United Kingdom: Published Ofcom guidance on record keeping and review

On 16 December 2024, the Office of Communications (Ofcom) published guidance on record keeping and review in accordance with the provisions of the Online Safety Act. The Act stipulates that user-generated content platforms and search service providers are obliged to maintain written records of their risk assessments and the measures they have taken to comply with their online safety obligations. In the event that alternative measures are adopted instead of those outlined in Ofcom's Codes of Practice, it is the responsibility of service providers to document how these alternatives achieve compliance. Furthermore, service providers are required to regularly review compliance, particularly following significant changes to the design or operation of their services. The records must be durable, accessible, clear, and up to date, with previous versions retained for a minimum of 3 years. Providers of Category 1 user-to-user services and Category 2A search services have additional duties, they must submit risk assessments to Ofcom and publicly summarise their findings. This guidance should be read in conjunction with Ofcom’s Codes of Practice and the Guidance on Risk Assessment of Services to ensure compliance with the duties outlined in the Act. Failure to meet these requirements may result in enforcement actions, including fines of up to GBP 18 million or 10% of worldwide revenue, whichever is greater.