UK OSA

Recent Developments

Feb 2025: Ofcom open letter clarified AI chatbot scope — services are in scope if they enable user-to-user content sharing or search multiple websites; pure 1-to-1 AI companions without these features may fall outside OSA, and the government has signalled possible changes to close this gap. SI 2025/1352 (Oct 21, 2025; in force Jan 8, 2026) added cyberflashing and encouraging/assisting serious self-harm (OSA s.184) as priority offences. Super-complaints regime entered force Jan 1, 2026. First enforcement: 4chan fined GBP 20,000 (Oct 2025) for failing to respond to info requests; 76+ active investigations including suicide forums (first launched Apr 9, 2025). Feb 2026: Ofcom opened a formal investigation into X over Grok AI generating non-consensual sexualised imagery. Key limitation: the OSA does not yet cover standalone AI chatbots — only platforms hosting user-generated content (the standalone-chatbot gap is tracked separately under the Crime and Policing Bill extension). 2026 illegal-content code amendments (s.43 process): (1) an intimate-image-abuse / hash-matching amendment adding recommendation ICU C14 (perceptual or cryptographic hash matching) for user-to-user and search services was submitted to the Secretary of State on 15 May 2026 and laid before Parliament on 1 June 2026; it applies to large or high-risk services (regulated-pornography hosts, 700k+ UK MAU, or file-storage/sharing services), not standalone AI chatbots; (2) a separate No. 2 amendment adding crisis-response measures (ICU C15/C16) for terrorism-related illegal harm was submitted to the Secretary of State on 12 June 2026. Under s.43 each draft has a 40-day Parliamentary scrutiny period from laying; absent objection Ofcom then issues the code, which comes into force 21 days after issue. For the 1 June amendment the 40-day period runs to about 11 July 2026, so realistic in-force is late July/August 2026 — NOT 22 June 2026 (an earlier note miscounted 21 days from the laying date rather than from issue). Final decisions on the full additional-measures package are planned for Autumn 2026. Separately, Ofcom anticipates publishing the register of categorised services in July 2026, triggering Category 1/2A/2B additional duties (risk-assessment records about Oct 2026; published summaries about Nov 2026) and a consultation on further categorised-service duties. Sources: gov.uk OSA draft amendments to the illegal content codes of practice; Ofcom Important dates for Online Safety compliance. Update 20 September 2026: Ofcom published the register of categorised services and the list of emerging Category 1 services on 10 July 2026 (register page first published 30 June 2026; register PDF dated 10 July 2026), so the Category 1, 2A and 2B additional duties are now in effect; Ofcom's illegal-content-duties guidance (last updated 25 June 2026) expects Category 1 and 2A providers to supply their latest risk-assessment records by October 2026 and to publish risk-assessment summaries by November 2026 (verified from archived copies of the Ofcom pages; ofcom.org.uk refuses direct requests from this network). Update 27 September 2026: Ofcom's 10 September 2026 press release ('Ofcom to crack down on spread of illegal intimate images and deepfakes') states that by 30 September 2026 online platforms should have hash matching in place to detect and prevent sharing of illegal intimate images, including explicit AI-generated deepfakes, or prove that their systems curb the spread by equally effective means; Ofcom opened an enforcement programme on the measure the same day and partnered with SWGfL (StopNCII.org). Ofcom also said it will consult by the end of 2026 on amending the Illegal Harms Codes for the statutory 48-hour takedown requirement for non-consensual intimate images, and opened a call for evidence on its women-and-girls guidance closing 6 November 2026. Source: Ofcom press release of 10 September 2026 as republished on wired-gov.net (ofcom.org.uk not reachable from the checking host). Update 18 October 2026: on 6 October 2026 Ofcom opened an investigation into whether Meta carried out suitable and sufficient illegal-content and children's risk assessments before launching Instagram Instants (Ofcom news item read from an archived copy in the 11 October 2026 sweep). On 15 October 2026 Ofcom reported that X's first quarterly report on hate and terror content falls within its May 2026 commitments while effectiveness concerns remain; that its Grok investigation now concentrates on X's illegal-content and complaints duties after X fixed gaps in restricting age-gated pornography; and that, because standalone chatbots fall outside the Act, SpaceXAI (formerly xAI) agreed to block UK users from pornographic image generation in standalone Grok and to stop its companion chatbots, including 'Ani', from sexually explicit conversations with UK users (Ofcom update as republished on wired-gov.net).