On 8 November 2024, Ofcom published an open letter addressed to online service providers in the UK confirming that the Online Safety Act (the Act) will apply to online service providers in respect of Generative AI.  The open letter was published as a warning to service providers in response to recent incidents of online harms involving the use of Generative AI chatbots to create and act as 'virtual clones' of individuals.

In relation to user-to-user services (i.e. services that allow users to interact with other users and/or to generate content) (user-to-user services), Ofcom confirms that:

• The Act applies to regulated websites and apps that include a Generative AI chatbot which enables users to share text, images or videos generated by the chatbot with other users.  For example, any "group chat" features of services which enable multiple users to interact with a chatbot at the same time.
• The Act applies to regulated websites or apps that allow users to upload or create their own Generative AI chatbot (such as those reported in the above referenced Articles) and such user generated chatbots will be made available to other users. Ofcom also clarifies that any content (text, audio, videos or images) (Content) created by these 'user chatbots' is 'user-generated content' and regulated by the Act.
• Any AI generated Content that is shared by users on a user-to-user service is user generated Content and will be regulated in exactly the same way as Content generated by humans. For example, Ofcom explains that deepfake fraud material will be regulated no differently to human generated fraud materials. Ofcom also confirms that this applies to Content that is created on the platform where it is shared and Content which has been uploaded by a user from elsewhere. 
• The Act applies to sites and apps that include Generative AI tools that can generate pornographic material.

In relation to search services:

• Generative AI tools that enable the searching of more than one website and/or database will be 'search services' within the meaning of the Act. Ofcom confirms that this applies to tools that modify, augment or facilitate the delivery of search results on an existing search engine and to those which deliver 'live' internet results to users on a stand-alone platform. For example,  a Generative AI tool which responds to a prompt asking about 'health information' by providing live results from multiple health advice websites/chat forums.

What can we expect next?

Phase One: illegal harms 

• December 2024: 
  • The first duties to take effect once Ofcom publishes its final Illegal Harms Risk Assessment Guidance and Codes of Practice which is expected in December 2024.
  • Ofcom will also publish its: (i) final enforcement guidance and (ii) record keeping and review guidance. 
• Mid-March 2025: All providers of services in scope of the Act must complete their Illegal Harms Risk Assessments.
• Spring 2025: Ofcom to launch a further consultation which builds on the Codes of Practice published in December 2024.

Phase Two: Child safety, pornography and the protection of women and girls

• January 2025: 
  • Ofcom expects to issue its final age assurance guidance for publishers of pornographic content and expects the duties relevant to such providers to become enforceable around the same time and will commence monitoring for compliance.
  • Ofcom expects to publish children's access assessment guidance. From the date of publication, service providers will then have 3 months to complete the children's access assessment process.
• February 2025: Ofcom expects to publish its draft guidance on protecting women and girls.
• April 2025: Ofcom expects to publish its Protection of Children Codes and risk assessment guidance. Service providers who have services likely to be accessed by children must then carry out a children's risk assessment within 3 months of Ofcom publishing this guidance.
• July 2025:  Service providers of services likely to be accessed by children will be required to complete their children's risk assessments by July 2025 when Ofcom expects that the children protection safety duties will become enforceable.

Phase Three: categorisation and additional duties for categorised services

The Secretary of State is considering the recommendations put to it by Ofcom and will put forward draft secondary legislation on Category 1, 2A and B Services (Categorised Services). For more information on Categorised Services, see our previous article here on the research and advice submitted by Ofcom as to which categories of services it considers are high risk/reach to UK consumers and should have additional duties. While this advice and guidance was submitted by Ofcom in March 2024, in an updated version of Ofcom's roadmap (published on 17 October 2024), Ofcom confirmed that it is still waiting for the UK Government to confirm the thresholds for categorisation in the secondary legislation required to implement this.

• By the end of 2024: Ofcom expects the UK Government to have confirmed the thresholds applicable to the Categorised Services.
• Summer 2025:
  • Ofcom expects to publish the register of Categorised Services.
  • Within a few weeks of publishing the register of Categorised Services, Ofcom expects to issue draft transparency notices and to issue final transparency notices 'soon after' that.
• By no later than early 2026: Ofcom to publish draft proposal regarding the additional duties on categorised services

In the meantime, user-to-user services and search services, can prepare by:

• undertaking risk assessments to understand the risk of users encountering harmful content;
• implementing proportionate measures to mitigate and manage those risks; and 
• implementing measures to enable users to easily report illegal posts and material that is harmful to children. 

Like to hear more on this topic?

We have previously written about the Act here:

• Online Safety Act: Ofcom submits its research and advice on categorised services to the UK Secretary of State, Ally Clark, Duncan Calow
• Online Safety Act: Ofcom publishes illegal content guidance, Ally Clark, Duncan Calow
• Online Safety Act: Online Safety Bill approved by Parliament and ready for Royal Assent, Ally Clark, Duncan Calow
• Online Safety Act: Online Safety Bill passed by the House of Lords, Ally Clark, Duncan Calow
• Online Safety Bill: Progress through Parliament & Ofcom Implementation, Elizabeth Bingham, Duncan Calow, Alex Lowe
• Online Safety Act: Online Safety Bill arrives at the House of Lords, Ally Clark, Duncan Calow
• Online Safety Act: Further amendments to the Online Safety Bill not ruled out: Parliament battling over the scope and detail of the Online Safety Bill, Ally Clark, Duncan Calow
• Online Safety Act: The return of the Online Safety Bill, Ally Clark, Duncan Calow