Every regulated user-to-user service must carry out a suitable and sufficient illegal content risk assessment at the time set by Schedule 3, keep it current (including when Ofcom significantly changes its risk profiles) and repeat it before any significant design or operational change. It covers the user base; the risk of users encountering each kind of priority illegal content (terrorism, CSEA and the Schedule 7 priority offences, each assessed separately) and other illegal content, taking account of algorithms and how fast and widely content spreads; the risk of the service being used to commit or facilitate a priority offence; higher-risk functionalities; patterns of use; the nature and severity of harm; and how design, business model, governance, proactive technology and media literacy measures raise or lower risk. Category 1 services also summarise the findings in their terms of service (s.10(9)). In force: risk assessment duties from 16 December 2024 (first assessments due by 16 March 2025); safety duties from 17 March 2025, when the first illegal content codes took effect (s.51).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.