Do a lightweight risk-mapping exercise: list all web/app properties, identify where user content appears, document moderation/complaint handling, and confirm who owns admin access. This reduces uncertainty quickly and builds the evidence trail you’ll need if requirements apply.