Summary

  • Ofcom’s crisis-response amendments to the illegal-content and child-protection codes came into force on 2 November 2026. Covered user-to-user services are recommended to write an internal protocol with indicators, monitoring and a senior response team.
  • The protocol and post-crisis analysis may remain private. The analysis is to be recorded when a crisis ends or 90 days after it began, whichever comes first; a dedicated law-enforcement channel has a narrower large-service scope.

The oddest deadline in Ofcom’s new illegal-content amendment comes before the emergency may be over. A provider should record an analysis when it determines a crisis has ended, or 90 days after it began if that is sooner. The record examines key decisions and whether the protocol still works. A long crisis therefore reaches a formal review point while people are still responding to it.

The two amendments took effect on 2 November. Ofcom defines a crisis for these measures as an extraordinary situation posing a serious UK public-safety threat, highly likely to be tied to a significant rise in relevant content on a service. The illegal-content measure covers terrorism, hate, harassment, stalking, threats, abuse and foreign interference. The children’s code amendment uses a parallel structure for child-accessible services and specified abusive, hate-inciting and violent content.

The protocol sits inside the operating team. For a large service at medium risk of a listed harm, or a service of any size at high risk, the code recommends a written internal plan. The provider selects indicators, monitors and revisits them, names a sufficiently senior cross-team response group and deploys people and systems as soon as reasonably practicable when it judges a crisis occurring or likely. If Ofcom sends a public-statement notice, the provider should weigh that alongside its indicators. The written protocol and the later decision analysis need not be published.

Ofcom split the original proposal into this protocol and a separate contact channel for law enforcement. That channel applies to large services at medium or high risk of the specified harms, when the provider judges a crisis occurring or likely. A smaller high-risk service can fall within the protocol recommendation without falling within the dedicated-channel measure. That boundary decides who must maintain a fixed contact route for police during a crisis.

The result is an unusual accountability design. A platform chooses the warning lights, declares when they warrant action, dispatches its own team and records its own decisions. Ofcom supplies the structure and a possible public notice, but the operational record can stay behind the platform’s door. Day 90 creates a check on decisions even if the incident has refused to end. Whether that check changes conduct will be visible in later regulatory evidence, not in a protocol the public is promised to see.