How often must risk assessments be carried out?

Risk assessments must be conducted at least once a year by VLOPs and VLOSEs.

Additional assessments are required whenever there are major changes to services — such as launching a new algorithm, recommendation system, or business model — that could affect user safety.
In practice, many platforms choose to run assessments more frequently (e.g. quarterly or biannually) to stay ahead of regulatory audits and demonstrate good faith. Regular assessments also help platforms detect emerging risks like new scam patterns or shifts in disinformation tactics.