UK Moves to Bring AI Chatbots Fully Within Online Safety Act Scope After Child-Harm Concerns

The Gap Ofcom Admitted It Could Not Close

Regulatory gaps rarely become public through official channels — they surface when a regulator is forced to explain why it could not act on an obvious harm. That is what happened here: Ofcom, the UK’s communications regulator, acknowledged it lacked the authority to address a deepfake scandal involving Grok, the chatbot built by Elon Musk’s xAI, which had been used to create non-consensual sexualized images primarily of women and children. Existing Online Safety Act “illegal content duties” — obligations requiring platforms to remove or prevent the spread of content such as child sexual abuse material (CSAM) and non-consensual intimate images — were written with social media platforms and user-generated content in mind, not generative AI systems capable of producing harmful content on demand.

The government’s response was direct: it announced it would move fast to shut the legal loophole and force all AI chatbot providers to abide by illegal-content duties in the Online Safety Act, closing the ambiguity that let AI-specific harms slip outside the Act’s clear reach.

The Legislative Machinery Behind the Move

The chatbot extension did not appear in isolation. In March 2026, the government proposed amendments to the Crime and Policing Bill and the Children’s Wellbeing and Schools Bill specifically to enable the broader changes now being fast-tracked. Both bills received Royal Assent on 29 April 2026, becoming the Crime and Policing Act 2026 (CPA) and the Children’s Wellbeing and Schools Act 2026 (CWSA).

Together, the two acts add new duties, criminal offences, and government powers to the UK’s online safety framework — including new criminal offences for creating or possessing intimate-image AI generators and CSAM generators, and powers to amend the Online Safety Act to regulate AI services and close chatbot loopholes. The CWSA in particular paves the way for a possible future ban on children’s access to social media, with government action on that front expected within months. The AI chatbot provisions build directly on this legislative foundation rather than requiring an entirely new bill — a deliberate choice that let the government move faster than a standalone AI-chatbot law would have allowed.

Ofcom’s Enforcement Priorities Confirm the Direction

Ofcom has independently signaled that AI-generated harms and child protection sit at the center of its 2026-27 enforcement agenda under the Online Safety Act, alongside its existing illegal-content and platform-moderation responsibilities. That alignment between the regulator’s stated priorities and the government’s legislative push suggests the chatbot extension is not a one-off reaction to the Grok incident, but part of a coordinated effort to treat generative AI as a first-class category of online safety risk, comparable to how the Act already treats social media and search platforms.

What This Means for Algerian AI Regulation and Chatbot Deployment

Algeria has no equivalent of the Online Safety Act, but the UK’s move is an early template for a regulatory gap most countries, including Algeria, currently share: AI chatbots operating largely outside existing content-safety law because that law was written before generative AI existed.

1. Any Algerian platform or business deploying AI chatbots facing UK or EU users should expect these obligations to apply extraterritorially

The Online Safety Act, like the EU’s Digital Services Act, applies based on where users are located, not where a company is headquartered. Algerian startups or ALGmag-adjacent digital businesses building AI chatbot products with UK or European user bases should treat illegal-content compliance (CSAM detection, non-consensual imagery, self-harm content) as a market-entry requirement now, not a future concern.

2. Algeria should study this as a template for its own eventual AI content-safety framework

Algeria does not yet have AI-specific content regulation, but as AI chatbots proliferate domestically — in education, customer service, and government service delivery — policymakers should look at how the UK extended existing illegal-content duties to chatbots rather than starting from scratch, since adapting an existing framework is faster and more legally coherent than building AI-specific rules in isolation.

3. Child protection should be the explicit anchor of any Algerian AI governance conversation, not an afterthought

The UK’s move was triggered specifically by child-harm and deepfake concerns, and both supporting acts are framed around children’s safety. Algerian regulators and educators introducing AI tools into schools and youth-facing services should build child-safety review into AI adoption decisions from the outset, following the same priority ordering the UK has now formalized in law.

The Direction of Travel

The UK’s move confirms a pattern likely to repeat across jurisdictions: regulators built for the social-media era are retrofitting existing content-safety law onto generative AI rather than waiting for entirely new legislation, because the harms — deepfakes, chatbot-generated harmful content, child exposure — are urgent enough that speed matters more than a purpose-built framework. For Algeria and other countries still without AI-specific content rules, the lesson is that the fastest and most legally defensible path to closing this gap is extending existing platform-safety obligations to AI systems explicitly, rather than treating AI regulation as a separate project that can wait.

Frequently Asked Questions

Sources & Further Reading

• UK Government Children’s Safety and AI Chatbot Powers: Two New Acts Receive Royal Assent — Bird & Bird
• UK Seeks More Powers Under Online Safety Act to Tackle AI Harms — Tech Policy Press
• Tandem laws expand UK online safety regime with new duties, criminal liability and government powers — Osborne Clarke