Key takeaways
AI chatbots are subject to the Online Safety Act 2023 if they allow user-generated content or facilitate user-to-user communication. Ofcom has published specific guidance on AI chatbots and online regulation, confirming that the OSA applies to chatbot services where they could facilitate harm to users.
There is no specific exemption for AI in the Online Safety Act. An AI chatbot service that meets the definition of a user-to-user service or search engine -- or that hosts pornographic content -- is regulated under the Act and must comply with Ofcom's codes of practice.
The key question is whether the chatbot could be used to generate illegal content (terrorism, CSAM, fraud facilitation, extreme violence) or cause harm to children. If yes, the service has illegal harms duties and potentially children's safety duties. The mechanism of generation (AI rather than human) does not create an exemption.
Age verification is required for AI chatbot services that could expose children to adult content or harmful material. Services accessible to children must implement age-appropriate design including algorithm restrictions on harmful content recommendations and protections against grooming.
Ofcom's 2026 compliance priorities explicitly include AI services as part of the children's safety focus. Ofcom published guidance on 'AI chatbots and online regulation' and is monitoring how the OSA framework applies as AI services evolve.
Reviewed: June 2026Key facts
|
Does the Online Safety Act apply to AI chatbots?
The Online Safety Act 2023 does not contain an exemption for AI-generated content or AI-mediated services. Whether an AI chatbot service is regulated under the Act depends on whether it meets the statutory definitions of a regulated service -- specifically, a user-to-user service (a service that allows users to generate, upload, share or interact with content), a search service, or a service hosting pornographic content.
Most consumer-facing AI chatbot services meet the definition of a user-to-user service because users input prompts (which are a form of user-generated content) and may be able to share or interact with AI outputs. Even a chatbot that generates responses entirely through AI -- without content from other users -- may fall within scope if its outputs could be used to facilitate harm.
Ofcom has published guidance on AI chatbots titled 'AI chatbots and online regulation -- what you need to know', available on its website. The guidance confirms that Ofcom is treating AI chatbot services as regulated services where they meet the relevant statutory definitions, and that the mechanism of content generation (AI rather than human) does not in itself create an exemption.
Illegal harms duties and AI
If an AI chatbot service could be used to generate or facilitate illegal content -- including terrorist propaganda, child sexual abuse material, fraud-enabling content or content facilitating serious violence -- the illegal harms duties under the Online Safety Act apply. The service must conduct a risk assessment, implement proportionate safety systems, and comply with Ofcom's illegal harms codes of practice.
For AI services, this risk assessment must address the specific ways in which AI generation could be exploited. A large language model that can be prompted to generate bomb-making instructions or child sexual abuse narratives has an illegal harms risk profile even if the service is primarily intended for legitimate purposes. The risk assessment must address these potential misuses.
Ofcom's codes of practice for illegal harms set out specific technical and operational measures. For AI services, relevant measures include: prompt filtering, output moderation, detection of attempts to generate illegal content, and rapid response mechanisms when illegal content generation is identified.
Children's safety and AI chatbots
The children's safety duties under the Act apply to AI chatbot services that are likely to be accessed by children. Ofcom's May 2026 research on children's media found that AI chatbot use is rising significantly among young people -- making this a growing priority area for enforcement.
AI services likely to be accessed by children must implement age-appropriate design, including age verification to prevent access to harmful content by under-18s. The algorithm restrictions in the children's codes apply to AI recommendation systems: AI that curates or recommends content to users must not surface content harmful to children in the feeds or suggestions it generates for under-18 users.
Ofcom has told major services used by children to meet clear expectations on protections against grooming and testing of new AI products before launch. An AI chatbot designed to engage with children must be tested for how it handles grooming-type conversations and must have safeguards to prevent it from facilitating such behaviour.
Age verification for AI services
AI services that host or generate adult content, or that could expose children to harmful material, must implement effective age verification. Ofcom's age assurance guidance (completed 2025) defines what constitutes highly effective age assurance -- robust age verification systems rather than self-declaration. An AI chatbot that can generate sexual content or other adult material must verify that users are over 18 before exposing them to such outputs.
The first Ofcom enforcement actions under the Online Safety Act were against pornography websites for failing to implement effective age verification. While those specific cases involved user-uploaded content rather than AI generation, the principle applies equally to AI services generating adult content.
What AI service providers must do
AI chatbot providers operating services accessible to UK users must: determine whether their service meets the definition of a regulated service; if so, conduct a risk assessment covering illegal harms and children's safety; implement safety systems proportionate to the identified risks; follow Ofcom's codes of practice or demonstrate equivalent compliance; implement age verification where required; and report illegal content to law enforcement through established channels.
Ofcom is monitoring the development of AI services actively. As the technology evolves -- particularly with the rise of agentic AI systems that can take actions rather than just generate text -- Ofcom is developing its regulatory approach. The 2026 Plan of Work includes AI services as part of the online safety priorities, and further regulatory guidance specific to AI is expected.
Related guides
Disclaimer: This guide is for informational purposes only. Kael Tripton Ltd is not regulated by the FCA. Sources: Ofcom, legislation.gov.uk, GOV.UK. Verify at ofcom.org.uk.
Frequently asked questions
Is ChatGPT regulated in the UK?
ChatGPT and similar AI chatbot services are subject to the Online Safety Act 2023 if they meet the definitions of a regulated service -- which they typically do as user-to-user services. Ofcom is the UK regulator for online safety. While Ofcom has not announced specific enforcement action against ChatGPT as of June 2026, its guidance confirms AI chatbots are within scope and must comply with illegal harms and children's safety duties where applicable.
Does the Online Safety Act apply to AI?
Yes. The Online Safety Act 2023 does not contain an exemption for AI services. An AI chatbot or AI content generation service that allows user interaction or hosts adult content is a regulated service under the Act. The mechanism of generation (AI rather than human) does not create an exemption. Services must comply with illegal harms duties and children's safety duties as applicable.
What must AI chatbot providers do to comply with Ofcom?
AI chatbot providers must: assess whether their service is a regulated service under the OSA; if so, conduct risk assessments for illegal harms and children's safety; implement proportionate safety systems; comply with Ofcom's codes of practice; implement effective age verification where required; and report illegal content to law enforcement. Failure to comply can result in fines of up to 10% of global annual turnover.
Are AI image generators regulated under the Online Safety Act?
AI image generation services that allow user prompts and could generate illegal imagery (such as child sexual abuse material) are within scope of the Online Safety Act's illegal harms duties. The risk assessment must address how the service could be used to generate illegal content and what measures are in place to prevent this. Age verification is required for services that can generate adult content.
What does age verification mean for AI chatbot services?
AI services that could expose children to adult or harmful content must implement effective age verification -- not just self-declaration but technical systems that provide a reliable barrier against under-18 access. Ofcom's 2025 age assurance guidance defines what constitutes highly effective age assurance. Chatbots that can generate sexual content or other adult material must verify user age before enabling such capabilities.
What is Ofcom doing about AI in 2026?
Ofcom included AI services in its 2026 compliance priorities, particularly in the context of children's safety. It published guidance on 'AI chatbots and online regulation' and the May 2026 research on children's media found rising AI chatbot use among young people. Ofcom is monitoring AI developments and expected to publish further guidance as agentic AI and other advanced AI services become more prevalent.
Can an AI chatbot be fined under UK law?
The company operating the AI chatbot service can be fined, not the AI itself. Under the Online Safety Act, Ofcom can fine operators of non-compliant services up to 10% of global annual turnover or 18 million pounds, whichever is higher. Senior managers of regulated companies can also face criminal liability in certain circumstances where they knowingly cause or allow serious failures.
Where can I find Ofcom's guidance on AI chatbots?
Ofcom's guidance on AI chatbots and online regulation is available at ofcom.org.uk/online-safety under the illegal and harmful content section. The guidance is titled 'AI chatbots and online regulation -- what you need to know' and is aimed at both consumers and service providers.
