Children's Risk Assessments: What Platforms Must Assess and Publish
What the Online Safety Act requires platforms to assess and publish about the risks their services pose to children — and how this is enforced by Ofcom.
Any service that is likely to be accessed by children must carry out a children's risk assessment under the Online Safety Act. This is a formal, documented analysis of the risks the service poses to under-18 users, and it must drive the safety measures the platform implements. Ofcom can inspect these assessments and take enforcement action where they are inadequate or where a platform fails to act on its own findings.
Who must carry out a children's risk assessment?
Any service that is 'likely to be accessed by children' has this duty. Ofcom assesses likelihood based on factors such as: whether the service is aimed at children; whether it uses animated or cartoon content that appeals to children; whether children's accounts are common even if the service is nominally adult; and whether the service is widely discussed in children's peer groups. Platforms cannot simply assert they are an adult service and ignore the duty — Ofcom looks at the reality of who uses the service.
Key takeaway: If children are likely to use a service in practice, the risk assessment duty applies — regardless of the platform's stated age limit.
What a children's risk assessment must cover
The assessment must identify: the kinds of content that could harm children on the service (from illegal CSAM to harmful-but-legal content like self-harm promotion); the design features that could increase risk (such as recommendation algorithms, direct messaging, and live streaming); the likelihood that children will encounter harm; and the potential severity of that harm. The assessment must be honest and thorough — a superficial or aspirational assessment that does not acknowledge real risks would fail Ofcom's scrutiny.
Key takeaway: Risk assessments must reflect the real risks on the platform, not just the risks the platform wishes existed.
Safety measures must follow from assessments
A risk assessment is not a box-ticking exercise — it must lead to concrete safety measures. If an assessment identifies that the recommendation algorithm promotes harmful content to under-18s, the platform must take steps to change that algorithm or restrict its use for children. If it identifies that children can encounter strangers in direct messages, the platform must apply appropriate messaging restrictions for under-18 accounts. Ofcom can investigate whether safety measures are proportionate to identified risks.
Key takeaway: Identifying a risk in an assessment creates a legal obligation to address it — the assessment and the safety measures must align.
Transparency: what must be published?
Category 1 and Category 2A platforms must publish a summary of their children's risk assessment and the safety measures they have implemented, in a form accessible to users. This means parents and researchers can see — at least in outline — what risks platforms acknowledge and what steps they claim to be taking. If a platform's published summary significantly understates the risks identified in its internal assessment, that is a potential compliance failure.
Key takeaway: Large platforms must publish their risk assessment summaries — parents and advocates can scrutinise these.
How Ofcom enforces the assessment duty
Ofcom can require platforms to produce their risk assessments as part of an investigation. If an assessment is inadequate — for example, if it fails to acknowledge obvious risks or is not kept up to date — Ofcom can take enforcement action. Ofcom has also published a Children's Safety Code setting out in detail what it expects platforms to do. Compliance with the Code creates a presumption that a platform is meeting its children's safety duties.
Key takeaway: Ofcom's Children's Safety Code is the practical standard — platforms that follow it are in a strong compliance position.
What the Act does
Requires any service likely to be accessed by children to carry out a children's risk assessment.
Obliges platforms to implement safety measures proportionate to the risks identified in the assessment.
Requires large platforms to publish a summary of their risk assessment and safety measures.
Gives Ofcom power to inspect assessments and take enforcement action if they are inadequate.
What the Act does not do
Understanding the limits of the Act helps you set realistic expectations when using complaint and reporting processes.
Require all services to publish their full internal risk assessment — summaries are required for large platforms.
Prescribe a single methodology for risk assessment — Ofcom's code sets the expectations but allows for proportionality.
Mean that once a risk is identified, it must be eliminated entirely — proportionate reduction of risk is the standard.
Practical steps
Check whether platforms your child uses have published a children's safety risk assessment summary — it is required from large platforms.
If you believe a platform is seriously underestimating the risks it poses to children, document your evidence and submit it to Ofcom.
Use published risk assessment summaries to have informed conversations with your child about the specific risks their favourite platforms acknowledge.
Schools and children's charities can request platform transparency reports and safety summaries as part of due diligence.
Frequently asked questions
Can parents see a platform's children's risk assessment?
For Category 1 and Category 2A platforms, a summary must be publicly available. The full internal assessment is confidential business information, but Ofcom can require its production. If you cannot find a platform's children's safety summary, you can ask the platform directly or check Ofcom's transparency register.
How often must risk assessments be updated?
Platforms must keep assessments up to date when there are material changes to their service — new features, significant changes to their user base, or significant changes in the risk landscape (such as new technologies creating new risks). There is no fixed annual review requirement, but an assessment that has not been updated in several years would likely fail Ofcom scrutiny.
Sources and further reading
Related guides
Last reviewed: 19 April 2026
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Was this page helpful?