Ofcom launches milestone OSA enforcement program

Ofcom has today launched an enforcement program under the Online Safety Act (OSA) to 'monitor whether providers are complying with their illegal content risk assessment duties and record keeping duties under the Online Safety Act'. The requirement to conduct an illegal harms risk assessment came into force on 16th December 2024 and assessments must be completed by all in-scope providers by 16th March 2025. See our Illegal Harms explainer article for more information.

In announcing its new enforcement program, Ofcom has confirmed that it has asked the providers of a number of large services, as well as the providers of some higher risk smaller services, to submit copies of their risk assessments by 31st March. This approach aligns with Ofcom's focus on scrutinising the services that present ‘particular risks of harm from illegal content due to their size or nature’. 

If these service providers fail to provide Ofcom with a satisfactory response by its prescribed deadline, Ofcom has made it clear that they risk enforcement action and that it will not hesitate to open investigations, where it considers this necessary. Ofcom has further stated that it intends to use the responses it receives from these providers to identify gaps in risk assessments, drive improvements in the completion of these compliance documents and to further its policy work in developing new measures under its OSA codes of practice.

This is the second enforcement program initiated by Ofcom under the OSA. In January, it launched its enforcement program relating to the requirement for providers of pornography services to implement highly effective age assurance measures to keep minors off their platforms. This earlier program involves Ofcom writing to these services to remind them of their duties and to request confirmation that they are implementing appropriate age verification mechanisms.

With enforcement programs now kicking off, and no doubt more to follow in the coming months, we may start to see some early OSA enforcement action from Ofcom. However, the regulator seems to be giving some indications that it may allow a form of grace period before action is taken (perhaps with an exception for very serious breaches), so we may not see much happening before Autumn of this year. Watch this space!