How long does a small-forum risk assessment need to be?

There is no fixed length. It should be proportionate to your size and risk — a few clear pages is often enough for a small, low-risk community, as long as it genuinely reflects your forum.

Do I need to do it before I have any problems?

Yes — the assessment is a preparatory duty, done in advance and kept up to date, not something you write only after an incident.

Guides

Online Safety Act risk assessment for a small forum

If you run a forum or community where members post to each other, you are almost certainly a user-to-user service — and the illegal-content risk assessment is your central duty. It is a written exercise: identify how illegal content could appear on your forum, judge how likely and how serious that is, and record what you do about it.

The good news for a small forum: the assessment is meant to be proportionate. You are not expected to build a moderation department. You are expected to have thought it through and written it down.

What a proportionate risk assessment covers

Ofcom frames the assessment around the kinds of illegal content the Act lists (for example fraud, threats, harassment, or content harmful to children) and how your service’s features could allow them — open sign-up, anonymous posting, private messages, image uploads, and so on.

For each, you note the risk level and the measures you already take or plan to take: reporting tools, moderation, terms that ban illegal content, and how you act on reports. The output is a short document you keep and can show if asked.

Keeping it light but defensible

A small, low-risk forum can often capture this in a few pages. The point is that it is honest, specific to your forum, and revisited when something material changes — a surge in members, a new feature, or a new type of problem content.

Record-keeping is a duty in its own right: keep the assessment and the record of your measures so your position is demonstrable over time.

Not sure if this applies to you?

Run the free scope checker — seven questions, about three minutes, a cited verdict at the end.

Check my service

Frequently asked

How long does a small-forum risk assessment need to be?: There is no fixed length. It should be proportionate to your size and risk — a few clear pages is often enough for a small, low-risk community, as long as it genuinely reflects your forum.
Do I need to do it before I have any problems?: Yes — the assessment is a preparatory duty, done in advance and kept up to date, not something you write only after an incident.

Sources

General guidance to help you prepare records — not legal advice, and following it does not make you “compliant”.

More guides

Want a tool that walks you through these duties when we build it?

Reserve the £15/month founding price →