Illegal Content Duties Record Keeping Template

Based on illegal-content-duties-record-keeping-template.odt from Ofcom's Online Safety Toolkit outlined in Record-Keeping and Review Guidance.

This template is designed to help user-to-user (‘U2U’) and search service providers to meet their record-keeping duties under the Online Safety Act 2023 (‘the Act’).

This can be used alongside Ofcom's ‘Check how to comply with the illegal content rules’ tool but using it does not guarantee your compliance.

The record-keeping duties set out in the Act (section 23 and 34) require service providers to:

keep written records of your illegal content risk assessment;
keep written records of the measures taken as described in the illegal content Code of Practice to comply with a relevant duty;
keep a written record of any alternative measure taken, where you have not taken a measure recommended under the illegal content Code of Practice (based on the outcome of your illegal content risk assessment).

Full guidance on the record-keeping duties can be found in Ofcom’s Record-Keeping and Review Guidance.

As well as keeping a record, you are responsible for completing a suitable and sufficient risk assessment in line with your duties under the Act. Ofcom’s Risk Assessment Guidance provides full details on what to do.

You can sign up for online safety updates or make an enquiry via Ofcom’s website. For further support, you may wish to seek specialist or legal advice

General Information

Service name:

Service type:

Completion date:

Next review/update date:

Reason for review:

Completed by:

Named person responsible for the risk assessment:

Approved by (governance and accountability channels):

Step 1: Identify Risks (Search Services)

Activities and outcomes: consult Ofcom’s Risk Profiles and identify the key risk factors which are relevant to your service.

What to include in your record: confirmation that you have consulted Ofcom’s Risk Profiles; a record of any risk factors from the Risk Profiles that are relevant to your service.

Is your service any of the following service types?

General search service (including downstream general search service)

Vertical search service

Do child users access your service?

Yes

Does your service have any of the following functionalities? Tick all that apply.

Provide users with search predictions or suggestions

Allow users to search for photographs, videos or visual images

Record of Risk Factors

Record of risk factors from the Risk Profiles relevant to your service:

Confirm consultation of Ofcom's Risk Profiles (e.g., by recording outcomes of questionnaire or noting relevant factors here).

Step 2: Assess Risks

Activities and outcomes: separately assess the likelihood and impact of each of the 17 kinds of priority illegal content, using all relevant evidence; assess the likelihood and impact of any other illegal content identified; consider service usage, design, operation, and existing controls; assign risk levels (high, medium, low, negligible) for each kind of illegal content based on evidence.

What to include in your record: list of additional characteristics considered; details of existing controls and their impact on risk levels; assigned risk level for each priority illegal content (and sub-categories like CSAM types) and other relevant illegal content, with evidence-based explanation; list of evidence and reasoning for likelihood/impact assessments.

Risk Assessment Record (Priority Illegal Content)

You need to record the risk level you’ve assigned to each of the 17 kinds of priority illegal content and the evidence and considerations for each.

This is a guidance page to illustrate how to make your records for each kind of priority illegal content.

Risk level:
[GUIDANCE: Evaluate the likelihood and impact of each kind of priority illegal content to assign a risk level (high, medium, low, negligible). Consider the relevant evidence to inform this judgement. You may consult the risk level tables found in Ofcom’s Risk Assessment Guidance (this is also covered in Step 2 of our Check how to comply with the illegal content rules)]

Risk factors considered:
[GUIDANCE: List any relevant and specific risk factors which relate to this kind of illegal harm (such as “messaging services”, “child users (under-18s)”, “user groups” etc.) from Ofcom’s Risk Profiles. Our ‘Check how to comply with the illegal content rules’ tool presents the associated kinds of illegal harm for each risk factor you select, or you can consult table 9.1 in the Risk Assessment Guidance.]

Additional characteristics considered:
[GUIDANCE: List any additional characteristics of your service which may be relevant (including user base, business models, functionalities, governance, and systems and processes) you have considered alongside the risk factors identified in Ofcom’s Risk Profiles.]

Existing controls considered:
[GUIDANCE: If you have considered the role of any existing controls already in operation on your service at the time of the risk assessment, you should record what these controls are, what risks they are intended to mitigate and how they do this, and how the consideration of the existing controls has impacted the risk level you have assigned to a kind of illegal content.]

Evidence:
[GUIDANCE: A list of the evidence, and summary of the reasoning, that has informed the assessment of likelihood and impact of this kind of priority illegal content, including any core and enhanced types of evidence.]