UK OSA
Online Safety Act 2023
One of the most comprehensive platform content moderation regimes globally. Creates specific duties around suicide, self-harm, and eating disorder content for children with 'highly effective' age assurance requirements.
Jurisdiction
United Kingdom
Enacted
Oct 26, 2023
Effective
Oct 26, 2023
Enforcement
Ofcom
Phased enforcement through 2026
legislation.gov.ukWhy It Matters
Most explicit regulation of mental health content globally. Suicide, self-harm, and eating disorders are "primary priority" content requiring prevention, not just mitigation. AI chatbots that enable content sharing between users are explicitly in scope.
Recent Developments
Feb 2025: Ofcom open letter clarified AI chatbot scope — services are in scope if they enable user-to-user content sharing or search multiple websites; pure 1-to-1 AI companions without these features may fall outside OSA, and the government has signalled possible changes to close this gap. SI 2025/1352 (Oct 21, 2025; in force Jan 8, 2026) added cyberflashing and encouraging/assisting serious self-harm (OSA s.184) as priority offences. Super-complaints regime entered force Jan 1, 2026. First enforcement: 4chan fined GBP 20,000 (Oct 2025) for failing to respond to info requests; 76+ active investigations including suicide forums (first launched Apr 9, 2025). Feb 2026: Ofcom opened a formal investigation into X over Grok AI generating non-consensual sexualised imagery. Key limitation: the OSA does not yet cover standalone AI chatbots — only platforms hosting user-generated content (the standalone-chatbot gap is tracked separately under the Crime and Policing Bill extension). 2026 illegal-content code amendments (s.43 process): (1) an intimate-image-abuse / hash-matching amendment adding recommendation ICU C14 (perceptual or cryptographic hash matching) for user-to-user and search services was submitted to the Secretary of State on 15 May 2026 and laid before Parliament on 1 June 2026; it applies to large or high-risk services (regulated-pornography hosts, 700k+ UK MAU, or file-storage/sharing services), not standalone AI chatbots; (2) a separate No. 2 amendment adding crisis-response measures (ICU C15/C16) for terrorism-related illegal harm was submitted to the Secretary of State on 12 June 2026. Under s.43 each draft has a 40-day Parliamentary scrutiny period from laying; absent objection Ofcom then issues the code, which comes into force 21 days after issue. For the 1 June amendment the 40-day period runs to about 11 July 2026, so realistic in-force is late July/August 2026 — NOT 22 June 2026 (an earlier note miscounted 21 days from the laying date rather than from issue). Final decisions on the full additional-measures package are planned for Autumn 2026. Separately, Ofcom anticipates publishing the register of categorised services in July 2026, triggering Category 1/2A/2B additional duties (risk-assessment records about Oct 2026; published summaries about Nov 2026) and a consultation on further categorised-service duties. Sources: gov.uk OSA draft amendments to the illegal content codes of practice; Ofcom Important dates for Online Safety compliance.
At a Glance
Applies to
Harms addressed
Who Must Comply
- User-to-user services
- Search services
- Services likely accessed by children
Obligations fall on:
Safety Provisions
- Primary priority content for children: must PREVENT access to suicide, self-harm, eating disorder content
- New criminal offense (Section 184): encouraging serious self-harm
- Risk assessments required for illegal content and children's access
- Recommender systems must exclude harmful content from children's feeds
- Services must use "highly effective" age assurance
Exemptions
1-to-1 AI Companion (No User Content Sharing)
Pure 1-to-1 AI chatbot where provider controls output and no content is shared between users.
- • Provider controls AI output (not user-generated)
- • No user content shared with other users
- • No public characters or shared chats
- • No user-to-user features
Compliance & Enforcement
Key Dates
Mar 17, 2025
Illegal content safety duties enforceable
Jul 25, 2025
Child protection safety duties enforceable
Jul 1, 2026
Ofcom expected to publish the register of categorised services (triggers Category 1/2A/2B additional duties) and to consult on further categorised-service duties (expected July 2026)
Oct 1, 2026
Category 1/2A services expected to provide Ofcom with up-to-date illegal-content and children risk-assessment records (contingent on register; expected Oct 2026)
Nov 1, 2026
Category 1/2A services expected to publish risk-assessment summaries (expected Nov 2026)
Penalties
£18M or 10% revenue (whichever higher); criminal liability
View on map
United Kingdom
Focus Areas
Cite This
APA
United Kingdom. (2023). Online Safety Act 2023.
Related Regulations
UK AI Chatbot OSA Extension
Section 248 of the Crime and Policing Act 2026 confers a delegated power to bring standalone and generative AI chatbot providers (ChatGPT, Grok, Gemini, etc.) within scope of Online Safety Act illegal-content duties - the mechanism to close the loophole where AI-only chatbots fell outside the OSA. The substantive duties on AI chatbots await secondary legislation.
AU Online Safety Act
Grants eSafety Commissioner powers to issue removal notices with 24-hour compliance. Basic Online Safety Expectations (BOSE) formalize baseline safety governance requirements.
Ireland OSMR
Establishes Coimisiún na Meán (Media Commission) with binding duties for video-sharing platforms. One of the cleaner examples of explicit self-harm/suicide/eating-disorder content duties in platform governance.
Ofcom Children's Codes
Ofcom codes requiring user-to-user services and search services to protect children from harmful content including suicide, self-harm, and eating disorder content. Explicitly covers AI chatbots that enable content sharing between users. Requires detection technology, content moderation, and recommender system controls.
Brazil ECA Digital
Comprehensive child digital safety law applying to any IT product or service directed at or likely to be accessed by minors in Brazil, with extraterritorial reach.
KCSIE
Statutory safeguarding guidance issued by the Department for Education for schools and colleges in England, setting out duties to prevent and respond to harm to children, including abuse, neglect, and online safety risks. Reissued annually; requires a whole-school approach to online safety organised around a four-part risk framework (content, contact, conduct, commerce), together with a designated safeguarding lead, staff training, and a child protection policy.
Last updated June 20, 2026. Verify against primary sources before relying on this information.