Ofcom spent two years writing the rule that tells large platforms to open a channel to the police during a public safety crisis. It never says how fast they have to answer it.
Estimated reading time: 6 minutes
In short. From 2 November 2026, large online platforms (more than 7 million monthly UK users) at medium or high risk of terrorism, hate, harassment or foreign interference content must keep "a dedicated channel for law enforcement to contact the provider" open during a public safety crisis [1]. Ofcom says the measure is "intended to ensure that service providers within scope can act promptly and effectively during a crisis" [2]. The Code clause that creates it is one sentence long and names no response time, no staffing requirement and no duty to tell Ofcom the channel was used [1]. The companion measure, a written internal crisis response protocol, "need not be published", and the provider alone decides what counts as a crisis in the first place [1]. Ofcom has already secured a quantified standard from one major platform by informal engagement alone: X's own reporting, reviewed 14 October 2026, commits to acting on 85% of flagged hate and terror content within 48 hours [3]. The Code that took two years and a formal rulemaking process to write asks for less. Two documented mistakes: four stars.
A platform knows a crisis is under way before any regulator does. That is the premise behind Ofcom's new Code measures on crisis response, and it is a reasonable one: the disorder that followed the Southport murders in July 2024 showed how quickly online content can accelerate violence on the street, and Ofcom opened a consultation on a fix in June 2025. A year and four months later, the fix has a date. This site already found that Ofcom missed its own "early Autumn" estimate for when the measures would bind platforms, landing on 2 November instead, seven weeks late [4]. That piece did not test what the finished measures actually require once they do bind. This one does.
What a two-year rulemaking process produced
The amendment issued on 12 October 2026 adds two new recommendations to the Illegal Content Code of Practice for user-to-user services: ICU C15, "Crisis response", and ICU C16, "Crisis response (dedicated channel for law enforcement)" [1]. Both apply only to "large" services, defined elsewhere in the same document as one with "more than 7 million monthly active United Kingdom users" [1], that are at medium or high risk of terrorism, hate, harassment, stalking, threats and abuse, or the foreign interference offence.
ICU C15 requires the provider to "prepare and apply (but need not publish) a written internal protocol" to identify and respond to a crisis [1]. The protocol must cover indicators "identified by the provider" for deciding whether a crisis is happening, how those indicators are monitored and kept under review, and the makeup of a crisis response team the provider itself assembles [1]. If the provider later decides its own indicators "no longer remain relevant", it updates the protocol itself, with no Ofcom sign-off required [1]. After a crisis, the provider conducts a post-crisis analysis, which it "need not publish" either [1].
ICU C16 is shorter. Its entire operative text reads: "If the provider determines that a crisis is occurring or is likely to occur, it should ensure there is a dedicated channel for law enforcement to contact the provider on matters related to the crisis" [1]. That is the whole measure. No response window. No requirement that the channel be staffed around the clock, or at all, during the crisis it exists for. No duty to report back to Ofcom, or anyone, on whether the channel was used or how it performed.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| Ofcom's Statement says the measures are "intended to ensure that service providers within scope can act promptly and effectively during a crisis" and will give providers "appropriate systems and processes in place to enable rapid and coordinated action" [2] | ICU C15's protocol is built on indicators "identified by the provider" [1], applied by a crisis response team the provider itself defines [1], and reviewed for continuing relevance by the provider alone [1], with no published document and no Ofcom threshold for what "significant increase" or "rapid" means | The promise is "rapid and coordinated"; the mechanism that is meant to deliver it is self-defined by the company at every stage and never has to be shown to anyone |
| ICU C16 creates "a dedicated channel for law enforcement to contact the provider" as the Code's answer to coordinating with police during a crisis [1] | The clause sets no response time. Ofcom's own 14 October 2026 update on X records that company's voluntary commitment to act on 85% of flagged illegal hate and terror content "within a maximum of 48 hours", averaging 24 hours, over a rolling three-month period [3] | The binding, sector-wide Code measure, the product of a formal section 43 process, sets a lower bar than the informal commitment Ofcom had already extracted from a single platform five months earlier |
| The protocol and the post-crisis analysis both carry the same parenthetical: "need not publish" [1] | No public body, researcher or journalist can check whether a platform's self-written crisis indicators were adequate, or whether its post-crisis review found and fixed anything, unless Ofcom specifically requests the document | A measure sold as accountability infrastructure produces no public record by default |
The mistakes, counted
The headline "dedicated channel for law enforcement" measure sets no standard for how fast it has to work (1). ICU C16's single sentence requires the channel to exist, not that it be answered within any particular time, staffed at any particular level, or tested before a crisis arrives [1]. Ofcom's own update on X four weeks earlier shows the regulator already knows how to write a quantified standard when it wants one: "within an average of 24 hours" and "at least 85%... within a maximum of 48 hours" [3]. Neither figure, nor any equivalent, made it into the Code measure that is supposed to generalise the lesson to every large at-risk platform.
The protocol that is meant to prove readiness never has to be shown to anyone (2). ICU C15.3 and ICU C15.7 both carry the same instruction: prepare it, apply it, "but need not publish" it [1]. The provider alone decides what counts as a crisis, when it has ended, and whether its own response was adequate, through a post-crisis analysis that is equally exempt from publication [1]. Ofcom can presumably request the document under its information-gathering powers, as it has done in other cases, but the Code itself creates no routine transparency and no scheduled disclosure, public or regulatory, by default.
Credit where due
The measures are not nothing. A platform with no crisis plan is required, for the first time, to have one, and large platforms must now ensure a named line to police exists before an emergency, not improvised during one. The 7 million monthly UK user threshold and the four named risk categories are precise and checkable, unlike some of the vaguer language elsewhere in Ofcom's Codes. And the Code's safeguards for freedom of expression and privacy, which apply to both new measures, point back to existing user-facing protections (ICU C3 to C8 and ICU D1, D2, D8 to D10) rather than inventing new, untested ones [1]. The problem this piece documents is not that Ofcom acted. It is that the specific mechanism built to prove the action works is designed not to be checked.
Verdict
Four stars, two documented mistakes. Ofcom took a real, well-evidenced problem, the way illegal content can accelerate public disorder, and spent over two years turning it into a Code measure. What it produced asks large platforms to write a plan nobody else can read, triggered by a crisis the platform alone defines, backed by a law enforcement channel with no deadline attached, weaker than the standard Ofcom had already talked one platform into meeting without any Code at all.
The star score counts two documented mistakes. First, ICU C16, the Code's "dedicated channel for law enforcement" measure, sets no response-time, staffing or reporting standard, a lower bar than the quantified 24-hour average and 48-hour, 85% backstop Ofcom's own 14 October 2026 update records X as already having committed to. Second, ICU C15's crisis response protocol and post-crisis analysis are both explicitly exempt from publication, and the provider alone determines its indicators, its crisis response team and whether a crisis has started or ended, with no scheduled disclosure built into the measure. Two mistakes in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual at Ofcom or any platform; the Code's own published text and Ofcom's own published update are institutional documents, not any one official's decision. All sources below were fetched directly on 24 October 2026 and returned HTTP 200; the issued Code was compared page by page against its immediately prior, 9 September 2026 edition [5], found via Ofcom's regulatory documents index [6].
Sources
- Amendments (No. 2) to the Illegal content Codes of Practice for user-to-user services (PDF), Ofcom, issued 12 October 2026, in force 2 November 2026 (ICU C15 and C16, pages 37-39; "large service" definition, page 72)
- Statement: Crisis response protocol, Ofcom, published 9 June 2026, last updated 12 October 2026
- Ofcom update: Monitoring X's response to hate and terror content, and Grok investigation latest, Ofcom, published 14 October 2026
- This site, "Ofcom promised itself new crisis-response rules for online platforms would arrive by early Autumn. Its own Code confirms they take effect on 2 November instead, a date its public compliance calendar still does not show." (13 October 2026)
- Illegal content Codes of Practice for user-to-user services (PDF, 9 September 2026 edition), Ofcom, issued 9 September 2026 (prior edition, compared page by page against source 1 to identify ICU C15 and C16 as new)
- Online safety regulatory documents and guidance, Ofcom, last updated 12 October 2026