Ofcom crisis rules take effect Nov. 2, 2026, leaving crisis calls to UK platforms

Under the UK Online Safety Act’s crisis-protocol rules, social media platforms must prepare written emergency moderation plans and dedicated law-enforcement communication channels, with the requirements taking effect on November 2, 2026. The obligations apply to large user-to-user services and sit inside Ofcom’s Illegal Content Codes of Practice and Protection of Children Code rather than standing alone as separate duties.

Ofcom signed the code amendments on October 12, 2026, and they enter force under section 43(4) of the Online Safety Act 2023. The crisis protocol is coded ICU C15 under the Illegal Content Code and PCU C11 under the Protection of Children Code. The separate law-enforcement channel measure is coded ICU C16 and PCU C12.

Ofcom’s crisis definition covers extraordinary situations that seriously threaten UK public safety and are highly likely to stem from or drive a major surge in unlawful material or material harmful to children. A crisis may cover one city only or stem from an overseas event threatening UK public safety. Environmental disasters, pandemics, and misinformation campaigns do not qualify.

Ofcom says ordinary moderation systems may not suffice during public disorder, terrorist attacks, or other crises that cause a sudden rise in harmful or illegal online activity. The regulator pointed to the riots after the July 2024 Southport murders, when false claims about the attacker’s identity spread online and fueled nationwide disorder, including attacks on mosques and hotels housing asylum seekers. Ofcom also cited the risk of attackers livestreaming terrorist attacks. Digital Watch Observatory notes these past and potential events shaped the regulator’s crisis definition.

Platforms—not Ofcom or the UK government—hold sole authority to decide when a qualifying crisis occurs. The decision-making burden lies entirely on platforms, which must judge in real time whether a crisis is occurring or likely. A section 175 notice from the Secretary of State is an indicator that a crisis may be happening, but it is not determinative. Neither regulator nor minister can declare a crisis for a platform, and the absence of a notice is no safe signal.

Once a platform judges that a crisis is occurring or likely, it must deploy a cross-functional crisis response team as soon as reasonably practicable. The team must be senior enough to make enforcement decisions without escalation delays, and the platform must activate systems to mitigate surges in harmful content. Tech Times describes the protocol’s operational requirements, including real-time indicator review.

Large platforms with more than 700,000 UK users must keep a dedicated law-enforcement communication channel for crisis-related information sharing. It sits alongside the crisis protocol in Ofcom’s codes. The channel is a coordination mechanism, not a substitute for court orders or formal legal information notices, and it does not mandate content removal.

Platforms must complete a documented post-crisis analysis within 90 days of a crisis ending, or within 90 days from its start if the crisis is still ongoing. Ofcom can formally request the analysis, which reviews key decisions and tests protocol effectiveness but does not restore wrongly removed content. Fieldfisher’s compliance advice confirms Ofcom’s regulatory power over this review.

The protocol reaches large user-to-user services assessed at medium or high risk of hosting priority illegal content or content harmful to children. Priority illegal content includes terrorism, hate speech, harassment, stalking, threats, abuse, and foreign interference. Children’s services are in scope at medium or high risk of harms such as abusive imagery, content inciting hatred, and violent material. Tech Times cites Winston Taylor’s OSA scope analysis as confirming the same thresholds apply to children’s services.

Generative AI services may fall under the protocol if they operate as user-to-user platforms and meet the size and risk tests. Search services are excluded because they do not amplify illegal content in the same way. Ofcom opened an investigation into X on January 12, 2026, over Grok AI-generated sexualized imagery and narrowed it on October 14, 2026, to illegal content duties and reporting obligations. The probe remains open.

Platforms that follow Ofcom’s recommended measures receive a safe harbor and Ofcom treats them as compliant with the Act’s underlying safety duties. Those taking alternative routes must prove their methods meet equivalent standards across the entire service. Under section 49(5), they must have particular regard to freedom of expression and user privacy; under section 49(6), Ofcom weighs whether the alternatives cover the whole service with equivalent safeguards.

Bratby Law calls the alternative-compliance burden more onerous than it first appears because platforms must discharge proof of equivalence during a live crisis. The firm also warns that a tidy protocol without an underlying risk assessment does not comply, because the protocol is only the operational layer atop sections 10 and 12 duties.

Civil liberties organizations warn that activating crisis protocols too early risks suppressing lawful political speech, while activating too late exposes platforms to enforcement action and reputational damage. They also caution that crisis-mode content removal under law enforcement pressure may inadvertently restrict legitimate speech. The Open Rights Group has objected to a direct police line to moderation desks without judicial oversight during fast-moving civil unrest.

Technology Secretary Liz Kendall has criticized Ofcom for delays in the Act’s full roll-out and urged the regulator to prioritize antisemitic content and hate speech. Kendall said platforms should “do everything possible under the Act to tackle antisemitic content and hate speech online.” Her remarks highlight ongoing tensions between regulatory pace and enforcement priorities.

Ofcom has issued over £7 million in fines to 11 providers since October 2025, including a £520,000 penalty against 4chan for failures to protect children. Enforcement actions reflect Ofcom’s proactive stance on compliance with the Act’s requirements. Meta, TikTok, and X lost an October 2026 court case over Ofcom’s data demands, with the court affirming the regulator’s authority to require detailed quantitative content-moderation data. Tech Times places the new crisis obligations within an active enforcement and litigation environment involving major platforms challenging the regulator’s information powers.

X committed in May 2026 to faster moderation of illegal hate and terrorist content but X faced accusations of failing to remove reported racist abuse within its 48-hour window. Ofcom’s investigation into X is the most prominent enforcement action under the Act’s illegal content duties and remains open as the crisis rules take effect.

The UK framework differs from the European Union’s Digital Services Act, which covers a broader range of emergencies including environmental disasters, pandemics, and misinformation, and involves the European Commission in crisis determination. That distinction leaves crisis declarations in British platforms’ hands rather than a supranational body’s.

Ofcom began work on crisis response protocols on October 23, 2024, and consulted on them during 2025. The measure was first floated in a June 2025 consultation, and Ofcom later split the single proposed crisis measure into two separate rules. Evidence that posts inciting violence fueled disorder after the Southport killings shaped the final design. Tech Times traces the policy’s origins to work begun months after the July 2024 Southport killings, before the June 2026 final decision.

Ofcom finalized the crisis protocol decision on June 9, 2026, the same day disorder broke out in Belfast. Liz Kendall announced proposed Online Safety Act changes that week and asked Ofcom to hold urgent discussions with regulated services. As of June 10, 2026, the measures still had to complete the parliamentary process before taking effect. Tech Times notes the coincidence between the final decision and renewed disorder in Northern Ireland, which drew ministerial attention that week.

Draft consolidated codes must be laid before Parliament under section 43, and if neither House objects within 40 days, Ofcom issues the code, which comes into force 21 days later. The codes amend instruments issued under section 41 and explain how providers meet illegal content duties in sections 10 and 27 and children’s safety duties in sections 12 and 29. Bratby Law locates the protocol within the Act’s statutory framework, showing it sits beneath pre-existing safety duties rather than creating new standalone obligations.

The regulator says providers should stand up temporary response teams immediately when a crisis hits, keep a record of key decisions, and run post-crisis reviews to measure how well the protocols worked. The measures aim to support faster, more coordinated public safety efforts during exceptional events. Fieldfisher tells compliance teams that crisis protocols should be treated as working documents actually used and revisited on a regular basis rather than put aside and ignored. Automated detection decisions are expected in autumn 2026, alongside Crime and Policing Act 2026 amendments creating new offenses for certain illegal imagery.

X, TikTok, Meta, and other platforms continue to dispute the scope and reach of Ofcom’s authority, a tension expected to shape UK online safety enforcement for years. Tech Times characterizes the rules as the first time any country has embedded mandatory pre-planned emergency moderation requirements into a regulator’s legally binding code. Ofcom’s further safety measures are due in autumn 2026.