Ofcom has published its plan of work for the coming year.  Many of our readers will be particularly interested in its plans for regulating the Online Safety Bill, which continues to pass through the parliamentary process.

Ofcom says that it is preparing to implement the regime as swiftly as possible once its statutory powers come into force. It says that it will consult on the regulatory architecture, including the codes of practice and guidance relating to elements of the regime concerning illegal content (including some of the most serious harms to children, such as images of child abuse) and the protection of children from legal but harmful content. The precise timing of these consultations will depend on when the Online Safety Bill becomes law.

In addition, Ofcom says that it will engage with online services within scope of the new regime.  It plans to identify an initial set of high-risk or high-impact services that it wishes to engage with. It says that it will be using its information gathering powers to set clear expectations of the nature of its engagement with these services and to understand their assessment and mitigation of risks faced by users of their services. It will also develop relationships with, and build its understanding of, the diverse range of services covered by the online safety regime. In addition, it will look to develop tools to promote compliance with the online safety regime.

Ofcom also plans to develop its operational effectiveness. The new online safety regime represents a significant expansion of Ofcom’s duties. It will build the evidence base around online harms and options for addressing them. It also plans to work with UK regulators, especially via the Digital Regulation Cooperation Forum.  In addition, it will work with overseas regulators and policymakers implementing, or considering, similar regimes, including through the newly launched Global Online Safety Regulators Network. This aims to drive alignment and reduce regulatory burdens where possible and improve the effectiveness and efficiency of regulation.

Ofcom has also, separately, published a discussion document about its approach to risk assessments under the Online Safety Bill. As currently drafted, the Bill will require all regulated firms to do a risk assessment of illegal content that may appear on their service, ranging from online fraud to terrorism. Services that are likely to be accessed by children will also have to do a risk assessment concerning content which is harmful to children. This is likely to include material such as pornography and content which promotes eating disorders. Ofcom will be required to provide guidance on how to do risk assessments and proposes a four-step approach:

• Establish the context: establish the risks of harm that need to be assessed. Consult the risk profiles produced by Ofcom, which set out its assessment of key risk factors, and identify any gaps in your understanding and evidence.
• Assess the risks: review evidence about your platform and your risks. Assess the likelihood of harmful content appearing and the severity/impact of harm. In addition, evaluate existing mitigating measures.
• Decide measures and implement: decide how you will comply with the safety duties, including through Ofcom's Codes of Practice. Identify measures you need to implement. Record the outcomes of the risk assessment. Implement any new measures.
• Report, review and update: report via relevant governance structures. Monitor the effectiveness of your mitigation measures. Put in place regular review periods for your assessments, recognising any triggers to revisit assessments between these periods.

Given the fact that many businesses will also be subject to the EU’s Digital Services Act and other similar legislation worldwide, it is reassuring that Ofcom is aware of these other regulatory requirements and is working with other regulators overseas to enhance international coherence around risk assessments for online safety. As mentioned above, Ofcom will consult on its guidance once the OSB comes into force.

It is probably an understatement to say that businesses affected by the OSB currently face some uncertainty about exactly what they will be required to do.  Hopefully, Ofcom’s guidance and consultations will ultimately clarify what some of these duties mean in practice.

For more information about the OSB, see our client guide.