AI Regulation Tracker  /  Regulator guidance

UK: Ofcom says many AI chatbots already carry Online Safety Act duties

Ofcom has confirmed that a large share of generative-AI chatbots are regulated services under the Online Safety Act, and it has opened a formal investigation, into X's Grok. Any firm running a consumer chatbot for UK users should check whether it now owes illegal-content and age-assurance duties.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Ofcom has told AI chatbot operators something many of them did not want to hear: a large number of these products are already regulated services, and the duties are live now.

In an explainer published in spring 2026, the UK communications regulator set out how the Online Safety Act applies to generative-AI chatbots. The headline point is that the label "AI" does not create an exemption. Where a chatbot performs the same functions the Act already regulates, it carries the same duties as any other in-scope service.

The three triggers that pull a chatbot into scope

Ofcom's explainer identifies functions that bring a generative-AI chatbot inside the Act. A chatbot that lets users share AI-generated output with other users is treated as a user-to-user service. A chatbot that searches the web functions as a search service. And a chatbot that can produce pornographic content falls within the regime that requires providers to keep such material away from children. Meet any of these tests and the service owes illegal-content duties, and, where pornography is possible, age-assurance duties.

Those duties are not new inventions for AI. They are the existing obligations under the Online Safety Act: assessing the risk that UK users encounter illegal content, taking proportionate steps to prevent it, removing illegal material when the provider becomes aware of it, and, for services where children could see pornography, using highly effective age assurance.

The practical effect is that a chatbot company inherits the same compliance backbone Ofcom has been building for social platforms and search engines. That means a documented illegal-content risk assessment, record-keeping the regulator can inspect, and named accountability for safety decisions. For a young AI product that treated moderation as a feature to add later, this reframes it as a legal baseline that has to exist before a UK launch, not after.

The Grok investigation shows the theory is now practice

Ofcom moved from explanation to enforcement quickly. On January 12, 2026 it opened a formal investigation into X over reports that its Grok chatbot was being used to create and share illegal non-consensual intimate images and child sexual abuse material. The investigation examines whether X assessed the risk of UK users seeing illegal content, took appropriate steps to prevent it, removed it swiftly, protected users' privacy, assessed risks to children, and used effective age assurance to keep pornography away from them.

The stakes are concrete. Under the Act, Ofcom can impose fines of up to 18 million pounds or 10 percent of a firm's qualifying worldwide revenue, whichever is higher. That figure is why product and legal teams at chatbot companies should treat the scope question as a board-level matter, not a footnote. The Grok case also signals how Ofcom is likely to identify targets: public reporting and third-party research about how a tool is being misused can be enough to prompt a formal investigation, so operators cannot rely on the absence of direct complaints to assume they are safe.

What the explainer does not do

The explainer does not put every chatbot inside the Act. A closed assistant that only answers the individual user, does not search the open web, and cannot generate pornographic content may sit outside the current user-to-user and search definitions. The regime is function-led, so the analysis has to be done feature by feature rather than at the level of "is this an AI product." Operators that ship new features, such as sharing or web browsing, can move a service into scope without intending to.

A proposed expansion to watch, not to act on yet

Separately, and this is a policy signal rather than current law, the UK government has indicated it intends to bring standalone consumer AI assistants, such as widely used general chatbots, more squarely into the Act's illegal-content duties. That would widen the regime beyond the present carve-outs for purely one-to-one assistants. It is proposed, not enacted, and no firm date is confirmed, so it should inform planning rather than compliance today.

For a US reader, the cross-border angle is direct. The Online Safety Act reaches services with links to the UK regardless of where the company sits, so a US chatbot firm serving UK users is squarely in scope. The Grok investigation, brought against a US-headquartered platform, makes that reach explicit rather than theoretical.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.