Protection of children duties under the Online Safety Act

Activities you’ll undertake in this step:

• identify the kinds of content harmful to children that need to be separately assessed, including each kind of primary priority content, each kind of priority content, and any kind(s) of non-designated content that may be relevant to your service
• consult Ofcom’s Children’s Risk Profiles (PDF, 884.07 KB) and identify the risk factors relevant to your service for each kind of content harmful to children

Content harmful to children

The Act lists a number of kinds of ‘content that is harmful to children’, grouped into three categories.
  
‘Primary priority content’, which includes:

• pornographic content, and
• content which encourages, promotes, or provides instructions for:
  • suicide
  • self-harm
  • eating disorders

‘Priority content’, which includes:

• content which is abusive or incites hatred
• abuse and hate content
• bullying content
• violent content
• harmful substances content
• dangerous stunts and challenges content

‘Non-designated content’, which includes types of content that do not fall within the above two categories, and which present a ‘material risk of significant harm to an appreciable number of children in the United Kingdom’.  

The guidance on content harmful to children (PDF, 802 KB) sets out examples of what kinds of content Ofcom considers to be, or not to be, content harmful to children.

You will also need to consider what non-designated content to assess. The Children’s Register of Risks (PDF, 3.66 MB) identifies two kinds of non-designated content: depression content and body stigma content.

Where you provide a user-to-user service and you identify that non-designated content is present on your service then you must notify Ofcom using the following email address: nondesignatedcontent@ofcom.org.uk. Ofcom’s Children’s Risk Assessment Guidance (PDF, 884.07 KB) provides guidance on how to do this.

We have published a list of risk factors – such as features including group messaging and recommender systems - that are most strongly linked to content harmful to children, and identify whether they are relevant to your service. For each risk factor, we explain how it could increase the risk of children encountering content harmful to children. This list of risk factors is called Ofcom's ‘Children's Risk Profiles’.

Once you understand content harmful to children and have a list of risk factors from Ofcom, you will need to assess what this means for your specific service.

You should gather evidence about your service. The Children’s Risk Assessment Guidance and Risk Profiles (PDF, 873 KB) explains how you should go about this. It also includes information about how you might consider children in different age groups on your service.

Based on this information, you should decide how likely it is that children could encounter content harmful to children on your service and what the impact could be.

This will help you decide whether your services is negligible, low, medium or high risk for each kind of content that is harmful to children. The Children’s Risk Assessment guidance provides more information on how to make these judgements.

Activities you’ll undertake in this step:

• separately assess the likelihood and impact of children encountering content harmful to children, using all relevant evidence

For this process, you should:

• consider the different ways your service is used, including ways which are unintended
• identify whether there are any additional characteristics or functionalities of your service’s design or operation, not in the Children’s Risk Profiles, which could increase the risk to children. This includes functionalities that present higher levels of risk such as:
  • content recommender systems,
  • features that enable adults to search and/or contact children,
  • predictive search functionalities, and
  • features and functionalities that affect how much children use the service
• consider the effectiveness of any existing control measures which could impact the level of risk of harm to children
• consult the risk level tables to assign a risk level for each of the four kinds of primary priority content, each of the eight kinds of priority content, and any kind(s) of non-designated content you have identified for assessment
• conclude the assessment of all the risks relating to content harmful to children, including the design and use of the service

Activities you’ll undertake in this step:

• consult Ofcom’s Protection of Children Code for user-to-user services (PDF, 953 KB) and/or Protection of Children Code for search services (PDF, 692 KB) to check which measures are recommended for your service
• decide whether to implement applicable measures to reduce the risk of harm to child users, or use alternative measures
• identify any additional measures that may be appropriate for your service
• implement all relevant measures
• record the outcomes of the children’s risk assessment

One way to meet your duties is to apply the relevant safety measures set out in Ofcom’s Codes of Practice. This includes measures related to content moderation, reporting and complaints, recommender systems, age assurance, and user tools. You must keep a written record of any measures taken or in use as described in Ofcom’s Codes of Practice.

More information about our Codes of Practice and how they relate to the safety duties can be found in the Implementing safety measures section of this page.

You can also decide on your own measures to comply with the safety duties. The Act refers to this as taking ‘alternative measures’. If you choose to take alternative measures rather than implementing the measures recommended for your service in Ofcom’s Codes of Practice, you will need to keep a record of those alternative measures and how they amount to compliance with the safety duties.

We have provided Record-Keeping and Review Guidance (PDF, 238.96 KB) on what your record needs to include.

Activities you’ll undertake in this step:

• report on the children’s risk assessment and measures through appropriate governance and accountability channels – you do not need to share your risk assessment record with Ofcom unless we specifically ask for it or you provide a categorised service
• providers of user-to-user services to notify Ofcom of the kinds and incidence of any non-designated content you have identified as present on your service through your children’s risk assessment
• monitor the effectiveness of safety measures at reducing the risk of harm to users
  monitor developing risks and the level of risk exposure after appropriate measures are implemented (also known as residual risk)
• review and/or update your children’s risk assessment when appropriate, including before making significant change to any aspect of the service’s design or operation

We recommend that you report your children’s risk assessment outcomes and online safety measures to a relevant internal governance body to review. For small services without formal boards or oversight teams, this can simply mean reporting to a senior manager with responsibility for online safety duties for risk of harm to children.

To keep your children’s risk assessment up to date, we recommend reviewing it annually. You also need to review your assessment if Ofcom makes a significant change to the Children’s Risk Profiles. If you are planning to make a significant change to your service, you need to do a new children’s risk assessment before making the change. The Children’s Risk Assessment Guidance and Risk Profiles (PDF, 873 KB) covers this in more detail.

Relevant Category 1 and Category 2A service providers must provide Ofcom with a copy of their children’s risk assessment record as soon as reasonably practicable after making, or revising, such a record. 

Our expectations of when providers should take action 

These additional duties will come into effect upon publication of the register of categorised services, which we anticipate in July 2026.  

We expect providers of Category 1 and 2A services to supply Ofcom with copies of their latest risk assessment record(s) by October 2026, or, if appropriate, to confirm if we already hold an up to date record(s). This allows providers sufficient time (at least 3 months) to ensure their risk assessment(s) are up to date, following publication of the register.  

Reflecting categorisation in updated records 

Risk assessment records should reflect how the register has categorised services as user-to-user services, search services, and combined services (where both the regulated user-to-user service and the public search engine of the combined service each meet the relevant categorisation threshold conditions). Therefore, where a provider is responsible for a combined service, it should risk assess each Category 1 and/ or 2B, and each 2A service separately, as relevant, and reflect this in its record keeping. 

Additionally, for combined services, the additional risk assessment duties will apply only to the relevant user-to-user service of the combined service if it is identified as a Category 1 services and/or to the regulated public search engine if it is identified as a Category 2A service.  

How providers can submit records to Ofcom 

As noted in our Record-Keeping and Review Guidance (261 KB), the record should be sent to Ofcom in electronic format and to an Ofcom email address. Ofcom will contact providers of Category 1 and 2A services to request records and specify where they should be sent. 

Relevant Category 1 and Category 2A service providers must publish a summary of their most recent children’s risk assessment in their terms of service (Category 1) or in a publicly available statement (Category 2A). 

The summary must include the findings of the most recent children’s risk assessment of a service (including as to levels of risk and as to nature, and severity, of potential harm to children). 

Our expectations of the content 

Risk levels

The Act states that summaries of risk assessment findings must include ‘levels of risk’.  

For children’s risk assessments, our Children’s Risk Assessment Guidance and Children’s Risk Profiles (PDF, 84.07 KB) advises providers to assign a risk level for each kind of content harmful to children. In summaries, we therefore expect providers to set out the risk level (negligible, low, medium or high) assigned to: 

• each of the 4 kinds of primary priority content harmful to children;  
• each of the 8 kinds of priority content harmful to children; and 
• any kind(s) of non-designated content, which is content harmful to children that is not primary priority content or priority content, and is of a kind which presents material risk of significant harm to an appreciable number of children in the UK. 

Nature and severity of risk 

The Act also states that summaries of risk assessments must include findings ‘as to nature, and severity’ of potential harm. 

Our Children’s Risk Assessment Guidance recommends that, to make judgements on the nature and severity of harm, providers need to consider: 

• if children on the service have had a materially harmful experience (for example, due to the nature of this kind of content and how children may encounter it on the service); 
• if harm is suffered indirectly by children who are not users of the service and how severe the impact of the harm is likely to be;  
• the potential reach of that kind of content on the service and number of children that could be impacted; and 
• how children might be affected by experiencing this kind of content cumulatively on your service. 

In summaries of risk assessments, we encourage providers to draw on their findings about the above points, and any other information they consider important, to comment on their view of the nature and severity of each harm type on their service. We also encourage providers to explain how these findings about nature and severity have informed the ultimate risk level assigned to each harm type.  

Other important information 

In addition to the above, we encourage providers to summarise any other key aspects of the risk assessment that informed the risk levels assigned to each harm type, based on the key elements our guidance recommends they consider. This includes where the provider’s consideration of the following points is important to understanding the risk level assigned for a particular harm: 

• the separate assessment of the likelihood and impact of a harm, based on evidence (including but not limited to the risk factors identified in Children’s Risk Profiles); 
• the different ways in which the service is used, including ways which are unintended; 
• whether there are any specific characteristics or functionalities of the service’s design or operation, not covered in Ofcom’s Children’s Risk Profiles, which could increase the risk of harm; 
• the effectiveness of any existing control measures which could impact the level of risk of harm to service users. 

Sharing findings in these areas is likely to be important to creating transparency around the provider’s understanding of risk levels on the service.

Our expectations of when providers should take action

These additional duties will come into effect upon publication of the register of categorised services, which we anticipate in July 2026.

We expect providers to publish summaries of the findings of their latest risk assessment(s) by November 2026.

As set out in the 'Provide Ofcom with a copy of the children's risk assessment record’ step above, we expect risk assessments and related records to have been updated by October 2026 to reflect how the register has categorised services as user-to-user services, search services, and combined services. We similarly expect risk assessment summaries published by November 2026 to reflect service categorisation.