Ofcom is investigating if a large online platform complied with its risk assessment duties before introducing a significant new feature. This is a timely reminder that "safety by design" includes assessing risks before product changes launch.
Ofcom announced a formal investigation about a feature which enables content shared between users to disappear once it has been viewed. It will assess whether the provider carried out suitable and sufficient illegal content and children's risk assessments before launching the feature.
It is important to stress that this is an investigation, not a finding of non-compliance. Ofcom will gather and analyse evidence and, if it considers that a compliance failure has occurred, must issue a provisional decision and give the provider an opportunity to respond before reaching a final decision.
Why does this matter?
Risk assessments are required under the Online Safety Act 2023. Providers within scope must assess and mitigate the risk of UK users encountering illegal content. Services likely to be accessed by children also have duties relating to the risks of children encountering certain types of legal but harmful content. However, this does not mean that the compliance teams of in-scope platforms can sit back once they have completed their initial risk assessments.
Platforms must update their risk assessments before making a significant change to the design or operation of their service. Earlier in 2026, Ofcom warned major platforms that they could face enforcement action if they failed to assess the risks associated with significant changes before deploying them. The new investigation indicates that Ofcom is prepared to act on those warnings.
Ofcom describes this as an important part of "safety by design". Its enforcement director used the analogy of a new car: just as a manufacturer would not launch a car without properly testing it, online services should not introduce significant features without first assessing their potential safety implications.
Product development is becoming an online safety issue
This has potentially important consequences for the way technology businesses develop their products.
Online safety compliance cannot simply sit with a legal or regulatory team undertaking periodic compliance exercises. Where changes to functionality may amount to a significant change to the service, risk assessment needs to be factored into the product development and release process itself.
Before a new feature is released, businesses will need to consider not only what the feature does commercially, but whether it changes the ways in which users can interact, create or encounter content and to what extent that affects existing assessments of illegal content or child-safety risks.
Consequently, new features involving messaging, sharing, disappearing content, recommendation systems, user interaction or other changes in how content is generated or encountered will require careful consideration under the risk assessment obligations before adoption. Providers need an effective process for identifying when proposed changes trigger a requirement to revisit their risk assessments.
What should providers be doing?
If a platform comes within the scope of the Online Safety Act, the investigation is a good prompt for you to look at internal product-governance arrangements and consider if:
- online safety is embedded sufficiently early in product development, rather than reviewed shortly before or after launch;
- there is a clear process for identifying whether a proposed product or functionality change is sufficiently significant to require a fresh or updated risk assessment;
- responsibility for making that decision is clearly allocated within the business;
- product teams know when and how to involve legal, compliance and trust and safety colleagues;
- illegal content and, where relevant, children's risk assessments are updated before significant changes are deployed; and
- there is an appropriate documentary record of the assessment and the decisions taken as a result.
Documentation may prove particularly important. If Ofcom subsequently asks how a provider evaluated the safety implications of a new feature, being able to demonstrate the process followed, the risks considered, and any mitigations adopted may be just as important as showing that a risk assessment document exists. Don't launch first and assess later.
