Children’s Risk Assessments and the July 2025 Duties

Children’s risk assessments form a central component of platform compliance under the Online Safety Act and related AI regulations. These assessments must identify and mitigate potential harms to children posed by content hosted or generated on platforms. The July 2025 duties place a strong emphasis on proactive risk identification, particularly for AI-generated content. Platforms must now evaluate not only existing content but also the potential for AI tools to produce harmful material that could affect young users. This includes considering how AI systems might amplify existing biases or create new forms of harmful interaction.

Key Elements of Children’s Risk Assessments

Effective risk assessments must focus on several core areas. First, platforms must identify the types of AI-generated or hosted content that are likely to affect children. Examples include deepfake content, manipulative AI chatbots, or AI-generated misinformation. Second, these assessments must evaluate the likelihood and severity of harm. For instance, AI-generated content that mimics a child’s voice or appearance could pose a significant risk of grooming or identity theft. Third, platforms must consider the effectiveness of existing safeguards. If a platform uses AI moderation tools, these must be reviewed to ensure they are capable of detecting child-specific risks.

• Content that mimics or impersonates children
• AI-generated misinformation targeting child audiences
• Chatbots or virtual assistants designed to interact with children
• Content that exploits or misrepresents child experiences

Implementation of July 2025 Duties

As of July 2025, platforms must begin implementing these risk assessments as part of their AI governance frameworks. The duty requires platforms to take reasonable steps to identify and reduce risks to children. This involves reviewing AI systems used for content generation or moderation, including those that may not have been previously classified as high-risk. For example, a social media platform using AI to curate content feeds must now consider whether these algorithms might expose children to harmful material through recommendation systems.

Organisations must also begin documenting these assessments. The documentation should include the data sources used, the identified risks, and the mitigation strategies applied. The EU AI Act’s Article 50 transparency duties, which apply from 2 August 2026, require platforms to make these risk assessments publicly available or accessible to regulators. This makes it essential to begin building these records early. The July 2025 duties also align with the EU AI Act’s Article 4 AI literacy requirements, which apply from 2 February 2025. This means staff must be trained to understand how AI systems might affect children, including through bias or misuse.

ISO/IEC 42001:2023 provides a framework for AI governance that platforms can use to structure these risk assessments. Clause 7.2 of this standard highlights the importance of identifying and addressing AI-related risks, including those affecting vulnerable groups such as children. The standard also requires platforms to monitor AI systems continuously, which is especially important for AI tools that interact directly with children. The certification process through ISO/IEC 42006:2025 ensures that these frameworks meet international standards, and platforms should begin preparing for this process now.

Platforms must also consider the practical implications of these duties. For example, a platform that allows users to generate AI avatars must now evaluate whether these tools could be misused to create misleading or harmful content involving children. Similarly, AI tools that generate educational or entertainment content must be reviewed to ensure they do not inadvertently promote harmful ideologies or behaviors. The July 2025 duties make these evaluations mandatory, not optional. The goal is to ensure that AI systems do not unintentionally place children at risk through design or deployment flaws.

Organisations should begin by conducting a baseline assessment of their AI systems. This involves mapping all AI tools currently in use, identifying those that interact with or affect children, and determining whether existing safeguards are sufficient. Where gaps are identified, platforms must develop plans to address these through technical or procedural improvements. Regular updates to these risk assessments must be part of the platform’s ongoing AI governance process. The July 2025 duties make these efforts not just good practice but a legal obligation. The EU AI Act’s penalties, including fines of up to 35 million EUR or 7 percent of global turnover, make compliance essential for all platforms operating in the EU or serving EU users.