Call for Evidence Response from FRACTAI – The Foundation for Research, Accreditation, Communication and Training in AI. Non profit professional body for AI.
2) What evidence, if any, is there that UK users are less exposed to illegal content and activity since the OSA illegal content duties came into force?
This aim of the Act in this respect should generally be seen as counterproductive. Children didn’t stop seeing the content that they were seeing previously. The Act also classified more types of material as illegal. This means that children are seeing more illegal content because they’re seeing the same volume and types of content and more of that content is now considered illegal. Children also have workarounds to access platforms. The illegal content will also move between platforms.
4) Have the OSA’s provisions been effective in driving services to a) identify relevant risks, b) take proportionate action that adequately mitigates those risks, and c) make meaningful changes to their systems, processes and design features?
No because OSA comes from a reactive space not a proactive space. Building in mitigations and understanding user groups is the only way to do this. Being reactive in the AI space is like plugging a leaky bucket, you are never able to stop fighting all of the fires because you have not addressed the root cause. Simeko AI in conjunction with the University of Bristol alongside FRACTAI (The professional body for AI) are addressing this and I am sure would be happy to work with you to address root causes.
There is no mis and dis information per se there is only subjective information. Not all information is correct, robust or relevant, it has to be analysed. We should look to the education system to not only provide classes in this but to the QAA who refuse to make AI a discipline and refine benchmark statements to ensure it is taught properly. If you do not educate people in ethical and robust AI development they will not be able to build it properly or use it properly and we end up with more AI output that cannot be curtailed by such things as OSA. Much information that has come out of official bodies in recent years has been incorrect or misleading but that is not taken down and a fine applied.
Mis-/disinformation doesn’t have that categorisation as some inherent metaphysical property. Rather, such a designation is gained when it interacts with a social and political community that can react against it. This is one of the essential failings of the Act: it supposes inherency when the reality is one of vagueness and uncertainty. Misinformation may be regarded simply as information in a different social or political context. The Act has already been criticised for interfering with the right to privacy. This is not an exogenous consequence of poor drafting, it is inherent to the functioning of the Act itself: because the Act cannot define mis-/disinformation (and therefore combat it), the Act must instead police the social and political community in order to fulfil its basic functions. Violations of privacy are built in to the operation of the Act because it is the only level on which the Act has analytical and evaluative power.
If such activities as prostitution and print pornography cannot be regulated what is the proposal to regulate pornography or sex workers. What is really being discussed here is crime, which should be a matter for our police and security services to deal with. This does not constitute the whole of pornography.
Currently software used by MoJ is not assured or audited and has been used in courts to potentially incorrectly convict and sentence defendants. These companies are for profit and are allowed to present evidence in a non-transparent way that then is used by the justice system in an incorrect way. The OSA has no provision for this.
The Act also fails to understand mechanisms for the generation and delivery of harmful content: in particular, its aims are hindered by the fact that the UK does not have a unified AI regulation regime. The state cannot regulate the distribution of harmful content to children when legislation does not cover the primary mechanisms by which that content is delivered to children. Because AI content is often generated from large volume of training data, which comes from across the internet, it can contain elements that are true, that are false or that are anything in between.
Attempting to regulate information systems such that the state can understand what qualifies as ‘harmful’ content under such a regime is futile, because each piece of content will have to be individually assessed and it is subjective.
5) Has the OSA impacted users’ ability to report illegal content or content harmful to children, make complaints and receive an appropriate and timely response, and to what extent?
The internal processes of social media and websites do not work. On reporting harmful content it appears to be some sort of bot that then comes back and rejects users complaints. This is the same for search engines when problems are flagged. Harmful content such as weight loss drugs and similar is still shown to everyone because the platform considers profit above safety. The problem is you cannot reverse engineer safety; it has to be undertaken within root cause methodology and AI/software build.
6) What unintended consequences, if any, have arisen from the Act or its implementation, including for freedom of expression, privacy and accessibility?
There are serious repercussions for freedom of speech, the OSA and similar regulations are pushing software companies very hard into censorship which is highly dangerous and deleting what is perceived as ‘harmful content’ but which perhaps is not. This has allowed people to be deleted from social media just for having an opinion. In addition many deleted people have gone underground and are radicalising because this speech cannot then be challenged. This type of concept must be formed with the input of experts in sociology, psychology and philosophy. This problem has been seen in government work also and where services users are cut off from services which is causing suicide and harms to the public. This disproportionately affects the vulnerable.
8) What changes, if any, are needed to improve the effectiveness of Ofcom’s a) illegal content and protection of children codes of practice, b) guidance on violence against women and girls, or c) wider regulatory approach?
Root cause and build regulation rather than firefighting a for profit companies.
9) Where duties are in force, how effective and timely have Ofcom’s supervision and enforcement been in driving improvements and securing compliance?
By firefighting OFCOM is, by definition, chasing content. We can’t eradicate the internet of illegal content but we can look at root cause and build better. This means that it would take time for content to be stopped and by then the damage is done. A good reference for this is the Perez Hilton suicide attempt broadcast online. Live TV is normally a few seconds behind broadcast with producers and a full team overseeing it so that anything harmful can be stopped, perhaps this type of approach could be put into live broadcasts on the internet thereby providing some delay and option to cut to the content. The issue with this is oversight. This could also be used incorrectly to enforce censorship.
10) Are there any factors that may be limiting Ofcom’s ability to carry out its duties under the OSA effectively? If so, what changes are needed?
Adequacy and future of the legislative framework. Lack of root cause analysis and ethical build enforcement. Firefighting rather than a proactive approach. Not examining alternative solutions.
12) Beyond amending the OSA, what specific action should the Government, Ofcom, regulated services or Parliament take to address any shortcomings in the online safety regime?
Look for alternative avenues such as community groups. The UK lost a lot of community centres and youth centres that were critical to community building. This might be why people have turned to social media. Before this loss people could turn to their own community, now, under successive governments, communities are more fragmented than ever. Building communities fosters mental resilience and provides a safety net, taking away the key blocks of community and fragmenting them with increased immigration with little reasonable integration policy has caused serious damage to the UK population. ‘Lack of finance’ is always quoted here but I think it can be said that the UK is currently spending on unfit for purpose contracts, taxpayers money is being used inappropriately and there could be a step change in efficient spending. In addition, the taxes on employing staff are so high it is no wonder that early careers and students have now lost opportunities to get jobs as their entry level jobs are replaced by robot tills and qr codes and numerous small businesses have no choice but to close thereby robbing a community of a service and critical long term business that knows them. This also robs the young of options to be part of a team and create community and to earn money to be self-sufficient and have a sense of pride. The insistence on poor policy has caused these changes over the last couple for decades. This is one of the major reasons people go online, to try to make up for that lack of community and they hope to find it with strangers. There are clearly significant problems here but one large one is that on their internet journey they are now bombarded with advertising and illegal content. There are more ways to solve this problem than solely working on online safety. In addition, the insistence on everything being online at school removes responsibility, accountability and keeps kids attached to a computer which increases the likelihood of harm. You have to ask, why are people online and is it productive? How many hours are now lost to scrolling and doomscrolling whilst we see increasing self harm and mental health problems. This could be looked at as akin to smoking where the Government tried to solve it with vapes and created a significantly larger issue by children being encouraged to use vapes, massive plastic pollution and increased nicotine delivery. This did not help the NHS nor help people quit. The sad part of this was at the time smoking was starting to become unpopular with an increased focus on fitness and the smoking ban was working. This indicates a lack of joined up approach and the concern is that the same is happening here.
13) How well can the existing online safety framework respond to emerging harms and technologies? What changes, within the existing framework of the Act, are needed to ensure that it remains fit for the future, and should these be made within the existing framework or through further primary legislation?
Very slowly and with little impact without constant surveillance which is, in itself, inappropriate. As seen with Perez Hilton, the dispersal of this video could not be stopped for some time and still exists.
The government’s deal with social media platforms over COVID that allowed them to simply delete people for having an opinion or indeed delete peer reviewed papers ushered in an era of censorship. However, when people are actually being bullied online the response from the platform is that it is not bullying. This could be seen as gaslighting. The ‘for profit’ nature and global reach of platforms means that the platform has significant freedom. Government trying to regulate this industry has failed to happen in good time despite many warnings and the firefighting and laser focus on online will mean it continues to do so. New platforms will emerge and new methods of circumventing undertaken by platforms or people will always emerge. Illegal content is still on the dark web and not difficult to access. It just moves as it would do in the real world.
Adults have very little control over what they see. Even asking for a certain type of ad to be removed lasts only a certain period of time before it comes back. The brainwashing and manipulation inherent in the content shown to adults is vast and exacerbated by devices ‘listening’ and the showing similar content across platforms. Many adults would probably wish they could unsee a lot of what the internet has fed them.
By convicting people for online activity the doors are now opened for people to be spoofed and for convictions to be undertaken that are not even capturing the real person and placing huge restrictions on free speech.
14) What impact could the recent and proposed additions to the UK’s online safety framework, including the Government’s proposals to restrict access to social media for under 16s, have on the OSA’s implementation and effectiveness?
In order for OFCOM to take action a person has to come forward, a huge amount of evidence has to be provided and then taxpayers money is taken and often wasted to try to prosecute when OFCOM is up against highly paid private sector lawyers. This is somewhat futile and the costs borne by the platform are so small that it really doesn’t matter to them. They can always replace people with AI and save the money some other way.
It would be prudent here to consider the regulation of ‘for profit’ and industry/innovation. In addition what must be considered is the effects platforms have when mirrored back into society through altered human behaviour that was learned on the platforms.
Children still access inappropriate online gaming and are able to speak with unknown adults in this environment which can lead to grooming and exposure to inappropriate language and content. In addition this is all leading the government towards a very oppressive stance because in order to reverse engineer ‘safety’ into the online space it risks oppressing people in language and in freedoms as well as violating privacy and demanding far too much online in terms of code inputs and verification. For example some people are unable to get bank accounts without a smartphone and for those with special needs there have been instances where they are told outright they can’t have an account. This is unconscionable but the lack of branches and discretion and the insistence on full technology approaches are utterly inappropriate. Cookies and codes cause millions of hours of lost productivity and time as well as create frustration meaning that many now choose not to engage with certain services. Getting onto a bank account app should not be the same process as accessing secret or top secret government networks.
Videos and audio being created of people as well as storage on the dark web is now a leading and frightening consequence to many people of being on the internet. Unfortunately because OSA has come far too late the retrospective impact is too small and not aligned to root cause meaning the ability to mitigate the above issues has come too late.
An important test of the Online Safety Act (OSA) is whether it can move beyond evidence of procedural compliance towards evidence of measurable harm reduction. The central issue is accountability for outcomes. A provider may be able to demonstrate that it conducted a risk assessment, introduced a safeguard or complied with a code. That is necessary, but it does not by itself demonstrate that users became safer. Where a material risk has been identified, providers should also be expected to demonstrate what safeguard was selected, when it became operational, what indicators were monitored afterwards, and whether the relevant harm reduced, persisted or changed form. This could be described as an auditable “risk receipt”: [risk identified → safeguard selected → safeguard activated → impact monitored → effectiveness demonstrated → safeguard revised where harm persists].
This should be longitudinal rather than a one-off compliance exercise. For significant risks, particularly those affecting children, platforms should retain auditable evidence of the timing of risk identification, implementation of mitigation, subsequent outcome measures and any further action taken. The objective is not to demand that every harm disappears immediately, but to make it possible for Ofcom to assess whether an intervention is demonstrably working and whether a provider responded quickly enough when it was not. This approach is consistent with issues raised in the Committee’s evidence session with Ofcom on 15 September 2026. When Lord Tarassenko asked what single change to the OSA would make the greatest difference, Mark Bunting highlighted stronger engagement with large companies across the totality of their risk-assessment and risk-management processes. Suzanne Cater identified practical shortcomings in the operation of business-disruption measures, while Oliver Griffiths argued for stronger powers to require proactive technology.
Ofcom stated that, although it had publicly criticised major platforms for failing to enforce their own minimum-age requirements, it did not have the power to compel them to do so. This exposes a significant accountability gap between statutory safety duties and voluntary platform policies. Parliament should therefore consider creating an explicit duty requiring regulated services to enforce their stated minimum-age requirements through effective age assurance, with corresponding enforcement powers for Ofcom. A platform should not be able to present a minimum age as a safety measure while the regulator remains unable to require its meaningful implementation.
These observations suggest that the next phase of the regime should focus not only on whether processes exist, but on whether providers can be held accountable for the effectiveness of those processes. Recent developments outside the OSA also show what platforms are technically capable of implementing. Meta’s 2026 agreement with a bipartisan group of 52 US attorneys general includes default daily time limits for teenagers, restrictions on overnight access, muted school-hour notifications, repeated usage prompts, enhanced parental controls and independent auditing. Whatever view is taken of the settlement itself, it demonstrates that significant design-level interventions and continuing external oversight are technically feasible. This raises an important question of consistency across jurisdictions. Nighat Dad (founder and Executive Director of the Digital Rights Foundation and a founding member of Meta’s Oversight Board) has argued that where protections are technically available, excluding teenagers elsewhere is a choice rather than a technical necessity. Her broader point is important for the UK: a company’s capacity to mitigate an identified risk should not become relevant only after litigation or regulatory pressure in a particular jurisdiction. Ofcom itself told the Committee that where a company has committed to protections elsewhere, it would encourage that company to make similar commitments in the UK.
Age restrictions also cannot be treated as a complete safety strategy. The UK Government has announced an under-16 social-media ban, stronger age checks and additional restrictions on high-risk features, while also recognising the need to address circumvention and risks arising from AI chatbots. In the Committee hearing, Ofcom noted that VPN use increased following age-gating measures and referred to the Australian experience of circumvention which was not as successful as intended. This reinforces the need to regulate the design and operation of services as well as entry to them.
The European Commission’s proposed EU KIDS Act offers a useful comparative development. It combines age-based access rules with a stronger safety-by-design approach and explicitly reverses the burden of proof by requiring providers to show that services are age-appropriate and safe by design. This moves regulation closer to the architecture of platforms themselves: recommender systems, engagement mechanisms, contact features and AI systems, rather than relying solely on content removal or age gates after harm has already arisen. However, this is just a proposal so far, and its application needs observation.
A child-rights framework supports this direction. The UN Committee on the Rights of the Child’s General Comment No. 25 states that businesses should respect children’s rights in the digital environment and that states should require child-rights due diligence, including impact assessment, monitoring, transparency and appropriate safeguards in the design and operation of digital services. The UN Guiding Principles on Business and Human Rights similarly provide a framework for companies to identify and address human-rights risks. This is relevant because protection should not depend entirely on parents or children successfully navigating systems whose underlying architecture may itself create or amplify risk.
A principal recommendation could therefore be that the implementation and future development of the OSA should place greater emphasis on demonstrable safeguard effectiveness. In practical terms, this means requiring regulated services, proportionate to their size and risk, to maintain auditable evidence linking identified risks to interventions and measurable outcomes over time; giving Ofcom sufficient powers to examine and challenge that evidence; and requiring safeguards to be revised where monitoring shows that harm persists or migrates elsewhere in the service.
The important regulatory question should therefore become not only: “Did the provider put a safeguard in place?”, but also: “What evidence shows that it reduced the identified risk, for whom, and how quickly?”
For an outcomes-based online-safety regime, implementation is only the beginning. The meaningful measure of success is whether risk is reduced in practice, before preventable harms become entrenched or irreversible.