UK Age Checks for AI Companions: What Ofcom Enforces

What the August update actually said

Ofcom’s 28 August 2026 update was not a new rulebook. It was a description of method: enforcement rarely starts with an investigation. The regulator can open with guidance and direct engagement, then escalate through warning letters, statutory information requests, audits and interviews, and independent Skilled Person Reports before a formal investigation is opened at all. Only after that come financial penalties and, in narrow circumstances, business-disruption measures that ask payment providers or internet service providers to cut a service off.

That matters because the visible end of the ladder is rare. Ofcom said several sites hosting content harmful to children had either blocked UK users or deployed age checks as a direct result of its compliance teams’ work — no fine, no published case. The fines are the exception, not the mechanism.

The pace of escalation is easier to read side by side.

The ceiling on a single penalty is the part providers pay attention to: up to £18m or 10% of qualifying worldwide revenue, whichever is greater. For a companion app with a few hundred thousand UK users, the revenue percentage is not the threat — the fixed figure is.

The one AI companion case, start to finish

On 15 January 2026 Ofcom opened an investigation into Novi Ltd, which operates the AI character companion service Joi.com, over two questions: whether it had carried out a children’s access assessment, and whether it used highly effective age assurance to keep children away from pornographic material. At the time the service was reported to reach approximately 6.5 million monthly users globally, with somewhere between 100,000 and 300,000 of them in the UK.

On 31 July 2026 Ofcom closed the case. Novi had implemented age assurance on the site, and the regulator concluded that pursuing enforcement was no longer an administrative priority. It closed the investigation without making any finding on whether the service had been compliant in the first place.

Why that outcome is the interesting part

Two readings are worth separating. For the operator, fixing the problem mid-investigation worked: no penalty, no adverse finding. For a user trying to judge an app, it means “was investigated” carries almost no signal about safety, because the case file closed empty. What changed is observable in the product rather than in the register: the door now has a check on it.

Which chatbots the Act actually covers

This is where a lot of coverage goes wrong. The Online Safety Act does not regulate AI models. It regulates services, and a standalone companion chatbot can sit outside its perimeter entirely. On Ofcom’s stated approach, a chatbot is likely to fall outside the regime when all three of the following hold:

• interaction is confined to the user and the bot, with no way for users to share content with each other;
• it does not search across multiple websites or databases; and
• it cannot generate pornographic content.

Break any one of those and duties attach. Add a shared character library or a public feed and you have a user-to-user service, where AI-generated content posted by users is treated the same way as content created by humans. Let the bot produce pornography and the age-assurance duties for that content apply, which is precisely the hook used in the Novi case. Embed the bot in an existing social platform and the platform’s duties cover the bot’s output — the basis of Ofcom’s 12 January 2026 investigation into X over its Grok assistant, which cited illegal-content risk assessment, illegal-content safety, child protection and age-assurance failures.

So the question is not “is this app AI.” It is whether the app lets users publish to each other, and whether it will write explicit scenes. Most character-sharing platforms answer yes to the first.

Age checks got harder to wave through

Ofcom’s statutory Use of Age Assurance Report 2026, published in July, put numbers on the shift. Approximately 69 million age checks were completed in the second half of 2025, about a 23-fold increase on the previous six months. The share of children who met a highly effective age check when asked to verify their age rose from 25% to 43% between July 2025 and January 2026. All ten of the UK’s most-visited pornography sites now run checks, as do a majority of the top 100, and 23 investigations have covered 88 adult services.

The report was also blunt about weak methods: Ofcom expressed serious doubts that age-inference technology — estimating age from a selfie or from behavioural signals — reliably identifies significant numbers of children. Companion apps that lean on inference alone should expect that to be revisited. Ofcom owes Parliament a rapid assessment by October 2026, and has a dedicated report on app-store level protections planned for January 2027.

Separately, a transparency notice issued on 22 June 2026 set up Ofcom research into AI chatbot services covering sign-up and access, interaction and engagement, how bots respond to prompts, and what safety features or controls are available. That is the groundwork for the next round of attention, and companion apps are squarely inside it.

What this changes if you use a companion app in the UK

1. Expect a check at the explicit boundary, not at the front door. Many apps gate only the mature mode. If an app demands verification the moment you sign up, that tells you something about what it thinks its content is.
2. Ask what the check keeps. Card checks, ID uploads and face estimation have very different retention profiles. Our privacy checklist covers what to look for before you hand anything over.
3. Treat UK availability as reversible. Blocking the UK is a legitimate compliance route and services have taken it. Export your characters and chat history while you still can — see companion app data export.
4. Do not read an investigation as a verdict. The Novi case closed with no finding at all. Judge an app on the controls you can see today, not on whether a regulator once asked it questions.
5. Watch for inference-only gates. Ofcom has signalled distrust of age estimation. An app relying on it may have to change method, and that change usually lands on users as a new verification prompt.

What is still unsettled

• The perimeter. Whether a purely one-to-one companion app is in scope turns on product details that change with every release. A feature update can move an app across the line.
• Method standards. “Highly effective” is a standard, not a list of approved products. Ofcom’s doubts about inference suggest the acceptable set narrows before it widens.
• Harms other than pornography. Enforcement so far runs through pornographic content and children’s access duties. Emotional dependence and crisis handling — the concerns behind recent companion research — are not what these cases test.
• Overlap with other regimes. UK duties sit alongside app-store level age checks elsewhere, such as Australia’s, and disclosure rules under the EU AI Act. An app can satisfy one and not another.

Frequently asked questions