Did X meet Ofcom’s illegal-content targets without proving removal worked?
X’s first quarterly report fell within agreed review-time commitments, but Ofcom still questions whether illegal hate and terror material is removed effectively. The regulator has not published the underlying report or made a final compliance finding.
The short version
3 key points
- 1.Ofcom says X's first quarterly report fell within commitments to review suspected illegal hate and terror reports within an average of 24 hours and at least 85% within 48 hours.
- 2.Meeting a review-time target is not evidence that illegal material was removed correctly or quickly; Ofcom says it still has concerns about removal effectiveness.
- 3.X changed its age-gating after Ofcom found some pornographic material remained accessible to accounts without completed age assurance, but the regulator made no compliance finding on those duties.
The answer: X met the timing commitments, not an effectiveness test
X's first quarterly performance report fell within review-time commitments agreed with Ofcom, according to the UK regulator. X had committed to review suspected illegal hate and terror content reported through its dedicated UK tool within an average of 24 hours across three months, with at least 85% reviewed and assessed within 48 hours as a backstop.
That is evidence of faster handling, not proof that the system reliably identified and removed illegal material. Ofcom says it has ongoing concerns about the effectiveness of X's response to taking down illegal hate and terror content and has received mixed reports about sustained engagement with third-party experts. It plans to cross-check X's figures against its own testing and expects another analysis after further quarterly data arrive.
The distinction matters for users. A report can be opened quickly but classified incorrectly, left online, removed too slowly after review or handled inconsistently. Ofcom has not published X's quarterly submission, the number of user reports, the share found illegal, the share removed, the time from report to removal, appeal outcomes or false-positive and false-negative rates. The public evidence therefore supports a narrow conclusion: the stated review clocks were met in the first reporting period, while the safety outcome remains unresolved.[1][2]
What the regulator measured — and what remains hidden
Ofcom describes two commitments rather than a statutory pass mark. The first is an average review time of 24 hours for suspected illegal terrorist and hate content submitted through X's dedicated UK reporting route. The second is a distributional backstop: at least 85% of those reports should be reviewed and assessed within 48 hours during the three-month period.
An average can conceal a long tail of delayed cases, which is why the 85% measure is useful. But neither number reveals whether the reviewer reached the correct decision. They also cover reports made through one dedicated tool, not every route through which users, trusted flaggers or automated systems might surface harmful material. Ofcom does not disclose the denominator or explain how duplicate, incomplete or abusive reports were treated.
A fuller assessment would publish report volumes, median and upper-percentile times, content categories, removal rates after review, time-to-removal and results from independently sampled content. It would also separate clearly illegal material from difficult borderline cases. Without those measures, readers should not translate 'within the agreed response timeframes' into 'X is compliant' or 'the problem is fixed'.[1]
The Grok-related investigation is still open
Ofcom opened its investigation into X Internet Unlimited Company on 12 January after widespread reports that a Grok model on X was being used to generate and share material that might amount to intimate-image abuse, child sexual abuse material and pornography accessible to children. The case examines X's risk assessments and systems for illegal content, child protection, reporting and complaints under the Online Safety Act.
The 14 October update says Ofcom has gathered and analysed extensive information using formal powers. The next phase will decide whether the evidence gives reasonable grounds to believe X failed to comply with duties protecting UK users from illegal content. If so, Ofcom would issue a provisional notice and X would be able to respond before any final decision.
That procedure is important. Ofcom has not found X in breach, and narrowing an investigation is not an acquittal on the remaining issues. The regulator is focusing resources on illegal-content, reporting and complaint duties while leaving open the possibility of revisiting child-safety questions if new information appears. Enforcement powers described on the case page include substantial fines and, in the most serious continuing cases, court-approved disruption measures, but no such sanction has been imposed in this update.[1][2]
X changed age-gating, but effectiveness data are absent
During evidence gathering, Ofcom found that age-gated pornographic material could, in certain circumstances, remain accessible to accounts that had not been verified as belonging to adults. X then made immediate changes so labelled pornography should be consistently restricted for accounts that have not completed age assurance using the platform's designated methods.
Ofcom consequently stopped taking forward, for now, its assessment of specified children's risk-assessment, child-safety and child-harm reporting duties. It explicitly says it is making no findings on compliance with those duties and continues to monitor age checks. The reported change is therefore a remedial step, not a validated safety result.
The public update supplies no test denominator: it does not state how many accounts, age states, devices, content formats or evasion attempts were checked before or after the change. It also does not quantify the risk that adults are wrongly blocked or that children bypass the controls. Independent testing across ordinary browsing, shared links and embedded or re-posted media would be needed to establish whether the restriction works consistently in practice.[1][2]
Standalone Grok has UK restrictions that the Act did not directly compel
Ofcom says gaps in the Online Safety Act prevented it from investigating the creation of illegal images inside the standalone Grok service when the X case opened. After engagement with the regulator, SpaceXAI — formerly xAI — restricted requests involving real people in revealing attire and later added UK-specific controls intended to protect children from pornographic material.
For users with UK IP addresses, the standalone service now restricts viewing, generating or sharing pornographic content through its image-generation technology. Companion chatbots, including Ani, are also restricted from sexually explicit conversations with UK users. These changes show that regulatory engagement can alter product behaviour even where the legal perimeter is disputed or incomplete.
They do not establish that every harmful prompt, account state or network route is blocked. Ofcom provides no adversarial test set, success rate, geographic-control error rate or evidence about VPNs, roaming users and travel. IP-based controls can also affect adults temporarily visiting the UK while failing to identify a UK child whose traffic appears elsewhere. The regulator says it will monitor application of the restrictions and continue discussing how the Act applies to the standalone service.[1]
What this means for people and public services
For people reporting illegal hate, terrorist material or non-consensual sexual images, speed matters because continued exposure can magnify distress, copying and distribution. But an acknowledgement or internal review does not protect a victim unless the decision is accurate, the content is removed where required and re-uploads are managed. Users should preserve evidence and use official reporting or law-enforcement routes where immediate risk or suspected criminal content is involved rather than relying on one platform report alone.
Teachers, safeguarding leads, police, victim-support services and public-sector communications teams need equally careful language. The regulator has documented changes and an active enforcement process; it has not certified X or Grok as safe. Institutions deciding whether to use or recommend these services should assess their own safeguarding, records and escalation duties rather than treating Ofcom engagement as a product endorsement.
For Parliament and policymakers, the standalone-chatbot gap is the structural issue. A user may experience the same AI brand through a social platform, app or link while the legal basis for oversight changes with the delivery channel. Clearer coverage, transparent testing powers and comparable reporting standards would make safety outcomes easier to evaluate without assuming that every conversational or generative service should be regulated identically.[1][2]
Evidence limits and what would change the assessment
Both central sources are Ofcom publications. They are authoritative for the regulator's commitments, actions and legal position, but they do not independently reproduce X's operational data. X's quarterly report is not linked, and neither source includes the sampled posts, reporting denominator, removal decisions or statistical uncertainty needed to audit performance.
The assessment would become stronger if Ofcom published standardised denominators and independently tested removal outcomes, including difficult cases, repeat uploads and results for protected groups. A provisional or final enforcement decision would materially change the legal assessment. Evidence that age assurance and Grok restrictions work across devices, account states and adversarial attempts would change the product-safety assessment.
Until then, the most accurate reading is mixed: X appears to have improved the speed of reviewing one category of user reports and changed controls after regulatory scrutiny, while Ofcom remains concerned about the outcome that matters most — whether illegal content is handled effectively. That is consequential policy news, but it is not an urgent breaking event or a completed finding of wrongdoing.[1][2]
What this means for people
- People reporting illegal hate, terror or intimate-image abuse need accurate removal and escalation, not only a fast acknowledgement or review.
- Children may receive stronger protection from labelled pornography and explicit Grok features, but Ofcom has not published independent effectiveness rates.
- Teachers, safeguarding professionals and public bodies should not interpret the regulator's update as certification that X or Grok is safe.
Global context
The action applies to UK users under the Online Safety Act and to UK-specific controls on standalone Grok. Other countries may regulate the same platform and AI service differently. The case illustrates a wider global problem: social-platform features and standalone chatbots can deliver similar harms while sitting inside different legal categories and evidence-reporting systems.
What the evidence does not yet show
- X's quarterly report and its underlying denominator are not public in the cited material.
- Review speed does not measure decision accuracy, removal effectiveness, time-to-removal or re-upload prevention.
- Ofcom has made no final finding that X complied with or breached the Online Safety Act duties under investigation.
- No independent denominator or error rate is published for the revised age-gating or standalone Grok controls.
- The two central sources represent the regulator's account; the article does not infer undisclosed company data or user outcomes.
What to watch next
- Ofcom's cross-checks against its own testing and the next quarterly analysis
- Any provisional notice, company response or final enforcement decision
- Published denominators for reports, removals, age-assurance tests and Grok restriction failures
- Legislative changes addressing standalone generative-AI services
Living evidence record
Impact record IAI-02EI1T6
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
14 October 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 14 October 2026
Research question, topics and regions
UK enforcement of illegal-content, child-safety and complaints duties where a social platform embeds a generative AI service
Topics: Ofcom · X · Grok · Online Safety Act · Illegal content · Age assurance · AI-generated sexual content
Regions: United Kingdom · Europe · Global platforms
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
Government & Policy
Can AI assist judges without deciding cases?
England and Wales' judiciary says approved AI may support tasks such as summarisation, transcription, redaction and document analysis, but every output used in judicial work must be reviewed and approved by the responsible judge. The position sets governance boundaries; it does not publish pilot results or authorise autonomous decisions.
8 min · 1 source
Government & Policy
What is the EU investigating after AI ‘loss-of-control’ reports?
The EU AI Office says it has received serious incident reports and will send further questions to the developers involved. The Commission has not identified the incidents, companies, models, harms or findings, while its scientific advisers’ four proposals remain recommendations rather than new legal duties.
8 min · 3 sources
Government & Policy
Who can win the UK’s £1.66m ‘controllable AI’ competition?
Innovate UK has opened a £1.66 million competition for UK SMEs testing reusable AI mechanisms, with projects limited to £50,000–£150,000 and an indicative 4% success rate. It funds early experimental validation—not products proven safe, scalable or commercially successful.
7 min · 1 source
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.