Ofcom published updated guidance on Friday for large online platforms that use artificial intelligence to moderate content, verify ages or tailor safety interventions under the Online Safety Act.
The document tells Category 1 and related services they must be able to explain how automated systems make safety decisions, maintain human review for high-risk cases and keep logs that regulators can audit. It lands alongside separate Ofcom research showing that most UK adults have tried generative AI tools, but only a small share use them to manage broadband or mobile accounts.
What platforms must document
The guidance expects firms to record training data summaries, performance metrics and bias tests for models that flag harmful material or enforce age gates. Services should not present chatbots as human agents without clear labels, echoing telecoms rules Ofcom reiterated in September when it said existing consumer protections already cover many AI-assisted customer journeys.
Legal teams at video, social and marketplace operators said the logging requirements resemble preparations for EU-style algorithmic transparency, but tied to UK statutory duties on child safety and illegal content. Platforms that already centralise trust-and-safety engineering in Dublin or London may reuse tooling, but must map it explicitly to Ofcom's oversight powers.
Human contact still matters
In parallel research from Ipsos fieldwork for Ofcom's Technology Tracker, respondents said they valued speaking to a person for complex complaints even when they were willing to use AI for simple comparisons. Ofcom stressed that providers cannot block access to human support when automated systems fail, a line that now applies both to telecoms customer service and to large online services covered by the new moderation guidance.
Smaller firms outside Category 1 still face general Online Safety duties, but the detailed AI logging expectations target the largest reach services first. Ofcom said it will monitor implementation and may issue further technical standards as it gathers evidence through the autumn.
Why UK tech policy watchers care
The release shows Ofcom moving from principle-based Online Safety implementation to operational detail on automated enforcement, just as Parliament debates whether frontier-model developers should face mandatory testing by the AI Security Institute. For platform engineers, the immediate task is aligning incident response runbooks with record-keeping that can survive a regulatory review without exposing proprietary model weights.
Investors in UK-listed ad-tech and hosting names will watch whether compliance spending rises in 2027 planning cycles. For now, the guidance gives general counsel a checklist: identifiable automation, human escalation paths and auditable logs whenever AI touches user safety.
Engineering trade-offs inside trust teams
Platform engineers said logging every model inference at scale will require sampling strategies and privacy redaction pipelines so child-safety reviewers can audit decisions without storing prohibited content indefinitely. Vendors selling moderation APIs are updating contracts to clarify who holds liability when an automated system misses illegal material that a human reviewer would have caught.
Telecoms operators watching the Online Safety guidance said some expectations rhyme with Ofcom's September statement on AI customer service: transparency labels, easy escalation to people, and bans on using automation to stall complaints. Convergence between sectors may simplify compliance for conglomerates that run both broadband and social apps, but smaller startups fear fixed costs will rise faster than revenue.