Ofcom opened its investigation into X in January after reports that Grok was generating sexual images of children. Nine months on, it has quietly dropped the one set of duties written to protect them.
Estimated reading time: 7 minutes
In short. Ofcom opened a formal Online Safety Act investigation into X Internet Unlimited Company (XIUC) on 12 January 2026, "following widespread reports that a Grok model on X is/was being used to generate and share content that may amount to intimate image abuse, CSAM and pornography that is accessible to children" [[1]]. The case was opened against duties including a "suitable and sufficient children's risk assessment" and "safety duties protecting children" [[1]]. On 14 October 2026, the same case record was updated to say Ofcom is "not taking forward" its assessment of exactly those children's duties, narrowing the case to general illegal-content duties instead [[1]]. A companion news update published the same day calls Ofcom "one of the first regulators in the world to act" on the Grok reports, then states that it "were unable to investigate the creation of illegal images within the standalone Grok service, because of gaps in the way chatbots are covered under the Act" [[2]]. Three documented mistakes: four stars.
X runs Grok, an AI chatbot, as a feature inside its platform and also as a standalone app. In January 2026, reports surfaced that a Grok model on X was being used to generate and share sexual images of real people, including children, that could amount to intimate image abuse or child sexual abuse material [[1]]. Ofcom, the regulator for online safety under the Online Safety Act 2023, opened a formal case the same month. Nine months on, its own record of that case shows the investigation has narrowed, and its own description of a parallel inquiry into the standalone Grok app shows that app was never covered by the case at all.
The claims, tested
| The claim | What we found | Verdict |
|---|---|---|
| "Ofcom was one of the first regulators in the world to act on concerning reports of the Grok AI chatbot account on X being used to create and share demeaning sexual deepfakes of real people, including children" [[2]] | Two sentences later, the same update: Ofcom "were unable to investigate the creation of illegal images within the standalone Grok service, because of gaps in the way chatbots are covered under the Act" [[2]]. The formal case Ofcom did open is against XIUC, the company behind the X platform, under sections 9, 10, 11, 12, 20, 21 and 22 of the Online Safety Act 2023, duties that attach to X as a platform, not to the Grok chatbot service that generated the images [[1]] | The "action" did not reach, and by Ofcom's own account could not reach, the specific service whose output triggered the case |
| The case was opened "following widespread reports that a Grok model on X is/was being used to generate and share content that may amount to intimate image abuse, CSAM and pornography that is accessible to children" [[1]], listing "a suitable and sufficient children's risk assessment" and "safety duties protecting children" among the duties under investigation [[1]] | The same page's 14 October update: "we have decided to focus on XIUC's compliance with its duties to protect people in the UK from illegal content... we are not taking forward our assessment of XIUC's compliance with the following duties: children's risk assessment duties (section 11); children's safety duties (section 12); and reporting and complaint duties in respect of content that is harmful to children (section 20(4) and section 21(5))" [[1]] | Nine months in, the duties framed as the reason for opening a case about content "accessible to children" are the ones Ofcom has just decided not to pursue |
| Under the heading "Improvements secured to protect children from porn on X", Ofcom says X "has now implemented a series of changes" so that "content labelled as pornography is consistently restricted for accounts that have not completed age assurance" [[2]] | The case record says this specific fix addressed concerns that "would only have been encountered under specific conditions and were not directly related to the widespread reports about methods of accessing Grok on X that led to the opening of this investigation" [[1]], and that it followed Ofcom "raising these concerns with XIUC" informally, not a provisional notice of contravention or any of the formal powers the same page describes, fines up to £18m or 10% of global revenue, or a court-ordered business disruption measure [[1]] | The headline improvement is real, but it answers a different problem to the one that opened the case, and came without Ofcom using any of its own formal enforcement powers |
The mistakes, counted
The chatbot whose output opened the case was never inside it (1). Ofcom's own words are plain: the widespread reports that triggered the 12 January case were about a Grok model generating sexual images of real people, including children [[1]]. Its own words are equally plain that the standalone Grok service could not be formally investigated "because of gaps in the way chatbots are covered under the Act" [[2]]. Parliament gave ministers a specific power to close that exact gap five and a half months ago: the Crime and Policing Act 2026 inserted section 216A into the Online Safety Act on the day it received Royal Assent, 29 April 2026, a gap and a power this site documented in detail last month. Neither the case record nor the 14 October news update mentions that power, used or not, while describing the precise harm it was built to reach.
The children's duties that justified opening the case have been dropped from it (2). Section 11 (children's risk assessment) and section 12 (children's safety duties) of the Online Safety Act were named in the case's own opening text as grounds for investigating XIUC, alongside the reporting and complaint duties in sections 20(4) and 21(5) [[1]]. The 14 October update drops all four, redirecting the case to general illegal-content duties instead, on the basis that XIUC fixed a porn age-gating issue the same page says was unrelated to the Grok reports that opened the case in the first place [[1]]. Ofcom is explicit that it is "making no findings" on the dropped duties and "may revisit this" if new information emerges, but no date or trigger for revisiting is given [[1]].
Nine months on, no finding has been made against X, and no date is set for one (3). The case record describes a formal process still at an early stage: Ofcom must have "reasonable grounds to believe" XIUC failed its duties before issuing a provisional notice of contravention, XIUC then gets a full opportunity to respond, and only then does Ofcom reach a final decision [[1]]. None of those steps has happened. The maximum penalties available, fines up to £18m or 10% of qualifying worldwide revenue, and a court order for business disruption measures such as blocking access or withdrawing payment services, remain entirely theoretical [[1]]. The only commitment on timing is to "publish a further update later this year" [[1]].
Credit where due
Ofcom's own documents do not hide the narrowing: the case record states plainly, in its own words, which duties are being dropped and why, rather than letting a reader infer it from silence. The regulator is also candid about the limits of what it has verified: on X's self-reported improvement in acting against hate and terror content, the same 14 October update says Ofcom will "cross-check these performance metrics against our own tests" rather than presenting the company's own numbers as confirmed, and states plainly that it still has "ongoing concerns" about effectiveness and has received "mixed reports" on a related commitment [[2]]. And the protective changes secured on the standalone Grok app are real: SpaceXAI, which operates Grok, restricted the generation of images of real people in revealing attire when the investigation opened, then went further to block UK users from pornographic image generation and to stop companion chatbots such as "Ani" engaging in sexually explicit conversation [[2]]. None of that required a finding of liability, but it happened.
Verdict
Four stars, from three documented mistakes. Ofcom opened a case in January because Grok was reportedly being used to generate sexual images of children. Nine months later, its own record shows the children's-specific duties that case was opened to test have been dropped, the chatbot that produced the images was never formally investigated at all, and no finding, fine, or court order has been made against anyone. What has happened instead is a set of voluntary changes, real but secured through engagement rather than the enforcement powers the case record itself describes.
The star score counts three documented mistakes. First, Ofcom's own account states it could not formally investigate the standalone Grok service's image generation, the specific source of the harm that opened this case, because of a gap in Online Safety Act coverage of chatbots that this site has separately found remains open five and a half months after Parliament gave ministers power to close it. Second, the children's risk assessment and children's safety duties (sections 11 and 12) and related children's complaint duties (sections 20(4) and 21(5)), named as grounds for opening the case on 12 January 2026, were dropped from the investigation's scope in the 14 October 2026 update, with no date set for revisiting them. Third, nine months into the case, no provisional notice of contravention, finding, fine or court order has been made, and Ofcom has committed only to "a further update later this year," no fixed date. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual at Ofcom, X or SpaceXAI; the case record and its own stated scope are institutional facts, not any one official's decision. Checked directly against Ofcom's case record and its 14 October 2026 news update, both fetched 16 October 2026.
Sources
- Investigation into X Internet Unlimited Company and its compliance with duties to protect its users from illegal content and child users from harmful content, Ofcom, published 12 January 2026, last updated 14 October 2026
- Ofcom update: Monitoring X's response to hate and terror content, and Grok investigation latest, Ofcom, published 14 October 2026