pleenk
enfrespt
Book a demo
← Blog
pt-brfresende

Adding live streaming, messaging or AI to your platform? Assess the risks before launch

Published 23 October 2026Updated 3 November 20267 min readBy Pleenk Approve

Development is almost done. Your team has built what your creators have been asking for for months. It might be live streaming, paid private messaging or an artificial intelligence (AI) tool that creates images. The release date is set and the announcement is ready. But nobody has yet asked a simple question: how could this feature be misused?

That is exactly the question Ofcom, the UK online safety regulator, is now asking Meta. On 6 October 2026, Ofcom opened an investigation into "Instants". Instagram launched this feature in May: shared content disappears once it has been viewed. Ofcom wants to know whether Meta properly assessed its risks before putting it live.

The short answer: is your platform accessible in the UK? Then the law requires you to update your risk assessment before any significant change to how the service is designed or run. You must also keep a written record of that assessment. This rule does not only apply to the giants. Outside the UK too, it is the best way to avoid discovering a problem at the same time as your payment service provider (PSP).

Why would a regulator care about a feature that has not launched yet?

Because a platform's risks do not come only from content. They also come from what the product makes possible. A public photo feed and a private live stream with tips do not raise the same problems. A private live stream makes moderation much harder, because everything happens in real time.

The Online Safety Act, the UK's online safety law, is very clear on this point. Its Section 9 requires three things of every service in scope. First, carry out a "suitable and sufficient" assessment of the risk of illegal content. Second, keep that assessment up to date. Third, carry out a new assessment focused on the effects of the change before any significant change to the service. Section 23 adds another duty: record in writing how the assessment was done and what it concluded.

Ofcom had given warning. In April 2026, it required more than 40 large services to hand over more than 70 risk assessments. It used the occasion to remind services that assessments must be reviewed at least once a year, and before any significant change. Its enforcement director compares this to a carmaker testing its car before selling it. For a breach, the fine can reach £18 million or 10% of global turnover. Whichever is higher applies.

An important point: at this stage, Ofcom is investigating; it has not sanctioned Meta. Ofcom must first gather evidence. If it thinks there is likely a breach, it will issue a provisional decision. Meta will then be able to respond.

What counts as a "significant change" for a creator platform?

The law gives no list. But Ofcom's risk assessment guidance gives examples:

  • a new feature launched outside the annual review;
  • a change to your systems that could change your risk levels;
  • dropping an existing safety measure.

For an adult, live streaming or user-generated content (UGC) platform, we would put these cases in that category without hesitation:

  • Live streaming or private video calls. Ofcom lists this among risk factors. It points in particular to grooming, meaning an adult manipulating a minor, and to child sexual abuse. Ofcom stresses that moderating in real time is difficult.
  • Private messaging, especially if it lets users send photos or videos, or if it is encrypted.
  • Content with several creators and invitations to co-performers.
  • Generative AI tools that create or edit images of people.
  • A new payment or payout method: tips, virtual gifts, payments between users.
  • Opening a new market or a new category of creators.

Watch out for a common trap: removing a safeguard is also a significant change. That is the case if you drop a verification step or pre-publication moderation to make sign-up easier.

Who is affected, and what does EU law say?

In the UK, the duty to assess risks before a significant change covers services where users interact with each other. It applies to all services covered by the law, whatever their size. Only a few extra duties target "categorised" services alone. For example, only they must publish a summary of their assessments. A creator platform accessible from the UK is therefore directly affected.

In the European Union, the DSA (Digital Services Act, the EU regulation on digital services) has a similar but narrower rule. Its Article 34 requires a risk assessment before launching features likely to have a critical impact. These are so-called "systemic" risks, which affect society as a whole. But this rule only covers very large platforms, those with more than 45 million monthly active users in the EU. Below that threshold, there is no equivalent formal duty.

Even so, a new feature often changes things that apply to every platform. These include your terms of service, your notice-and-takedown system, and your recommender systems. A written assessment helps you update them at the same time.

The rules on visitor age verification do not change. Here, the assessment covers what the new feature makes possible between users and creators.

What we would do if we were launching live streaming next month

Ask five questions before writing the first line of code. Who will be able to use the feature? Who will be able to appear on screen? What can go wrong, and how fast? How will we know? What will we do in the next minute? The answers often fit on two pages. That is the document a regulator or your acquirer (the bank that handles your card payments) will want to see.

Name one person who decides. Someone must decide whether a change is "significant". That person also knows when to bring compliance, legal and moderation into product discussions. The law firm Lewis Silkin advises writing this process down in black and white, rather than leaving everyone to judge alone.

Start with the people. In a live stream, the question "who is behind the screen?" becomes "who is on screen, right now?". The streamer must be verified before their first live stream. Anyone who joins them must also be verified, and their consent must be recorded. An unverified co-performer on a live stream is exactly what the card networks want to avoid.

Fit moderation to the format. You do not moderate disappearing or live content like a published video. You need real-time alerts and a visible report button during the broadcast. You also need to be able to cut the stream immediately, with a human review behind it.

Check who gets the money. The feature may create a new money flow, such as tips or gifts. If so, payouts must always go to an account in the name of the creator's verified identity. This is one of the first checks against a third party exploiting someone.

Keep banned people out. A new feature also attracts people who were already excluded. If the ban targets an account and not an identity, it will not hold.

Tell your PSP before, not after. Your acquirer carries the risk of your business with Visa and Mastercard. Present the feature, the assessment and the planned measures to them before launch. A possible nasty surprise then becomes proof that you take this seriously.

Date everything and keep everything. Keep the assessment, the decision to launch, the measures you adopted and those you rejected, with the reason for each choice. As Lewis Silkin points out, being able to show the process matters as much as the document itself.

What this really changes

For a founder, the Instagram investigation is not a big-tech story. It is a reminder of method. Compliance is not added after launch: it is decided during design. The right habit is to ask the same questions for every new feature. Who is affected? What can go wrong? How will we see it? How will we react? And where did we write it down? Platforms that do this launch at the same pace as everyone else. But they do not have to explain to their bank afterwards why they did not see it coming.

How Pleenk Approve can help

Pleenk Approve does not write your risk assessment for you. But it provides some of the evidence the assessment will call for. The core of Pleenk is a single digital identity. Every creator, streamer or co-performer is verified with a liveness check. Their identity is encrypted by Pleenk and stored in a single wallet (a digital identity wallet): your platform receives proof, never the ID document. Everything is linked to this wallet: their accounts, their consents, the IBAN that receives their earnings and any bans. Your moderation stays yours: Pleenk connects to the AI moderation tool you chose and keeps proof that the checks were done. Preparing to launch live streaming, messaging or an AI tool? Write to us at contact@pleenk.com and we will look at your project with you.

This article is for information only and does not constitute legal advice. Regulations and card network rules are evolving. Have your choices reviewed by your legal adviser and your payment partners.

Sources

More articles
9 November 2026 · 8 min read
Human trafficking and cam studios: what a live streaming platform must check
6 November 2026 · 7 min read
Ofcom is investigating two adult services over non-consensual intimate images: what a PSP should ask its merchants
4 November 2026 · 7 min read
When an agency runs a creator's account: what your platform needs to control