Schedule 3: Timing of providers’ assessments Cross-cutting duties Section 23: Record-keeping and review duties
This section sets out the record-keeping and review obligations that apply to providers of regulated user-to-user services.
	Providers of user-to-user services are obliged to keep a written record of the risk assessments that they carry out. They must also keep written records explaining which of the measures recommended in a code of practice they are taking for the purposes of complying with their duties. Where a provider is taking an alternative approach to that recommended in a code of practice, it must keep a written record explaining what it is doing instead and how that amounts to compliance with the relevant duties.
	Subsection (6) requires providers to review compliance with the relevant duties regularly and after making any significant change to their service.
	Subsection (7) provides OFCOM with the ability to exempt categories of providers from the need to keep written records and carry out reviews. It is anticipated that this power could be used for small, low risk services to ensure these service providers do not face an unnecessary regulatory burden. Where OFCOM considers an exemption is no longer appropriate, they may revoke that exemption. Under subsection (8), OFCOM must publish the details of any such exemptions or revocation of exemptions with reasons.
	Subsections (9) places a duty on Category 1 providers to keep a written record of their assessment required under section 14. Category 1 services’ section 14 assessment covers matters such as the incidence of content that falls in scope of their user empowerment duties. Subsection (9) requires that the written record cover all aspects of the assessment, including how it was carried out and the findings.
	Subsection (10) specifies that Category 1 providers have a duty to, as soon as reasonably practicable after making a record of an assessment as required by subsection (2) or (9), or revising such a record, that they must then supply this in full to OFCOM.