If a regulator asked for your pre-launch risk record tomorrow, you should already know what it would show.
This week Ofcom opened an investigation into whether Meta carried out a suitable and sufficient illegal content risk assessment and children's risk assessment before launching Instagram Instants, where content disappears once viewed. It's an investigation, not a finding of a breach. Meta says it takes its obligations seriously, ran a risk analysis and briefed Ofcom on the feature several times before launch.
The Online Safety Act requires services to keep their risk assessments current, to do a fresh one before any significant change to the design or operation of the service, and to keep a written record of each. One feature launch is enough to put that to the test. If you have UK users, this is a question about your own process.
I'd want the assessment done at design review, in the same slot as the security review, with a named sign-off. By the time a feature is on a launch calendar, the decisions that create or remove risk have mostly been made. The abuse pre-mortem belongs where the design can still change.
Disappearing content deserves its own page. If something is gone after one view, the plain questions are how a user reports it afterwards and what my team can still see when they do. Whatever the answer, it's a design decision, and it needs an owner and a written mitigation before launch.
The record matters as much as the work. Every launch should leave a dated assessment behind it, with mitigations and the name against each one, filed so I could hand it over within a day. The assessment is product work. The record is the proof it was done.
Links in comments. Pre-mortum tool that I built in comments as well.
#TrustAndSafety #OnlineSafety #SafetyByDesign #ChildSafety #Compliance