INT2: Three - Industry Knowledge

Question 1

How do you keep on top of the news in your sector?

Answer 1

1. News
   — Biweekly ‘Everything in Moderation’ Newsletter
   — Monitoring articles on Online Safety, notable coverage recently including The Spectator (Gab), Guardian (U.S foreign policy) and NYT (com groups)
2. Podcasts
   — OII
   — Deloitte Regulated Radio
   — Safety is Sexy
3. LinkedIn Influencers
   — Jeff Dunn
   — Ruby Y
4. Technology Policy Organisations
   — DRCF publications
   — TechPolicyUK

Question 2

What are Ofcom’s current Enforcement programmes?

Answer 2

Ofcom’s regime is oriented around ensuring implementation of its recommended measures for reducing risks. All Enforcement programmes center on this: assessing whether services have effectively complied with duties to implement specific measures.

(i) FSS implementation of measures to address risks of CSAM
— Assessing risks of CSAM on FSS, SBRs
— Inadequate measures to prevent risk of illegal CSAM proliferation; particular measures required such as hash matching

(ii) Services compliance with measures to conduct RA and following associated record-keeping duties
— Currently reviewing RFI returns for quality of evidence and judgement (assessing risk in terms of severity and likelihood)
— Enforcement action recently announced into a suicide forum

(Iii) To assess Part 5 Services’ implementation of HEAA Standards to prevent children from encountering pornographic content

Upcoming Enft for additional priorities… can’t disclose, but known.

Question 3

What would you advise a service on how to comply effectively with the far-ranging obligations in OSA?

Answer 3

1. Get the basics right: 3 phases
   — Focus on the phased deliverables
2. Focus on Ofcom’s priorities
   — Focus on Ofcom’s 8 x priorities: Governance/Accountability (suitable/sufficient RAs, nominating accountable individuals), ConMod for illegal content, CSAM/Grooming, Hate Terror, VAWG, Fraud, PoC (incl. HEAA and measures to prevent PC/PPC), additional duties for Categorised Services
3. Don’t take your eye off the ball of new/emerging policy obligations e.g., additional measures, thresholds for categorisation
4. Be proactive
   — Use Ofcom’s resources
   — Risk Assessment Tool
   — Guidance documentation
   — Leverage Supervisory relationships for advice

Question 4

AI Act - What can services do?

Answer 4

1. AI Literacy
   — Services must comply with active obligations to deploy AI Literacy programmes for employees
   — Help employees understand how to use AI ethically
   — Familiarise employees with concepts such as AI Governance, Policy, Inventories, Risk Assessment, Audit
2. AI Policy/Decision-making Framework
   — Going beyond compliance with regulation, set a broad policy aimed at ensuring AI deployments conform to ethical principles
   — Focus on the most common principles, e.g., transparency, redress, safety, fairness, governance
3. Implement AI Governance Basics
   — Establish accountabilities at Board level
   — Prepare for transparency reporting obligations
   — Establish processes required for RAs
4. Conduct AI System Inventory
   — What risk level are the deployments?
   — Supply chain due-diligence
   — Decommission prohibited use cases
   — Assess risks against the AIA framework
5. AI Audit
   — Identify trusted partners for AI Audit
   — Define standards and expectations to ensure this is done robustly

Question 5

DSA - What’s your knowledge on this?

Question 6

What’s the most challenging part of OSA compliance?

Answer 6

1. Breadth of risk assessments - need to scale up compliance operations and deploy effective processes
2. Upcoming policy changes - complying and keeping an eye on what’s next at the same time
3. Cultural change - embedding compliance culture, persuading/influencing senior decision makers
4. Public scrutiny - firms are under the spotlight, awareness is increasing about safety implications of services; proactive compliance is important to not only do ‘good enough’, but to showcase best practice instead