The United Kingdom has moved decisively to close a gap that regulators had flagged since the Online Safety Act first passed: general-purpose AI chatbots were not covered. PM Keir Starmer's government announced on February 16 that ChatGPT, Google Gemini, and Microsoft Copilot would now fall within the Act's scope.
What Changed
1
Scope Extension
ChatGPT, Gemini, and Copilot classified as regulated services under the Online Safety Act, triggering Ofcom oversight.
2
Minimum Age Enforcement
Platforms must implement verifiable age checks — not mere self-declaration.
3
Harmful Feature Restrictions
Infinite scrolling, autoplay, and algorithmic recommendation must be restricted for child accounts.
4
VPN Circumvention Controls
Platforms must take reasonable measures to prevent VPN-based age restriction bypass.
Implications for Product Teams
Any product that incorporates a third-party AI chatbot now inherits potential compliance obligations under the Online Safety Act if it has UK users.
- Audit every AI-powered conversational feature for potential child-facing exposure
- Review your age verification flow — self-reported date of birth is no longer sufficient
- Disable engagement-maximising features for users under 18
- Ensure vendor contracts with AI API providers include compliance obligations
- Monitor Ofcom guidance — implementation codes are still being published
Context: The Online Safety Act imposes fines of up to 10% of global annual turnover for non-compliance.
Our web development and custom software teams are already advising clients building UK-facing products. Talk to us before your next release.
Tags:
RegulationAI SafetyOnline Safety ActUK PolicyChildren Online
