Ofcom is moving another part of Britain’s Online Safety Act from written obligations into technical enforcement, opening a programme that will examine whether higher-risk online services have built systems capable of stopping known non-consensual intimate imagery from being redistributed.

Ofcom will initially concentrate on services in the adult and instant-messaging sectors, which the regulator considers particularly exposed to the uploading and dissemination of non-consensual intimate imagery, or NCII. Its work will assess whether providers are preparing new hash-matching measures before they take effect on 30 September, or implementing alternative controls capable of achieving an equivalent result.

The rules extend to illegal intimate photographs and videos as well as explicit AI-generated deepfakes, putting one of the most visible forms of generative-AI abuse inside the same enforcement framework. Ofcom has already contacted some providers and says businesses that are neither compliant nor taking credible steps towards compliance may face formal investigations.

Penalties under the Online Safety Act can reach £18 million or 10 per cent of qualifying worldwide revenue, whichever is greater, although opening a sector-wide programme does not mean any particular company has already been found in breach.

Hash matching moves intervention upstream

Hash-matching systems create a digital fingerprint representing known material. Participating services can compare content moving through their platforms against those fingerprints and intervene when a match is detected, avoiding the need to redistribute the original file between victims, platforms, and organisations every time it reappears.

Ofcom is working with SWGfL, which operates the Revenge Porn Helpline and StopNCII.org. The latter allows someone affected by intimate-image abuse to generate a fingerprint on their own device, meaning the underlying image does not have to leave their possession before participating services can use the hash to help prevent further distribution.

The approach moves part of enforcement from removal after publication towards preventing recognised material from spreading again. Once an intimate image reaches multiple accounts, services, or websites, removing every copy becomes considerably harder, while redistribution can continue after the original upload has disappeared.

Ofcom has nevertheless stopped short of prescribing a single supplier or implementation. Its codes recommend hash matching where the measure applies, but providers may use an alternative if they can show that it satisfies the relevant safety duty just as effectively.

That flexibility preserves room for different technical architectures while creating a demanding evidence question. A company deciding not to use the recommended mechanism needs more than a policy explanation; it needs to demonstrate that the alternative produces comparable protection in practice.

The Act reaches the control layer

The enforcement programme extends a wider transition already visible across Britain’s online-safety regime. As Techopia examined last week, regulated services are moving beyond risk assessments and policy documents into recurring operating decisions covering age assurance, recommendation systems, illegal-content controls, suppliers, and internal governance.

NCII controls lend themselves to more concrete inspection than broad public commitments to user safety. Regulators can ask which services ingest hashes, whether matching works reliably, what happens after detection, how false matches are handled, and whether apparently compliant processes continue operating under normal production conditions.

Services using external technology cannot assume that outsourcing the technical control transfers regulatory responsibility. Ofcom has already applied that principle elsewhere in the Online Safety Act, making regulated businesses responsible for whether third-party systems actually satisfy their statutory duties.

The same logic follows here. A service may participate in StopNCII or use another provider, but it remains responsible for integration, escalation, monitoring, and the decisions taken when the system identifies material.

New content presents a harder problem because hash matching works best against material that has already been fingerprinted. Services still need processes for newly created imagery, while AI tools now allow abusive material to be produced without an original intimate photograph ever having been shared voluntarily.

Enforcement will increasingly test production systems

Ofcom plans to combine supervision, engagement with providers, and formal investigations rather than treating every implementation problem immediately as an enforcement case. That leaves room for services to demonstrate progress, while preserving a route towards individual action where the regulator identifies suspected breaches.

A further consultation is expected before the end of the year on strengthened illegal-harms codes reflecting requirements for reported NCII to be removed within 48 hours. Together, the measures would create intervention at two different points: preventing recognised content from being shared and accelerating removal after previously unknown material is reported.

Whether the framework reduces abuse will depend on implementation across a fragmented range of services. Coverage, technical reliability, response times, and the ability to deal with newly generated content will determine how much harmful material still reaches users despite nominal compliance.

The NCII programme therefore provides an early view of what mature Online Safety Act enforcement will look like. Ofcom is moving from asking whether a business has considered a risk towards inspecting the systems used to control it.

By 30 September, affected providers will need more than a statement that intimate-image abuse is prohibited. They will need an operating mechanism that can withstand regulatory examination and, where they choose another route from Ofcom’s recommended measure, evidence that it produces the required protection.