Online Safety Act: Ofcom launches enforcement programme for illegal harms risk assessments

On 3 March 2025, Ofcom launched an enforcement programme to monitor if services are complying with their illegal content risk assessment duties and record keeping duties under the Online Safety Act 2023 (“the OSA”).

The illegal harms duties under the OSA came into force on 16 December 2024 when Ofcom published its illegal harms codes of practice and guidance. From that date, in-scope online service providers had three months to carry out a “suitable and sufficient” illegal content risk assessment. Therefore, services have until 16 March 2025 to complete their illegal harms risk assessment. Providers are also required to make and keep a written record of their risk assessment, including details about how it was carried out and its findings.

In advance of this deadline, Ofcom has issued formal information requests to a number of service providers requiring them to submit their records of their illegal harms risk assessment to Ofcom by 31 March 2025. The Ofcom press release states that the online services that have received these formal information requests include “the largest social media platforms, as well as smaller but risky sites.”

Failure to comply with the information request could result in significant penalties – fines of up to 10% of turnover or £18m, whichever is greater - and Ofcom states that if any platform does not provide a satisfactory response by the deadline it “will not hesitate to open investigations into individual service providers”.

Ofcom states that the objective of the enforcement programme is to monitor whether providers are complying with their illegal content risk assessment duties and record keeping duties under the OSA, identify possible compliance concerns, to monitor how Ofcom’s risk assessment guidance and record keeping guidance are being applied by industry and support the adoption of best practice.

The programme is expected to run for at least 12 months, during which Ofcom may decide to open separate formal investigations if there are concerns that a service provider is not meeting its duties under the OSA.

If you are keen to find out more about how to best prepare for the OSA, please contact one of the CMS team.

Co-authored by Florentina Terholli, Associate at CMS.