The UK’s Online Safety Act is not an AI law, but it increasingly intersects with AI. New guidance from Ofcom, published in December 2025, clarifies that AI chatbots operating on user-to-user services or search services can fall within the Act’s scope. For platform operators, this means chatbot-generated content must be part of the safety picture, not treated as a separate system.
The guidance matters because many services use chatbots to answer questions, recommend content, moderate comments or assist users. If that chatbot is embedded in a regulated service, its outputs may be treated as part of the service’s content risk profile.
When a chatbot is in scope
Ofcom’s guidance focuses on two main categories. First, user-to-user services: platforms that allow users to interact with each other. If a chatbot is part of that interaction — for example, by generating replies, suggesting messages or moderating discussions — the platform’s duties to assess and mitigate harm apply to the chatbot’s outputs as well as user-generated content.
Second, search services: services that search multiple websites or databases and present results. A chatbot that summarises search results or generates answers on behalf of a search engine may bring the service within scope, particularly if the chatbot produces content that could be illegal or harmful.
The key point is functional, not technical. Ofcom looks at what the service does, not whether the output came from a person or a model. A chatbot that generates harmful content at scale can create the same regulatory exposure as a human user doing the same thing.
What operators need to do
For in-scope services, the implications are practical. Risk assessments must include chatbot-generated content. Safety systems must account for the ways chatbots can produce illegal material, amplify harm or bypass moderation. Transparency reports should explain how chatbot risks are managed.
Operators also need to think about upstream design. The model provider, the prompt engineering layer and the retrieval system all influence what the chatbot says. Safety cannot be delegated entirely to the model vendor; the platform remains responsible for the service it offers to users.
The broader signal
The guidance is part of a wider pattern. Regulators are applying existing laws to AI rather than waiting for AI-specific statutes to catch up. Data protection, consumer protection, competition law and now online safety all apply to AI systems in familiar ways.
For UK firms, this means AI governance cannot be siloed in a future AI Bill. It has to be part of how the business manages its existing regulatory obligations. A chatbot team that does not speak to the online safety team is a compliance risk waiting to materialise.
The bottom line
Ofcom’s clarification removes any ambiguity: AI chatbots on regulated services are not outside the Online Safety Act. Platform operators should review their risk assessments, moderation systems and reporting to ensure chatbot outputs are covered. The safest assumption is that if a chatbot can produce content on your service, it can produce regulated content too.