Online Safety Act 2023 (c. 50) – Section 99 – OFCOM’s guidance about risk assessments
(1) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the illegality risks, OFCOM must produce guidance to assist providers of regulated user-to-user services in complying with their duties to carry out illegal content risk assessments under
section 9.
(2) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm from illegal content, OFCOM must produce guidance to assist providers of regulated search services in complying with their duties to carry out illegal content risk assessments under
section 26.
(3) As soon as reasonably practicable after OFCOM have published the first risk profiles relating to the risk of harm to children, OFCOM must produce guidance to assist providers of
Part 3 services in complying with their duties to carry out children’s risk assessments under
section 11 or
28.
(4) Before producing any guidance under this section (including revised or replacement guidance), OFCOM must consult the Information Commissioner.
(5) OFCOM must revise guidance under this section from time to time in response to further risk assessments under
section 98 or to revisions of the risk profiles.
(6) OFCOM must publish guidance under this section (and any revised or replacement guidance).
(7) If the risk profiles mentioned in
subsection (3) relate to regulated user-to-user services only or to regulated search services only, that subsection is to be read as requiring the production of guidance relating only to regulated user-to-user services or to regulated search services, as the case may be.
(8) References in this section to regulated search services include references to the search engine of combined services.
(9) In this section—
“illegality risks” means the risks mentioned in section 98(1)(a); “risk of harm from illegal content” means the risk of harm mentioned in section 98(1)(b); “risk of harm to children” means the risk of harm mentioned in section 98(1)(c); “risk profiles” means risk profiles prepared under section 98.
Amendment in force, not yet in the text
The following amendment(s) to this Section are now in force, but legislation.gov.uk had not incorporated them in the text in force on 19 September 2026 that this page reproduces, so the text above does not yet show them:
- s. 99(4): words substituted by S.I. 2026/386, Sch. 2, para. 26(1), para. 26(2)(f) (comes into force when 2025 c. 18, s. 119 is fully brought into force); commencement: reg. 1(2)
Note: S.I. 2026/386 came into force on 30 September 2026 (reg. 1(2)), when section 119 of the Data (Use and Access) Act 2025 was fully brought into force by S.I. 2026/1015, reg. 2.
