assessments current — Duty to keep each assessment up to date, including when Ofcom significantly changes an applicable risk profile (ss.26(3), 28(3))
- Reassess before significant change — Further assessment before any significant change to the design or operation of the service, covering the impacts of that change (ss.26(4), 28(4))
- Assessment timing — Assessments carried out at the times set out in Schedule 3
- Records — Records of risk assessments kept under s.34(2) and (9)
Risk Assessment for AI Systems
Part 3 Chapter 2 duties cover regulated user-to-user services, regardless of whether AI generated the content. The parallel search-service duties sit in Chapter 3 (ss. 26, 28). Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(c), (d)); Ofcom compliance deadlines fell later.
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Carry out a suitable and sufficient assessment of risks of users encountering priority or other illegal content, considering service algorithms and dissemination; keep it current and reassess before significant service changes (s. 9). |
| Children's risk assessment | If the service is likely to be accessed by children, assess the statutory categories of harmful content and relevant design or algorithmic risk factors; keep the assessment current and reassess before significant service changes (s. 11). |
| Assessment record | Make and keep the required written record of each risk assessment (s. 23(2)). Safety mitigation duties are separately in ss. 10 and 12. |
Penalties
| Violation | Fine |
|---|---|
| Applicable regulated-service breach | Sch. 13 para. 4 sets the applicable maximum at the greater of GBP 18M or 10% of qualifying worldwide revenue, subject to its qualifications. |
Sources: Online Safety Act 2023
Risk Assessment for Search Services
Part 3 Chapter 3 covers search-specific risks: s. 26(5)(a) names algorithms, indexing, organisation and presentation of results, and s. 28(5)(c) names predictive search functionality. These are functionality factors, not an AI-origin trigger. Both sections commenced 10 Jan 2024 (S.I. 2023/1420, reg. 2(j)).
Requirements
| Requirement | Details |
|---|---|
| Illegal content risk assessment | Suitable and sufficient assessment of the risk of users encountering priority and other illegal content in search content, taking into account risks presented by the service's algorithms and by how it indexes, organises and presents results (s.26(2), (5)(a)) |
| Children's risk assessment | Where the service is likely to be accessed by children, a further assessment covering primary priority, priority and non-designated content harmful to children, with separate consideration by age group and explicit assessment of predictive search functionality (s.28(2), (5)(a), (5)(c)) |
| Keep assessments current | Duty to keep each assessment up to date, including when Ofcom significantly changes an applicable risk profile (ss.26(3), 28(3)) |
| Reassess before significant change | Further assessment before any significant change to the design or operation of the service, covering the impacts of that change (ss.26(4), 28(4)) |
| Assessment timing | Assessments carried out at the times set out in Schedule 3 |
| Records | Records of risk assessments kept under s.34(2) and (9) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Greater of GBP 18M or 10% of qualifying worldwide revenue (Sch. 13 para. 4) |