Our client is a large multinational online service provider, offering services to users in the UK and regulated under the Online Safety Act 2023.
Ofcom's enforcement of the Online Safety Act gathered pace in 2025, with regulated services required to complete Illegal Content Risk Assessments (’ICRA’) — a form of regulatory engagement unlike anything most service providers have encountered before. ICRAs are legally required to be "suitable and sufficient" and form the foundation for Ofcom's decisions on what additional compliance measures a provider must put in place. The stakes are high: penalties for non-compliance can reach 10% of qualifying worldwide revenue or £18 million, whichever is greater, and Ofcom can seek court orders to block services from being accessed in the UK entirely.
The client commissioned AWO to support the drafting and review of their Illegal Content Risk Assessment, and to advise on the particularly sensitive issue of end-to-end encryption on their service.
-
Illegal content risk assessment
AWO reviewed the client's draft ICRA against extensive Ofcom guidance, identifying areas for improvement and advising on where and how "enhanced evidence" from outside the service could and could not be used to strengthen the assessment.
-
Defending encryption
While Ofcom treats end-to-end encryption as an illegal content risk factor, AWO helped the client articulate a robust justification for its use — protecting a privacy-preserving feature that is vital to users without compromising the integrity of the ICRA.
-
Regulator engagement
AWO assisted the client in meeting with Ofcom to present and defend their finalised ICRA, and to gather and interpret the regulator's feedback. The result was minimal ICRA feedback and no requests for changes to the client's existing illegal content risk mitigation measures.
AWO is one of relatively few firms with hands-on experience advising clients on practical OSA compliance while protecting the highest standards of user privacy. To discuss OSA compliance, contact Alex Lawrence-Archer.