The UK Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Section 255 of the Act creates criminal offences for suppliers of AI chatbots that produce illegal or harmful content. The provisions are enacted law in force from the date of Royal Assent. AI chatbot providers are now within scope of the illegal content rules in the Online Safety Act 2023.
Section 255 of the Crime and Policing Act 2026 defines three distinct offences. The first is supplying an AI chatbot that produces content specified in subsection (4). The second is failing to carry out a suitable and sufficient risk assessment before supplying such a chatbot. The third is failing to mitigate or manage risks of identified harm. Specified content means content that is illegal for any user under section 59 of the Online Safety Act 2023. For users under 18, the category extends to content where an AI falsely presents itself as human. Penalties reach five years' imprisonment on conviction on indictment.
AI chatbot developers, API providers, and platform operators deploying conversational AI to UK users must assess whether their systems can generate content caught by the specified content definition in section 255(4). Operators serving users under 18 face broader obligations: their systems must not produce content designed to mislead children into believing they interact with a human. Third-party AI model customers are classified as suppliers under section 255 and bear direct liability rather than downstream platform liability. Providers must document their risk assessments to demonstrate compliance in any enforcement proceeding.
Section 255 does not include a statutory safe harbour for suppliers who conduct risk assessments that prove insufficient after the fact. Ofcom guidance on what constitutes a suitable and sufficient risk assessment for AI chatbots under the combined Crime and Policing Act and Online Safety Act regime is pending. The boundary between platform liability for user-generated content under the Online Safety Act and direct supply liability under section 255 has not yet been addressed by regulators.
Licentium advises technology companies and AI product developers on UK regulatory obligations. If your AI chatbot products serve UK users, we can assist with compliance analysis and risk assessment documentation. Work we undertake includes Online Safety Act compliance, AI product risk assessments, criminal liability analysis for technology products, and regulatory engagement strategy.
Source: Crime and Policing Act 2026, s 255 (UK c.20), Royal Assent 29 April 2026