Office of Communications

The Online Safety Act 2023 gave Ofcom broad regulatory powers over online service providers. It has now completed its initial Illegal Harms and Protection of Children Codes and related guidance. Along with supporting documentation, these total over 1,700 pages and constitute a regime that Ofcom itself admits is “complex”. With Ofcom already consulting on additional safety measures to strengthen these codes, providers have a new and intricate sea of compliance requirements to navigate, with the prospect of substantial fines or other sanctions if they fail.

In June, Ofcom published a document updating its strategic approach to AI. While there is no need for the businesses Ofcom regulates to seek its permission to roll out AI solutions, businesses should be mindful that Ofcom may scrutinise potential harms arising from the use of AI in the sector. For example, the document highlights the increasingly prevalent use of deepfakes and implications for online safety. The paper also outlines how Ofcom plans to accelerate its own use of AI, using a “safety-first” approach.

In recent years, Ofcom has taken steps to encourage network investment and full fibre rollout across the UK, including through remedies such as requiring the incumbent Openreach to allow access to its passive infrastructure to other network operators. In the first half of 2025 it consulted on proposals broadly following the same approach to promote competition and investment in fibre networks in the Telecoms Access Review 2026-31. Its final decisions for the review will be published in early 2026. Its proposal includes implementing measures aimed at obliging providers to design and manage their networks to protect against existing and future threats to the UK’s network security.

Under the Media Act 2024, Ofcom has been setting out reforms to “level the playing field where traditional broadcasters compete with global tech giants”. This includes consulting on how to implement the requirement that connected TV platforms ensure the availability and prominence of designated public service broadcasting TV apps. Ofcom has also been granted powers to oversee certain prominent video-on-demand services, including those targeting UK audiences from overseas, that are set to be subject to standards akin to those applied to traditional broadcasters. However, the list of services has not yet been finalised so watch this space.

Ofcom is expected to add data centres to its regulatory remit as the Cyber Security and Resilience Bill becomes law. Proposals would see data centres with 1MW or more capacity (or enterprise data centres with 10MW or more capacity) in scope of cyber security rules aimed at protecting critical national infrastructure. Data centre operators should watch this space to ensure they are up to date on any new regulatory requirements.