Ofcom has begun a wide-ranging internal review of how it is organised for the next phase of UK online safety regulation. In a 15 July 2026 letter to ministers, chair Sir Ian Cheshire said the work covers Ofcom’s structure, operating model, enforcement balance, capabilities, priorities and measures of impact. The review is due to conclude in early autumn.
The immediate pressure is workload. Cheshire told the Financial Times on 3 August that Ofcom’s workload has almost doubled since it became the Online Safety Act enforcer, and that more resources would probably be needed. That is an assessment of future need, not confirmation that new funding, staff or statutory powers have been approved.
For B2B technology companies, the Ofcom Big Tech review 2026 matters less as another headline about “reining in Big Tech.” It is the possibility that Ofcom changes how quickly it supervises services, how it prioritises cases and what evidence it expects. The current Online Safety Act duties remain the baseline while the review is under way.
Direct answer — What changed in the Ofcom Big Tech review 2026?
Ofcom is reviewing its organisational structure and operating model for online safety, including the balance between policy, compliance and enforcement, the capabilities it needs, how it measures impact and whether targeted changes to its enforcement framework or powers should be recommended. The review is due in early autumn. It has not itself granted Ofcom new powers, staffing or funding.
Key Takeaways
- Ofcom says the internal review is already under way and will conclude in early autumn 2026.
- Sir Ian Cheshire described the regulator’s workload as having almost doubled since Online Safety Act enforcement began.
- The review covers structure, operating model, people, capabilities, priorities, impact measures and possible targeted improvements to enforcement powers.
- No new powers, staffing allocation or funding increase has been announced through the review.
- In-scope services should keep working against current duties and separate confirmed rules from possible review recommendations.
What Ofcom Is Actually Reviewing
The official scope is broader than a staffing exercise. Ofcom is examining whether its organisational structure and operating model fit the next phase of online safety regulation. It is also reviewing the balance between policy development, compliance and enforcement, particularly as litigation becomes a more common feature of the regime.
The letter identifies four further questions: whether Ofcom has the right people and capabilities in the right places, how it should prioritise the harms that matter most, how it should measure outcomes, and whether targeted improvements to the enforcement framework or its powers would help it deliver existing duties more effectively.
That last point needs careful reading. Ofcom is considering whether to recommend changes. The letter says conclusions that require government support or legislative change would be discussed with ministers after the review. It does not say those changes have been accepted. Cheshire’s stated goal is for the regulator to become “faster, more agile and more outcome-focused” while retaining evidence-based decisions.
Why the Workload Claim Matters
Online safety is no longer a small extension of Ofcom’s traditional telecoms and broadcasting remit. Ofcom says the Online Safety Act covers more than 100,000 services and over 130 priority offences. The regulator must implement remaining parts of the regime while supervising compliance and pursuing enforcement under rules already in force.
The work is also evidence-heavy. Ofcom’s updated implementation roadmap says it requested and received 104 risk-assessment records in 2025, and required certain providers to submit records between 1 May and 31 July 2026. The same roadmap covers child sexual abuse reporting, fee administration, technology notices and future transparency requirements.
Those obligations explain why an internal operating-model review matters even without a new law. A regulator can change case selection, supervision cadence, internal ownership and evidence review within an existing statutory framework. For regulated platforms, that can alter the practical cost and speed of compliance before Parliament changes a single sentence.
The Hidden Catch: This Is Not a New Rulebook
Our read: the near-term risk is enforcement tempo, not a newly expanded legal perimeter. Headlines about more resources and new powers compress three different possibilities into one story.
- Internal changes: Ofcom may reorganise teams, change priorities or adjust how policy, supervision and enforcement work together.
- Resource recommendations: Cheshire said more resources would probably be needed, but the review has not announced an approved budget or headcount increase.
- Statutory changes: any recommendation that needs legislative change still requires government and parliamentary action.
That distinction matters for compliance planning. Teams should not rewrite controls around a possible recommendation. They should maintain evidence against current duties, then update processes when Ofcom publishes a conclusion, timetable or formal consultation.
What B2B Platforms and Marketing Teams Should Do Now
- Confirm whether the product is in scope. User-to-user features, search, communities, messaging, reviews, file sharing and some AI interfaces can create questions that ordinary corporate websites do not. Product and legal teams should document the assessment rather than rely on a marketing label.
- Preserve the evidence trail. Keep current risk assessments, product-launch tests, moderation decisions, escalation records and vendor evidence accessible. A faster regulator still needs records that show what the service knew, decided and changed.
- Label regulatory status precisely. Compliance dashboards should separate rules in force, Ofcom consultations, review recommendations and government proposals. Treating all four as new law creates wasted work and misleading customer claims.
- Watch the early-autumn conclusion. Look for changes to organisational ownership, supervisory priorities, evidence requests and enforcement sequencing. Update launch gates and supplier reviews only when Ofcom publishes an actionable change.
- Ask platform vendors for proof. B2B marketers that do not operate an in-scope service may still depend on social, community or AI vendors. Ask what UK risk, moderation and product-testing evidence they can provide before repeating broad compliance claims.
Frequently Asked Questions
It is an internal review of Ofcom’s structure and operating model for the next phase of online safety regulation. It covers policy, compliance, enforcement, capabilities, priorities, outcome measurement and possible targeted improvements to the enforcement framework. Ofcom says the work will conclude in early autumn 2026.
No new powers, staffing allocation or funding increase was announced with the review. Sir Ian Cheshire said more resources would probably be needed, and Ofcom is considering whether targeted improvements to its powers would help. Any recommendation needing government support or legislation remains a future step.
Ofcom’s 15 July letter says the review will conclude in early autumn 2026. It does not give a precise publication date or promise that every conclusion will be released at once. Teams should monitor Ofcom’s correspondence, consultations and Online Safety Act roadmap for formal follow-up.
Continue complying with duties already in force, document whether product features fall within scope, and keep risk, testing and moderation evidence ready. Separate confirmed obligations from consultations and possible recommendations. Review processes only when Ofcom publishes a concrete change, timetable or request that applies to the service.
