Online Safety Act

The Online Safety Act 2023 received Royal Assent on 26 October 2023. Its long title describes it as an Act to provide for "the regulation by OFCOM of certain internet services"¹.

It mainly covers two kinds of service: user-to-user services, where people can share content with each other, and search services. They must assess the risks on their platform and act on them. The duties to tackle illegal content became enforceable on 17 March 2025, and the children's safety rules came fully into effect in summer 2025². Sites that publish pornography have had to use age checks since 17 January 2025². Ofcom can fine a company up to £18 million or 10% of its qualifying worldwide revenue, whichever is greater².

AI is covered where it fits those categories. In November 2024 Ofcom told providers that a chatbot whose answers users can share with others is a user-to-user service, that chatbots made by users count as user-generated content, and that AI tools which search across websites are search services³. AI tools that can produce pornography must use "highly effective age assurance"³.

That left a gap. A standalone chatbot that only talks to its own user may fall outside the Act, and Ofcom said chatbot-made images are generally out of scope unless they are pornographic or shareable⁴. In February 2026 the government said it would close the gap through the Crime and Policing Bill⁴. The resulting Crime and Policing Act 2026, which received Royal Assent on 29 April 2026⁵, creates an offence for making available AI chatbots that generate certain prohibited content and amends section 216 of the Online Safety Act so ministers can make regulations on illegal AI-generated content⁶.