Ofcom has published a statement introducing new priority offences under the Online Safety Act (OSA), setting out fresh guidance for tech companies on reviewing their Illegal Content Risk Assessments (ICRAs) and updating their compliance frameworks. Regulated providers should treat this as a call to action: existing risk assessments, content moderation policies, and compliance positions all need to be revisited in light of these changes.
What’s Changed
In December 2025, the Government reclassified two offences as “priority offences” under the OSA, a status that carries specific compliance duties for regulated providers:
- Encouraging or assisting serious self-harm; and
- Cyberflashing
Both were previously treated as non-priority offences. Now, Ofcom has merged encouraging or assisting suicide with encouraging or assisting serious self-harm into one combined category, and made cyberflashing its own separate category.
Suicide and Self-Harm: a combined harm category
Ofcom has folded the existing offence of encouraging or assisting suicide together with the new serious self-harm offence into a single harm category: “suicide and self-harm.” The Risk Assessment Guidance and Illegal Content Codes of Practice have been updated accordingly.
In practice, this means providers must now:
- Assess the risk of both suicide and self-harm together and assign one overall risk rating for the combined category;
- Apply existing measures designed for such content; and
- Account for the practical differences in how these two harms actually present online, even though they now sit under one regulatory umbrella.
Ofcom has also refreshed the User-to-User Risk Profile with new risk factors tied to suicide and self-harm, added a self-harm reference to the Search Risk Profile, and expanded the Register of Risks with additional evidence on how these harms manifest online.
Cyberflashing: A New Standalone Category
Cyberflashing is now its own distinct illegal harm category. The underlying offence covers intentionally sending an image or video of genitals in order to cause alarm, distress, or humiliation or for sexual gratification, including where the sender was reckless as to whether alarm, distress, or humiliation would result. Providers now need to separately assess risks of cyberflashing and assign a risk level for this harm
What This Means for In-Scope Providers
These changes qualify as “significant changes” under the OSA, which triggers a specific legal obligation: providers must review and update their ICRAs to capture the risks posed by these newly categorised harms. Ofcom has said it expects providers to act as soon as practicable following its statement.
Looking Ahead
The updated Risk Assessment Guidance, Risk Profiles, Register of Risks, ICJG, and Record-Keeping and Review Guidance are already in force. The Codes still need to go through parliament before those changes kick in.
There’s more coming too. Ofcom says it plans to publish decisions on user control measures and additional safety measures sometime in autumn 2026. On top of that, the Crime and Policing Act 2026 brings in a batch of new offences and priority offences, and Ofcom is currently working out how to respond. Expect more updates as this all develops.
If you need help assessing how this affects your compliance, we’d be happy to help.
Image by magnific on Freepik/Magnific — https://www.magnific.com/author/magnific
