The UK government announced on 15 February 2026 that all AI chatbot providers will be brought under the full scope of the Online Safety Act. Technology Secretary Peter Kyle confirmed plans to close a legal loophole that had allowed stand-alone AI chatbots to operate outside the Act's illegal content duties. Prime Minister Keir Starmer backed the move, telling reporters: "Technology is moving really fast, and the law has got to keep up."
This isn't about child safety in the abstract. It's about who carries the liability when an AI chatbot on your website generates content that falls foul of UK law. If your business uses any form of AI chat, from a customer service bot to an AI-powered search widget, you need to understand what just changed.
The coverage so far has focused on platforms like ChatGPT and Character AI. But the wording of the amendment captures something wider: any AI service that generates conversational content for UK users. That includes the chatbot sitting on your business website right now.
What Actually Changed
The Online Safety Act became law in October 2023. It placed duties on platforms hosting user-generated content to protect against illegal and harmful material. Search engines got a separate set of obligations. But AI chatbots that generate content (rather than hosting user-submitted posts) sat in a grey area.
According to the government's announcement, the amendment will force all AI chatbot providers to comply with illegal content duties under the Act. Peter Kyle didn't leave room for ambiguity:
"We will move fast to shut a legal loophole and force all AI chatbot providers to abide by illegal content duties in the Online Safety Act or face the consequences of breaking the law."
Peter Kyle, Secretary of State for Science, Innovation and Technology, GOV.UK
The word "all" is doing the heavy lifting. Previous enforcement had targeted specific categories: user-to-user platforms, search services, and sites hosting pornographic content. The amendment extends the Act's reach to any AI system that produces conversational output for users in the UK.
Ofcom, the regulator responsible for enforcement, had already begun engaging with AI providers. Dame Melanie Dawes, Ofcom's chief executive, said in January that her team had been "proactive in engaging with providers of AI chatbots that may be in scope to ensure they understand their obligations." That was before the loophole was officially closed. Now, the engagement becomes enforcement.
Who Is Actually Affected
Most news outlets have framed this around consumer AI platforms. Fair enough: ChatGPT has over 400 million weekly users, and Ofcom's updated codes of practice tighten requirements around children's access to AI content. But the regulatory language goes further than that.
If you run a business website with any of the following, this applies to you:
- AI-powered customer service chatbots that generate responses (not just scripted decision trees)
- AI search or recommendation widgets that produce text answers from your content
- Embedded third-party AI assistants (think ChatGPT widgets, Intercom AI, Drift AI, or similar)
- AI-powered product advisors that use large language models to answer customer questions
Scripted chatbots with pre-written responses aren't caught. The Act targets systems that generate content. The moment your bot uses a language model to produce an answer it wasn't explicitly programmed to give, you're in scope.
Ria Moody, a managing associate in the TMT team at Linklaters, pointed out the expanding scope of what counts as harmful content. "This will likely cause more content to be captured by this measure," she told The Guardian. That means businesses can't just rely on default safety filters built into the AI model. As the definition of "captured content" expands, you need to audit what your chatbot actually says to customers.
What UK Businesses Need to Do Now
The government hasn't published a detailed compliance timeline yet, but the direction is clear. Here's what you should be doing before it lands.
Audit every AI touchpoint on your site. List every place a customer can interact with AI-generated content. That includes support bots, FAQ generators, product recommendation engines, and any widget that uses GPT-4, Claude, Gemini, or another LLM behind the scenes. If you use a third-party service, check their terms: are they taking responsibility for compliance, or is it on you?
Test your chatbot's edge cases. The Online Safety Act covers illegal content categories including terrorism, child sexual exploitation, fraud, and harassment. Try to break your chatbot. Ask it about topics it shouldn't answer. If it produces content that could be classified as illegal under UK law, you have a problem that needs fixing before Ofcom comes looking.
Document your safety measures. Ofcom will expect evidence that you've taken "proportionate steps" to prevent illegal content. That means logs, moderation policies, content filtering rules, and evidence of regular testing. We covered the liability question two weeks ago: if AI generates your content, you're still responsible.
Review your website's architecture. Does your AI chatbot operate in a sandboxed environment, or does it have access to your full site content? Can it reference pricing, make claims about products, or generate statements that could constitute financial advice? The tighter the constraints on your AI, the lower your regulatory exposure.
Talk to your hosting and AI providers. If you use a managed chatbot service, find out what safety measures they've built in. Ask for documentation. If they can't provide it, that's your answer about whether they're ready for this regulation.
How Ofcom Will Enforce This
Ofcom already has teeth. Under the Online Safety Act, fines can reach up to 10% of a provider's global annual turnover, or £18 million, whichever is higher. For persistent failures, senior management can face criminal liability.
The regulator published codes of practice in late 2025 covering user-to-user and search services. Those codes detail specific steps platforms must take: age assurance, content moderation, risk assessments, and transparency reporting. The AI chatbot amendment will extend similar requirements to generative AI services.
For small businesses, proportionality matters. Ofcom won't expect a three-person consultancy to run the same moderation infrastructure as OpenAI. But it will expect evidence that you've considered the risks and taken reasonable steps. That could mean content filters on your chatbot's output, restricted topic boundaries, or human review of flagged conversations.
The CMA's parallel investigation into AI market power adds another layer. UK regulators are coordinating their approach to AI. What Ofcom does with the Online Safety Act will influence how the CMA, ICO, and FCA approach AI regulation in their own domains. Businesses that get ahead of the Online Safety Act requirements will be better positioned when those other regulations land.
Part of a Wider UK Regulatory Pattern
This move fits the UK government's broader approach to AI governance. In January, the government launched GOV.UK Chat, its own AI assistant for public services, built with safety guardrails from the start. That wasn't just a technology project. It was the government demonstrating what it expects from AI providers: controlled, auditable, limited to verified information.
The timing is deliberate. The EU AI Act enforcement begins this year. The US has executive orders on AI safety under review. The UK is positioning itself as a pragmatic middle ground: not banning AI, but insisting that AI providers meet the same content standards as every other publisher and platform.
For web businesses, the direction of travel is clear. AI on your website isn't a toy or an experiment anymore. It's a publishing channel. And publishing channels come with legal obligations.
If you haven't reviewed your AI chatbot setup in the context of UK law, now is the time. Check what your bot can say. Document what you've done to prevent harmful outputs. And make sure you know who's liable when something goes wrong, because under this amendment, the answer is almost certainly you.
Businesses that take AI visibility seriously tend to be the same ones that take AI governance seriously. The two go together. If you want AI systems to represent your business accurately, you also need to make sure they represent it safely. The AI Visibility Checker can help you understand how AI currently sees your site. What happens next is up to you.
Frequently Asked Questions
Does the Online Safety Act now apply to AI chatbots?
Yes. The UK government announced on 15 February 2026 that it will close the loophole that allowed AI chatbots to operate outside the Act's illegal content duties. All AI chatbot providers serving UK users will be required to comply.
Is my website chatbot affected by this change?
If your chatbot uses a large language model (GPT, Claude, Gemini, or similar) to generate responses rather than serving pre-written scripts, it falls within scope. Scripted decision-tree bots with fixed responses are not affected. The test is whether the system generates new content.
What are the penalties for non-compliance?
Ofcom can issue fines of up to 10% of global annual turnover or £18 million, whichever is higher. For persistent failures, senior managers can face criminal prosecution. Proportionality applies: smaller businesses face lower expectations, but must still demonstrate reasonable steps.
When does this come into effect?
The government has announced the policy intent but hasn't published a specific enforcement date. Ofcom has already begun engaging with AI providers. Businesses should start auditing their AI systems now rather than waiting for a formal deadline.
Who is liable: the business or the AI provider?
Both could be. The Act targets "providers" of the service. If you're embedding a third-party AI chatbot, check the terms of service to understand who carries responsibility. In practice, the business deploying the chatbot on its website will likely share liability with the underlying AI provider.
What types of illegal content does the Act cover?
The Act covers terrorism content, child sexual exploitation material, fraud, harassment, and other categories defined in UK criminal law. Ofcom's codes of practice also address content harmful to children, including self-harm and eating disorder material. AI chatbots must prevent the generation of any of these content types.
Do scripted chatbots need to comply?
No. Rule-based chatbots with pre-written, fixed responses are not in scope. The Act targets AI systems that generate new content using language models. If your chatbot only serves answers from a script or decision tree, it doesn't fall under these requirements.
How should I prepare my business for compliance?
Start by auditing every AI-powered touchpoint on your website. Test your chatbot with edge-case questions. Document your content filtering and moderation policies. Check whether your AI provider offers compliance documentation. Review your website maintenance plan to include regular AI safety audits.
Is Your AI Chatbot Ready for Regulation?
The Online Safety Act now covers AI chatbot providers. Check how AI systems see your business and whether your digital presence meets the new compliance requirements.
Check Your AI Visibility
