On September 9, 2026, Ofcom launched an enforcement programme to monitor whether online services are meeting their duties to prevent the spread of illegal non-consensual intimate imagery (NCII), including explicit AI-generated deepfakes. Ofcom states that by September 30, 2026 online platforms should have automated hash-matching technology in place to detect and prevent the sharing of illegal intimate images.

A service that does not use hash matching must demonstrate that its systems and processes curb the spread of NCII by other equally effective means. The programme operationalises existing Online Safety Act duties and Ofcom's codes; it does not create a new product-certification or equipment-approval scheme.

Non-compliant firms may face enforcement action and penalties of up to 10% of global annual revenue. Ofcom also announced that it will consult by the end of 2026 on strengthening the Illegal Harms Codes of Practice to reflect the statutory requirement to remove reported non-consensual intimate images within 48 hours.

A related Call for Evidence, open until 5:00 p.m. on November 4, 2026, seeks evidence on service-provider action and online gender-based harms since November 2025.

Impact

Impact assessment: High.

Key reasons: Ofcom has opened an active enforcement programme, identified September 30, 2026 as the operational compliance date for hash matching or equally effective controls, and can impose penalties of up to 10% of global annual revenue.

Who is affected?

Providers of user-to-user and search services, especially services that host or share images or videos, together with their trust-and-safety, AI, engineering, legal and compliance teams.

Conclusion:

providers should document their NCII risk controls, verify coverage of AI-generated deepfakes, test prevention and reporting workflows, and retain evidence showing that any alternative to hash matching is equally effective.