UK AI Chatbot OSA Extension
UK Crime and Policing Act 2026 - AI Chatbot Online Safety Act Extension (s.248)
Section 248 of the Crime and Policing Act 2026 confers a delegated power to bring standalone and generative AI chatbot providers (ChatGPT, Grok, Gemini, etc.) within scope of Online Safety Act illegal-content duties - the mechanism to close the loophole where AI-only chatbots fell outside the OSA. The substantive duties on AI chatbots await secondary legislation.
Jurisdiction
United Kingdom
Enacted
Apr 29, 2026
Effective
TBD
Enforcement
Ofcom
Enacted as the Crime and Policing Act 2026 (c.20); Royal Assent 29 April 2026. Section 248 (Power to amend Online Safety Act 2023: AI, Part 17) is a delegated (Henry VIII) power letting the Secretary of State bring standalone/generative AI services into OSA scope by regulations. Operative duties on AI chatbots are NOT yet in force - they await secondary legislation, which had not been laid as of June 2026.
legislation.gov.uk (Crime and Policing Act 2026 s.248)Why It Matters
Closes the most significant regulatory gap in UK online safety law by extending OSA duties to standalone AI chatbots. Major implications for any AI chatbot operator serving UK users.
Recent Developments
Announced 16 Feb 2026 by PM Keir Starmer following the Grok deepfake scandal (non-consensual sexualised images). Added as a government amendment at Lords Report stage (AI chatbot amendment agreed 18 March 2026; a separate CSAM image-generation risk-assessment amendment was disagreed at that stage). Enacted as the Crime and Policing Act 2026 (c.20) on Royal Assent, 29 April 2026, as s.248. As an enabling power it does not itself impose duties on AI chatbots; the Secretary of State must make regulations (developed with Ofcom) to bring AI services into OSA scope. No such secondary legislation had been laid as of June 2026, so standalone AI chatbots are not yet subject to OSA duties under this power.
At a Glance
Applies to
Harms addressed
Who Must Comply
- Standalone AI chatbot providers
- AI systems that generate content (not just user-to-user platforms)
Safety Provisions
- AI chatbot providers must comply with Online Safety Act illegal content duties
- Same regulatory framework as user-to-user platforms applied to AI systems
- Ofcom empowered to regulate AI chatbot providers
- Examination of children's AI chatbot use restrictions
Compliance & Enforcement
Penalties
£18M or 10% revenue (whichever higher); license revocation
View on map
United Kingdom
Focus Areas
Cite This
APA
United Kingdom. (2026). UK Crime and Policing Act 2026 - AI Chatbot Online Safety Act Extension (s.248).
Related Regulations
UK OSA
One of the most comprehensive platform content moderation regimes globally. Creates specific duties around suicide, self-harm, and eating disorder content for children with 'highly effective' age assurance requirements.
UK OSA CSEA Reporting Regs 2026
Statutory instrument implementing section 69 of the UK Online Safety Act 2023, requiring regulated user-to-user service providers (UK and non-UK) to report child sexual exploitation and abuse (CSEA) content to the National Crime Agency under tiered priority-based timeframes.
CA Bill C-34 (Safe Social Media Act)
Proposed Canadian federal legislation that would create a Digital Safety Act and an independent Digital Safety Commission of Canada, imposing safety duties on social media services and AI chatbot services. Notable as the first Canadian bill to place specific statutory duties on AI chatbot services, including crisis-intervention and harm-mitigation measures, alongside child-protection and transparency obligations.
Ofcom Children's Codes
Ofcom codes requiring user-to-user services and search services to protect children from harmful content including suicide, self-harm, and eating disorder content. Explicitly covers AI chatbots that enable content sharing between users. Requires detection technology, content moderation, and recommender system controls.
KCSIE
Statutory safeguarding guidance issued by the Department for Education for schools and colleges in England, setting out duties to prevent and respond to harm to children, including abuse, neglect, and online safety risks. Reissued annually; requires a whole-school approach to online safety organised around a four-part risk framework (content, contact, conduct, commerce), together with a designated safeguarding lead, staff training, and a child protection policy.
Brazil ECA Digital
Comprehensive child digital safety law applying to any IT product or service directed at or likely to be accessed by minors in Brazil, with extraterritorial reach.
Last updated June 20, 2026. Verify against primary sources before relying on this information.