Ofcom promised itself new crisis-response rules for online platforms would arrive by early Autumn. Its own Code confirms they take effect on 2 November instead, a date its public compliance calendar still does not show.
Estimated reading time: 5 minutes
In short. Ofcom decided in June 2026 to add crisis response measures, covering riots and other public safety emergencies fuelled by illegal content online, to its Illegal Content and Protection of Children Codes of Practice [1]. Its own roadmap said it expected the Codes to take effect "in the early Autumn" [2]. The amendments were not issued until 12 October 2026 and do not bind platforms until 2 November [5]. Ofcom's own compliance calendar for businesses still lists only "Autumn 2026, subject to parliamentary process" [3]. Two documented mistakes: four stars.
Riots spread fast online. Ofcom's own case for this Code amendment points to the disorder that followed the Southport murders in the summer of 2024, when hostility and false claims circulating on social media were cited as a factor in how quickly violence escalated on the streets [4]. The fix Ofcom settled on is narrow and procedural: large platforms at risk of terrorism, hate, harassment or foreign interference content should have a written internal "crisis response protocol" ready before a crisis hits, and the largest should keep a dedicated channel open for law enforcement to reach them during one [5]. Nobody disputes the problem. The question this piece tests is simpler: did Ofcom deliver the fix on the timetable it set for itself, and does its own paperwork say so accurately.
What Ofcom decided, and when it said the rules would bind
Ofcom published its Statement: Crisis response protocol on 9 June 2026, confirming the two measures and explaining that service providers "should prepare and apply a crisis protocol to mitigate and manage the risks arising from a significant increase in relevant illegal content" during what it defines as "an extraordinary situation in which there is a serious threat to public safety in the United Kingdom" [1]. The Statement itself does not give a target date for the Code amendments to take effect. That estimate appears on a different page: Ofcom's own roadmap for implementing the Online Safety Act, last updated 28 July 2026, which records that "On 18 June, we announced our final decision. Subject to the parliamentary process, and given the summer parliamentary recess, we expect the new Codes of Practice measures to come into effect in the early Autumn" [2].
Early Autumn, on any ordinary reading, means September. The roadmap page carrying that estimate has been edited as recently as 28 July, so Ofcom plainly has the means to update it when circumstances change. As of this check, it has not.
What the issued Code actually sets as the date
The document that settles the question is the amendment notice itself, not a forecast. "Amendments (No. 2) to the Illegal content Codes of Practice for user-to-user services" was issued on 12 October 2026 and states plainly: "In accordance with section 43(2) and (3) of the Act, the draft has been laid before Parliament for the 40-day period, during which time neither House of Parliament resolved not to approve the draft. The amendments come into force on 2nd November 2026 in accordance with section 43(4) of the Act" [5]. The parallel notice amending the Protection of Children Code, issued the same day under the same section 43 mechanism, sets the identical date [6]. Ofcom's own regulatory documents page, last updated 12 October 2026, lists both as "Upcoming Codes of Practice" that "are not yet in force" as of that update, with the standing explanation that amendments of this kind "take effect 21 days after they are issued" [7]. Twenty-one days from 12 October is 2 November. Whichever document is checked, the date agrees: not early Autumn, but the first days of November, roughly seven weeks past the estimate and almost five months after the June decision.
The calendar businesses are told to rely on still has not caught up
Ofcom maintains a page specifically so regulated services can find exact compliance dates: Important dates for Online Safety compliance, which opens by telling readers "this page explains the important milestones" and "all dates reflect our current expected timings" [3]. This site tore the same page down once already, on 7 October 2026, over a different milestone that had already passed without comment. Checked again now, its entry for the crisis response measures reads: Start Date "June 2026", Milestone "Ofcom finalises additional safety measures on crisis response", Completion date "Autumn 2026 subject to parliamentary process" [3]. The page is stamped "Last updated: 24 August 2026" and has not been touched since, even though the specific, statutory in-force date was confirmed in writing the day before this check [3] [5]. A business trying to plan around this page, exactly what it exists for, would still see only a season and a caveat, not the date Ofcom itself had already fixed and signed.
Credit where due
Unlike the cyberflashing and serious self-harm Code amendments this site examined earlier today, which remain undated with no issued version at all, the crisis response measures have actually cleared the section 43 process: a specific issue date, a specific in-force date, and a signed notice confirming Parliament raised no objection [5] [8]. The Statement page itself also carries an honest banner warning readers it "may be out of date" and pointing them to the regulatory documents page for the current position, a sensible safeguard most of Ofcom's other static pages do not have [1]. The substance of the measure is also reasonable and proportionate on its face: a written internal protocol platforms need not even publish, triggered only by large services at meaningful risk.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| Ofcom's roadmap, last updated 28 July 2026: "we expect the new Codes of Practice measures to come into effect in the early Autumn" [2] | The signed amendment notice sets the in-force date as 2 November 2026, issued 12 October 2026 [5] | Roughly seven weeks later than the estimate, on a page last edited after the decision was made but never corrected |
| Ofcom's compliance calendar, last updated 24 August 2026: this measure's completion date is "Autumn 2026 subject to parliamentary process" [3] | The specific 2 November in-force date was confirmed in writing on 12 October 2026, the day before this check [5] | The page built specifically for exact compliance dates still gives businesses only a season |
Verdict
Four stars, two documented mistakes. Ofcom did get this Code amendment through the section 43 process, signed and dated, with Parliament raising no objection across the 40-day laying period. What it has not done is update the two public-facing pages that told readers when to expect it. The roadmap's "early Autumn" estimate has sat unrevised since July, even though the page carrying it was edited after the actual decision was taken. The compliance calendar businesses are pointed to for exact dates still says only "Autumn 2026", a day after Ofcom's own lawyers fixed the date in writing. Getting the Code finished is the easy half of telling the public what happened; updating the pages that say so is the half that was skipped.
The star score counts two documented mistakes: Ofcom's roadmap page said it expected the crisis response Code amendments to take effect "in the early Autumn", but the signed amendment notice sets the actual date as 2 November 2026, about seven weeks later, on a roadmap page last updated after the June decision but never corrected; and Ofcom's Important dates for Online Safety compliance page, the page built specifically to give businesses exact dates and already torn down once by this site on 7 October 2026 for a different stale entry, still lists only "Autumn 2026 subject to parliamentary process" for this measure, unchanged since 24 August 2026 and not updated even the day after the specific date was confirmed in writing. Two mistakes in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; it describes gaps between Ofcom's own published pages, not the performance of any person who signed or drafted them. All sources below were fetched directly on 13 October 2026 and returned HTTP 200; both amendment PDFs were checked with a full-text read of all 8 pages each.
Sources
- Statement: Crisis response protocol, Ofcom, published 9 June 2026, last updated 12 October 2026
- Ofcom's approach to implementing the Online Safety Act, Ofcom, last updated 28 July 2026
- Important dates for Online Safety compliance, Ofcom, last updated 24 August 2026
- Stopping illegal content going viral in a crisis, Ofcom, published 9 June 2026
- Amendments (No. 2) to the Illegal content Codes of Practice for user-to-user services (PDF), Ofcom, issued 12 October 2026, in force 2 November 2026
- Amendments to the Protection of Children Code of Practice for user-to-user services (PDF), Ofcom, issued 12 October 2026, in force 2 November 2026
- Online safety regulatory documents and guidance, Ofcom, last updated 12 October 2026
- This site, "Ofcom decided in June that cyberflashing and encouraging serious self-harm should become priority offences under its enforcement codes. Four months on, the codes that actually bind platforms still do not mention either." (13 October 2026)