FAQ

What is the Online Harms Taxonomy Library?

OHTL collects published taxonomies and typologies of online harm from regulators, researchers and industry, and maps each one to a common open schema, building an open knowledge graph of online harm taxonomies. You can then compare, cite and reuse them, and see how a category in one taxonomy relates to categories in others.

Why does OHTL exist?

There is no agreed set of definitions for online harm. In a 2023 article introducing the Typology of Online Harms from the World Economic Forum (WEF), Australia's eSafety Commissioner and co-authors wrote of "numerous fragmented interpretations", and that without common definitions "consolidating views and data for informed decision-making is impossible". But regulators, platforms and researchers still each use their own lists. OHTL aims to make those lists easier to compare and work with, so that others can build tools and services that support online safety. About lists who could use it.

Who is it for?

Anyone who works across more than one way of classifying online harm: researchers comparing definitions, compliance teams comparing their policies with several regulatory regimes, trust and safety teams and safety vendors aligning their categories, policymakers comparing where different regimes draw their lines, and developers building compliance tools and AI assistants that need a reliable source to work from.

Is OHTL building a single master taxonomy of online harms?

No. We publish each taxonomy as its publisher wrote it, with its own categories and definitions, and we don't merge, rank or choose between them. Some bodies have worked to agree a common language - the WEF's Typology of Online Harms, for example, was developed with regulators, technology companies, universities and civil society. We include it as a source. But in practice, regulators, platforms and researchers have developed their own categories and definitions, so we aim to connect them to each other, including to the WEF Typology. Where categories in different taxonomies relate, we record the relationship as a crosswalk that anyone can inspect and challenge.

How does OHTL relate to AI risk repositories?

Projects such as the MIT AI Risk Repository and IBM's AI Atlas Nexus collect taxonomies of risks from AI systems. OHTL focuses on online harm: the categories used in online safety law, regulators' guidance, platform rules and content classifiers, including AI use policies and harms from AI-generated content. Risks from frontier AI models themselves, such as weapons development or loss of control, are outside our scope. Where categories overlap, we plan to link to those projects rather than copy them, and to publish our crosswalks in SSSOM (the Simple Standard for Sharing Ontological Mappings), a format IBM's AI Atlas Nexus already uses.

How does OHTL choose sources?

We include a source if it publishes an identifiable set of named categories of online harm and comes from one of four groups:

• regulators and legislation, whether in force or formally proposed
• international and multi-stakeholder bodies
• industry, where a very large platform or widely used classifier publishes its categories at a stable public address
• research that others cite widely or build on.

We review each candidate before we add it. The Library doesn't claim to be complete, and we welcome suggestions.

This is our working approach during phase 1. We will develop formal policies with participants from phase 2 (see Governance).

Why does OHTL treat legislation, guidance and company policies together?

Because practitioners have to reconcile them at the same time. A trust and safety team may need to map one set of moderation categories against the UK Online Safety Act, the Digital Services Act and a vendor's classifier labels. We don't treat these as equivalent: we record each source's type, such as statute, regulatory guidance, platform rules or classifier labels, so you can see its nature and legal status. Some sources state their status themselves: the WEF says its Typology is not meant to be prescriptive and does not assign severity ratings. A match between a statutory category and a classifier label shows a conceptual overlap, not legal equivalence.

What does it mean when OHTL includes a source?

Only that people rely on it in practice as a published classification of online harm. Including a source doesn't mean we endorse it, its categories or the policy choices behind them, or that its publisher endorses OHTL. Those choices differ: the WEF Typology, for example, sets out to balance freedom from online harm against rights such as freedom of expression, and other publishers may strike that balance differently.

Why is a source I expected missing?

We are in the first phase of the Roadmap and are still reviewing several candidates, which we list on the Sources page. To suggest a source, email contact@ohtl.org.

Why archive the source documents?

Publishers revise guidance, move documents and remove older editions, but every OHTL taxonomy must point to the exact edition it came from. So every edition gets a permanent URL. If it already has one in an official archive, such as legislation.gov.uk or EUR-Lex, we use that. Otherwise, if the licensing terms allow, we upload an unaltered copy to an open repository such as Zenodo, a long-term research archive run by CERN, which gives it a DOI. Otherwise, we trigger a capture in the Wayback Machine and use that, while we ask the publisher for permission to upload it. We also record a checksum, so anyone can check a copy matches the original.

What about copyright in the source documents?

Publishers keep the copyright in their documents. We upload a copy to an open repository only where their terms allow it, and each record there states the publisher's own copyright and terms.

Is OHTL's version of a taxonomy authoritative?

No. The original document is always the authority. We link every category back to its source so you can check it, and a person checks each extraction. If you spot a difference, please tell us. Nothing on OHTL is legal advice.

What format will the data be in?

RDF, the W3C standard for publishing a knowledge graph as linked data, so you can load it into common graph tools and link it to other datasets. We haven't chosen the exact file formats yet.

What is the schema based on?

We plan to build on SKOS, the W3C standard for taxonomies and thesauri, with Dublin Core for basic provenance, and to add our own terms only where no established vocabulary fits. We design the schema in phase 2 of the Roadmap.

Why a knowledge graph?

A knowledge graph records how things relate, not just what they are called: which categories sit under which, and where a category in one taxonomy matches or overlaps one in another. Publishing it as linked data gives each category its own permanent web address, so anyone can point to it from research papers, compliance work or their own datasets, and standard vocabularies mean the data works with existing tools. It also gives AI tools a structured, citable source to work from, rather than relying on what a model remembers.

What is a crosswalk?

A record of how a category in one taxonomy relates to a category in another: whether they match, overlap or differ. For example, the WEF Typology groups each harm as a content, contact or conduct risk. It cites the CO:RE 4Cs, which add a fourth group, contract risks, that the WEF leaves out. A crosswalk will record how the three shared groups relate, and that contract risks have no WEF counterpart. We haven't published any crosswalks yet.

Why not just ask an AI model?

AI models give fluent answers, but they can misquote or mis-cite the rules, answer the same question differently each time, and miss how provisions and categories connect. OHTL gives them, and you, a checked source to work from, with every category traced to its original text. We see the two working together: the AI handles the conversation, and OHTL supplies the evidence.

What kinds of task could OHTL help AI tools with?

Early research on frontier AI models suggests a knowledge graph helps most where long documents alone fall short: following rules that cross-refer, have exceptions or interact, as when checking a scenario against a whole regulation; combining many facts spread across long texts; and supplying facts a model can't know from its training, such as what a particular edition of a source says or how categories in different taxonomies relate. Long documents alone work well for finding a single fact, and a graph adds little where the model already knows the answer. For example, a graph of the GDPR's provisions and cross-references helped GPT-5-thinking spot violations more accurately than the full text alone (GraphCompliance, preprint). Most of this evidence comes from preprints and changes with each model release (as of September 2026). We would like to test it on real online safety compliance questions: see Work with OHTL.

Is the schema stable?

Not yet. Until it settles, we number releases 0.x and anything may change between them. The Roadmap explains how we get to version 1.0.

Is OHTL open source?

We develop the schema and the published taxonomies in public repositories on GitHub.

When will taxonomies be available?

We haven't published any yet. We are in phase 1 of the Roadmap, and we will publish early drafts as we test the schema in phase 3.

Can I use OHTL data in my research or product?

Yes, that is the aim. We will publish the data and schema under open licences, which we have yet to choose. The source documents stay under their publishers' terms.

How should I cite OHTL?

We plan to give each release its own DOI, so you can cite the exact version you used. We will add citation guidance here after the first release.

I have found an error. What should I do?

Email contact@ohtl.org with the page or category and what looks wrong. We fix errors at source, so the correction carries through to every format we publish.

Who runs OHTL?

At the moment, OHTL is run only by me, David Sant. I am a technology lawyer and former software developer, based in Oxford, UK (this is me). I advise on technology, AI, data protection and regulatory compliance, including online safety legislation and codes of practice. I created OHTL as an independent initiative, and (for now) I look after it, but I am looking for others to help (see About).

Why do you use "we"?

This project is too big for one person. As the Roadmap says, it depends on people and organisations who will help build useful outputs and look after them over time. OHTL needs to become a "we" project, so that's what I'm working towards, and that's why this site mostly uses "we". If you'd like to help, see Work with OHTL or email contact@ohtl.org.

How can I take part?

We are looking for domain experts, researchers and organisations to help design and test the schema and shape how OHTL is run. See Work with OHTL.

Who makes decisions about the schema?

Governance explains how we make decisions now, sets out our draft principles, and describes how governance will develop as more people take part.