The UK’s approach to regulating AI chatbots is shifting rapidly in an effort to keep pace with technological change and address the risks of online harm, particularly for children.

The Crime and Policing Act 2026 (“CPA”) and the Children’s Wellbeing and Schools Act 2026 (“CWSA”) both received Royal Assent at the end of April 2026, and ministers have signalled that chatbot providers and online platforms are likely to face a tougher safeguarding environment - especially where children are concerned – as the UK Government considers further potential legislative interventions to address online harms.

The UK Government is expected to leverage powers granted under these new Acts to amend the Online Safety Act 2023 (“OSA”) via secondary legislation and materially strengthen its ability to regulate AI-generated content. It has notably committed to act swiftly to implement the findings of its consultation into children’s online safety, which closes on 26 May 2026. 

These rapid legal developments follow Ofcom’s acknowledgement that it lacked sufficient powers to act against X’s Grok “nudification tool”. Currently, not all chatbot-generated content falls within scope of the OSA. If AI chatbots are used specifically as search engines, to produce pornography or operate in user-to-user contexts (i.e. social media sites and apps), they are already covered by the OSA. However, images and videos that are created by a chatbot without it searching the internet are generally outside the current regime unless they amount to pornography. This loophole is precisely what the UK Government has been seeking to close, to bring AI chatbots back within the intended scope of the OSA rules and allow regulators to tackle harmful AI-generated content more effectively.

The CPA introduces a new s.216A into the OSA, which grants the Secretary of State (“SoS”) broad powers to expand the OSA’s scope for the purpose of minimising or mitigating the risk of harm to individuals in the UK from:

• illegal AI-generated content; or 

• the use of AI services for the commission or facilitation of priority offences.

Because this power applies to any internet service capable of producing AI-generated content, its use is likely to bring a significantly wider range of AI chatbots squarely within online safety rules, with companies facing penalties of up to 10% of global revenue for breaching the OSA.

The CPA also criminalises the making, adapting, supplying or offering to supply so-called “nudification tools”; creates new offences of ‘screenshotting’ an intimate image without consent; and imposes new duties on online platforms to ensure such images are taken down within 48 hours.

Whilst these are clear steps towards addressing online harm, they are notably limited to illegal conduct. It is increasingly apparent that chatbots can also generate dangerous – but not illegal – content, such as material that encourages people to self-harm or take their own lives, without facing sanction under current online safety rules. This gap presents a serious risk of harm, particularly for children. 

The CWSA may go some way towards addressing these wider risks for children. It inserts a new section 214A into the OSA, empowering the SoS, again by way of secondary legislation, to require specified internet service providers to prevent or restrict access by children under a specified age to their services (or to certain features or functionalities), such as by applying screen time limits, curfews, or age restrictions on communication functionalities. 

It also amends the UK GDPR to:

• permit the SoS to amend the age of digital consent (currently 13 in the UK); and 

• allow different ages of digital consent to be specified for different types of service or specified services (which could include AI chatbots, gaming sites and social media) (s72 CWSA).

This final amendment is a somewhat diluted ‘bookmarking’ of the proposed under‑16 social media ban pending the outcome of the Government consultation: it stops short of an outright ban but clearly reserves the power to introduce tighter age restrictions once the consultation concludes. 

That said, it plants a firm policy flag that individuals’ interactions with chatbots – particularly children’s interactions - will be more tightly controlled in future, with more specific, and potentially onerous, requirements to follow. The UK Government is required to produce a progress report on the topic before 29 July 2026, with regulations to be made within 12 months of that report. 

The Acts are therefore significant not only for what they do now, but for the regulation-making powers they unlock, creating a route for further rules under the OSA that could directly impact AI chatbot functionality, access and age-based controls. 

What this means for AI chatbots

For chatbot developers and deployers, the direction of travel is clear. If a chatbot can generate illegal content, facilitate harm, or expose children to unsafe interactions, regulators will expect the same level of protection and accountability as for other online services.

In practical terms, this points to:

• greater emphasis on risk assessment, content controls, escalation processes and record‑keeping; and

• more robust data processing practices and age assurance measures.

With the prospect of future age restrictions, chatbot operators will need to be ready to adjust privacy notices, consent flows, and access controls to reflect any new threshold.

Companies looking to integrate AI chatbot functionality into existing services should assess, at design stage, whether the proposed use of an AI chatbot and its functions would bring it within the OSA’s scope, and take note of this timely warning shot that safety-by-design, child-centred governance and legal accountability are becoming baseline expectations rather than optional extras.

Conclusion

The two Acts mark a turning point in the UK debate on AI chatbots. Rather than treating chatbots as novel tools outside existing safety frameworks, the UK Government is rightly moving to ensure they fall within the broader model of online regulation focused on children’s protection and platform accountability. For policymakers, the challenge will now be to strike the right balance between innovation and child protection as the next phase of AI regulation in the UK takes shape.