Online Safety Act 2023

CHAPTER 3Risk assessments of regulated user-to-user services and regulated search services

98OFCOM’s register of risks, and risk profiles, of Part 3 services

(1)OFCOM must carry out risk assessments to identify and assess the following risks of harm presented by Part 3 services of different kinds—

(a)the risks of harm to individuals in the United Kingdom presented by illegal content present on regulated user-to-user services and by the use of such services for the commission or facilitation of priority offences;

(b)the risk of harm to individuals in the United Kingdom presented by search content of regulated search services that is illegal content;

(c)the risk of harm to children in the United Kingdom, in different age groups, presented by content that is harmful to children.

(2)The risk assessments must, among other things, identify characteristics of different kinds of Part 3 services that are relevant to such risks of harm, and assess the impact of those kinds of characteristics on such risks.

(3)OFCOM—

(a)may combine assessment of any or all of the risks of harm mentioned in subsection (1), or may carry out separate assessments of those risks;

(b)in the case of the risk of harm mentioned in subsection (1)(c), may assess regulated user-to-user services and regulated search services separately or together.

(4)The findings of each risk assessment are to be reflected, as soon as reasonably practicable after completion, in a register of risks of Part 3 services prepared and published by OFCOM.

(5)As soon as reasonably practicable after completing their assessment of a risk of harm mentioned in a particular paragraph of subsection (1), OFCOM must prepare risk profiles for Part 3 services which relate to that risk of harm.

(6)For the purposes of the risk profiles, OFCOM may group Part 3 services together in whichever way they consider appropriate, taking into account—

(a)the characteristics of the services, and

(b)the risk levels and other matters identified in the relevant risk assessment.

(7)OFCOM must publish risk profiles prepared under this section.

(8)OFCOM must from time to time review and revise the risk assessments and risk profiles so as to keep them up to date.

(9)References in this section to Part 3 services—

(a)in the case of a risk assessment or risk profiles which relate only to regulated user-to-user services or to regulated search services, are to be read as references to the kind of service in question;

(b)in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(a), are to be read as references to regulated user-to-user services;

(c)in the case of a risk assessment or risk profiles which relate only to the risk of harm mentioned in subsection (1)(b), are to be read as references to regulated search services.

(10)References in this section to regulated search services include references to the search engine of combined services.

(11)In this section the “characteristics” of a service include its functionalities, user base, business model, governance and other systems and processes.

(12)In this section—

• “content that is harmful to children” has the same meaning as in Part 3 (see section 60);

• “illegal content” has the same meaning as in Part 3 (see section 59);

• “priority offence” has the same meaning as in Part 3 (see section 59).

99OFCOM’s guidance about risk assessments

(1)As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under section 9.

(2)As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under section 26.

(3)As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of Part 3 services in complying with their duties to carry out children’s risk assessments under section 11 or 28.

(4)Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commissioner.

(5)OFCOM must revise guidance under this section from time to time in response to further risk assessments under section 98 or to revisions of the risk profiles.

(6)OFCOM must publish guidance under this section (and any revised or replacement guidance).

(7)If the risk profiles mentioned in subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.

(8)References in this section to regulated search services include references to the search engine of combined services.

(9)In this section—

• “illegality risks” means the risks mentioned in section 98(1)(a);

• “risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b);

• “risk of harm to children” means the risk of harm mentioned in section 98(1)(c);

• “risk profiles” means risk profiles prepared under section 98.