Ofcom Guidance: UK Online Safety Act and Generative AI Chatbots

Overview

On 8 November 2024, Ofcom, the UK's statutory communications regulator, issued an open letter to online service providers operating in the United Kingdom. The letter, signed by Lindsey Fussell, Interim Group Director for Online Safety, serves as a crucial clarification regarding the application of the Online Safety Act 2023 (OSA) to Generative Artificial Intelligence (AI) and chatbot tools. This intervention by Ofcom was prompted by a series of distressing incidents involving online harm facilitated by Generative AI, including cases where chatbots were used to mimic real individuals and deceased children, as well as other instances of harmful content generation. The primary objective of this guideline is to remind service providers of their existing and impending duties under the OSA, explicitly stating that the Act's regulations extend to AI-generated content and services in the same manner as human-generated content. Ofcom emphasizes the mandatory nature of these duties and signals its readiness to take enforcement action, including imposing fines, against providers who fail to comply, urging them to prepare for compliance immediately.

The letter underscores that the rapid advancement and widespread adoption of Generative AI necessitate a clear regulatory stance to protect users from potential harms. It highlights specific scenarios where Generative AI falls within the scope of the OSA, such as when AI chatbots are integrated into user-to-user services, when platforms allow users to create and share their own AI chatbots, or when AI tools function as search services. Furthermore, services that can generate pornographic material using AI are also explicitly brought under the Act's purview, particularly regarding age assurance requirements. By issuing this guideline, Ofcom aims to ensure that online service providers proactively assess and mitigate the risks associated with Generative AI, fostering a safer online environment in line with the foundational principles of the Online Safety Act. The communication serves as a direct call to action for the industry to integrate AI-related risks into their compliance strategies before the full commencement of various OSA duties.

Definitions

The open letter clarifies several key terms within the context of the Online Safety Act's application to AI, ensuring that service providers understand the scope of their obligations. Generative AI is defined as AI models capable of creating text, images, audio, and videos in response to a user prompt. This broad definition encompasses a wide array of AI tools that generate content rather than merely processing or analyzing existing information. The letter specifically addresses how such tools, when integrated into online services, trigger duties under the OSA. It also clarifies that any AI-generated text, audio, images, or videos shared by users on a user-to-user service constitute user-generated content, and are therefore regulated in the same way as human-generated content. This means the origin of the content (human or AI) does not alter the service provider's responsibility for its safety and legality.

The document further delineates the types of services that fall under the Act's scope. User-to-user services are defined as sites or apps that enable their users to interact with each other by sharing images, videos, messages, comments, or data. Crucially, this definition extends to services where a Generative AI chatbot allows users to share AI-generated content with other users, or where users can create and share their own Generative AI chatbots with others. This includes platforms with 'group chat' functionality involving chatbots, or services providing tools for users to create chatbots that mimic real or fictional personas for public interaction. Additionally, search services are identified as Generative AI tools that enable the search of more than one website and/or database. This includes tools that modify, augment, or facilitate the delivery of search results on existing search engines, or those providing 'live' internet results on standalone platforms. The letter provides an example of a standalone Generative AI tool serving up live health information results, classifying it as a regulated search service.

Governance and Institutional Framework

The governance framework for the application of the Online Safety Act to Generative AI and chatbots is firmly anchored with Ofcom, the designated regulator for online safety in the United Kingdom. Ofcom's authority stems directly from the Online Safety Act 2023, which grants it powers to ensure online service providers protect users from illegal and harmful content. The open letter itself is an exercise of Ofcom's regulatory function, clarifying how existing legislation applies to emerging technologies like Generative AI. Lindsey Fussell, Ofcom's Interim Group Director for Online Safety, signed the letter, signifying the regulator's commitment and direct involvement in addressing these complex issues. Ofcom's role encompasses issuing guidance, developing codes of practice, monitoring compliance, and enforcing the Act's provisions, including the imposition of fines for non-compliance. This proactive engagement demonstrates Ofcom's agile approach to regulating a rapidly evolving digital landscape, ensuring that the principles of online safety are upheld even as new technologies emerge.

Ofcom's mandate under the Online Safety Act is comprehensive, covering a broad spectrum of online harms. By explicitly extending the Act's reach to Generative AI, Ofcom is establishing a clear expectation that providers of these advanced tools are not exempt from their responsibilities. The regulator's approach is to treat AI-generated content no differently from human-generated content when it comes to assessing risks and applying duties. This ensures a consistent regulatory environment where the focus remains on the potential for harm, regardless of the content's origin. Ofcom's website serves as a central hub for information regarding these duties, offering resources such as a 'regulation checker' tool and channels for submitting enquiries, thereby facilitating compliance for service providers. The institutional framework is designed to be responsive, with Ofcom continuously developing and publishing further guidance and codes of practice to support the implementation of the Act's duties, particularly concerning risk assessments and mitigation strategies for various types of online harm.

Key Focus Areas

The open letter highlights several key areas where the Online Safety Act's duties specifically apply to Generative AI and chatbots. Firstly, it clarifies that sites or apps that allow users to interact with each other by sharing content, and which incorporate Generative AI chatbots enabling the sharing of AI-generated text, images, or videos among users, are considered 'user-to-user services' under Part 3 of the Act. This includes services with group chat functionality where multiple users interact with a chatbot simultaneously, whether the chatbot is a primary feature or part of a larger social media platform. Secondly, platforms that allow users to create their own Generative AI chatbots – 'user chatbots' – which are then made available to other users, also fall under the user-to-user service definition. This is particularly relevant for services that provide tools for creating chatbots mimicking real or fictional personas, which can then be submitted to a library for others to interact with. In both these scenarios, any AI-generated content shared is deemed 'user-generated content' and is regulated identically to human-generated content, meaning deepfake fraud material, for instance, is treated no differently from human-generated fraud material.

Thirdly, Generative AI tools that facilitate the search of more than one website and/or database are classified as 'search services' within the meaning of the Act. This encompasses tools that modify, augment, or facilitate the delivery of search results on existing search engines, as well as those providing 'live' internet results to users on a standalone platform. An example provided is a standalone Generative AI tool serving up live results from health advice websites and patient chat forums in response to a user query, which would qualify it as a regulated search service. Finally, the letter explicitly states that sites and apps featuring Generative AI tools capable of generating pornographic material are regulated under Part 5 of the Act. These services are mandated to implement highly effective age assurance measures to prevent children from accessing such material. Across all these categories, Ofcom's overarching message is that the presence and functionality of Generative AI do not diminish a service provider's obligations under the Online Safety Act; rather, they bring these services firmly within its regulatory scope, requiring proactive measures to ensure user safety.

Implementation Framework

Ofcom's open letter outlines a clear implementation framework for online service providers to ensure compliance with the Online Safety Act in the context of Generative AI and chatbots. Providers of user-to-user services and search services are strongly encouraged to prepare immediately for compliance with the relevant duties. A core requirement is undertaking comprehensive risk assessments to understand the potential for users to encounter harmful content generated or facilitated by AI. This involves identifying, assessing, and mitigating risks posed by Generative AI, such as the generation of illegal or inaccurate content, or content harmful to children. Following these assessments, services must implement proportionate measures to manage and mitigate identified risks. Furthermore, a crucial aspect of the framework is enabling users to easily report illegal posts and material that is harmful to children, ensuring accessible and effective reporting and complaints processes are in place. These foundational steps are essential for laying the groundwork for compliance before specific duties become enforceable.

The letter also provides insights into the timeline for the commencement of certain duties and the publication of supporting guidance. Ofcom indicates that the first duties related to illegal harms will begin to take effect from December 2024, coinciding with the publication of its final Illegal Harms Risk Assessment Guidance and Codes of Practice. These codes are expected to offer practical measures to help user-to-user and search services meet their duties and protect users from Generative AI risks. A significant milestone for services falling under Part 3 of the Act is the completion of their Illegal Harms Risk Assessment, which must be done by mid-March 2025. For pornography sites under Part 5, the government is expected to commence the relevant part of the Act around January 2025, when Ofcom plans to publish its Part 5 Guidance, making age assurance duties enforceable. While the duties are not all live simultaneously, Ofcom stresses that there is no reason for providers to delay taking immediate steps to protect their users and prepare for full compliance, especially given the mandatory nature of the Act's requirements.

Monitoring and Evaluation

The open letter from Ofcom implicitly and explicitly sets expectations for how online service providers should monitor and evaluate their compliance with the Online Safety Act, particularly concerning Generative AI. A key measure highlighted is the necessity for services to have a named person accountable for compliance with the Online Safety Act. This ensures clear responsibility within the organization for overseeing the implementation of duties related to Generative AI and other online harms. Furthermore, providers are expected to establish and maintain a robust content moderation function that is adequately resourced and well-trained. This function must be capable of swiftly identifying and taking down illegal posts and content harmful to children, regardless of whether it was generated by AI or humans. The emphasis on adequate resourcing and training underscores the complexity of moderating AI-generated content, which may present new challenges in detection and assessment.

Another critical aspect of monitoring and evaluation involves the deployment of highly effective age assurance mechanisms. This is particularly relevant for platforms where the generation of pornographic material is a possibility, ensuring that children cannot normally access such content. The letter also stresses the importance of having easy-to-access and easy-to-use reporting and complaints processes. These mechanisms are vital for users to flag harmful or illegal AI-generated content, thereby assisting service providers in their monitoring efforts and enabling timely intervention. By outlining these operational requirements, Ofcom ensures that service providers not only implement measures but also have the internal structures and processes in place to continuously monitor their effectiveness, respond to emerging harms, and adapt to the evolving landscape of Generative AI risks. The regulator's supervision team is available to support providers with queries, further indicating a framework of continuous engagement and oversight.

Penalties, Liability, and Appeals

Ofcom's open letter unequivocally states that the duties set out in the Online Safety Act are mandatory, leaving no room for ambiguity regarding the legal obligations of online service providers in the UK. The regulator is prepared to take robust enforcement action against companies that fail to meet these duties, particularly concerning the application of the Act to Generative AI and chatbots. This enforcement action may include the issuance of significant fines, serving as a powerful deterrent against non-compliance. The letter explicitly warns that Ofcom will not hesitate to use its powers to ensure that platforms protect their users from online harms, irrespective of whether the content is human-generated or AI-generated. This commitment to enforcement underscores the seriousness with which Ofcom views the potential risks posed by Generative AI and its determination to hold platforms accountable for their responsibilities under the Act.

While the letter focuses on the mandatory nature of the duties and the potential for penalties, it also implicitly touches upon liability by emphasizing the need for service providers to undertake risk assessments and implement proportionate mitigation measures. By doing so, platforms are expected to proactively manage their exposure to risks that could lead to breaches of the Act and subsequent enforcement action. Although the letter does not detail specific appeal mechanisms, the broader framework of the Online Safety Act includes provisions for judicial review and appeals against Ofcom's decisions. However, the immediate message to providers is clear: prioritize compliance to avoid triggering enforcement proceedings. The threat of fines and regulatory action serves as a strong incentive for companies to invest in the necessary resources, expertise, and systems to ensure their Generative AI tools and services operate within the bounds of the Act, thereby minimizing their liability and the risk of penalties.

Relationship to Other Instruments

This open letter is intrinsically linked to and serves as a direct interpretive instrument for the Online Safety Act 2023 (OSA). Its primary purpose is to clarify how the provisions and duties established by the OSA apply specifically to the rapidly evolving domain of Generative AI and chatbots. Ofcom, as the designated regulator for the Act, is exercising its mandate to provide guidance and ensure that the legislation remains effective and relevant in the face of new technological developments. The letter repeatedly references the Act's definitions of 'user-to-user services' and 'search services', and explicitly states that AI-generated content is considered 'user-generated content' under the Act, thus bringing it squarely within the existing regulatory framework. This demonstrates a strategic approach to leverage existing legislation rather than immediately developing entirely new laws for AI, ensuring consistency and avoiding regulatory fragmentation.

While the letter's focus is on the direct application of the Online Safety Act, it operates within the broader context of the UK government's approach to AI regulation. The UK has articulated a 'pro-innovation approach to AI regulation' through its 2023 white paper, which sets out five principles for regulators to inform AI development across sectors. Although this open letter does not directly elaborate on these broader principles, its emphasis on risk assessments, proportionate measures, and accountability aligns with the government's overarching strategy for responsible AI development and deployment. Furthermore, the letter's mention of upcoming guidance and Codes of Practice, such as the Illegal Harms Risk Assessment Guidance and Part 5 Guidance, indicates that it is part of a series of regulatory instruments designed to operationalize the OSA. These future documents will provide more detailed instructions and best practices, building upon the foundational clarifications laid out in this open letter to ensure comprehensive compliance across the online services ecosystem.

International Alignment

Ofcom's open letter primarily focuses on the domestic application of the Online Safety Act 2023 within the United Kingdom's jurisdiction. The document is addressed specifically to "UK online service providers" and details how UK legislation applies to Generative AI and chatbots operating within the country. While the UK government is actively engaged in international discussions and initiatives related to AI governance, such as through its participation in global AI safety summits and its broader AI strategy, this particular open letter does not explicitly detail any specific international alignment efforts or cross-border cooperation mechanisms. Its scope is confined to clarifying and enforcing the UK's national online safety framework as it pertains to AI-driven services.

The letter's emphasis is on ensuring that service providers operating in the UK comply with the mandatory duties of the Online Safety Act, irrespective of where the Generative AI models or their developers might be based. This domestic focus reflects Ofcom's role as a national regulator responsible for safeguarding UK users. While the harms discussed, such as deepfakes or harmful content generated by chatbots, are often global in nature, the regulatory response outlined in this document is firmly rooted in the UK's legal and institutional framework. Therefore, for insights into the UK's broader international alignment on AI regulation, one would typically look to other government policy papers, such as the UK's AI White Paper or statements from the Department for Science, Innovation and Technology, rather than this specific operational guidance from Ofcom.

Implementation Timeline

Sources and References