Services keep written, easily understandable records of every risk assessment (how it was done and its findings), of code of practice measures applied, and of any alternative measures with how they achieve compliance and respect free expression and privacy, including coverage of each listed area; they review compliance regularly and after significant changes. Ofcom may exempt descriptions of providers. Category 1 services also record user empowerment assessments and send Ofcom copies of assessment records. In force: risk assessment duties from 16 December 2024 (first assessments due by 16 March 2025); safety duties from 17 March 2025, when the first illegal content codes took effect (s.51).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.