1. Regulatory focus
Ofcom opened an enforcement programme on September 9, 2026, targeting the spread of non-consensual intimate imagery, with instant messaging identified as a priority sector and the relevant code amendments effective September 30. Under the recommended measures, covered providers should arrange human assessment of an appropriate proportion of detected content rather than assume that an automated match always establishes illegality. Review allocation should reflect confidence in detection, the severity of potential harm and the consequences of an incorrect decision for the uploader. Providers choosing alternatives to hash matching must demonstrate that those arrangements are equally effective in meeting their legal duties. ([ofcom.org.uk](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/Enforcement-programme-into-measures-being-taken-by-services-to-prevent-users-from-encountering-or-sharing-non-consensual-intimate-imagery-NCII?language=en&utm_source=openai))
2. Business impact
The enforcement focus on messaging does not mean that every private conversation must be scanned: ICU C14 defines relevant content around imagery communicated publicly and accessible to UK users, with applicability also depending on service characteristics, scale and risk. For covered operations, configurations that prioritise recall or rely on unverified hashes can require a larger human-review allocation to control false positives. Where a mistaken decision restricts an account or affects creator earnings, teams should also consider how promptly the action can be reversed. Consequently, operational reporting should not treat the number of blocked uploads as sufficient evidence of effective or proportionate moderation. ([ofcom.org.uk](https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/detecting-intimate-image-abuse/amendments-to-illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=425051))
3. Operating recommendations
As an implementation approach, document applicability separately for public image and video sharing and private conversations, then distinguish case-level illegality decisions from sampled quality assurance in reviewer workflows. Retain performance evidence for configuration changes, and feed missed content discovered through user reports or complaints back into quality assurance rather than closing the operational record after removal. When following the code measure, review the balance between precision and recall at least every six months and document the configuration rationale, review findings and resulting changes. Assign owners to both review streams so that individual decisions and systemic detection errors can be addressed separately. ([ofcom.org.uk](https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/detecting-intimate-image-abuse/amendments-to-illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=425051))
Frequently Asked Questions
Does one-to-one customer-support image upload automatically require scanning?
Can strong vendor detection results justify removing human review?
Can an unfinished implementation treat the period after September 30 as a grace period?
Sources
- Ofcom: Enforcement programme into measures being taken by services to prevent users from encountering or sharing NCII — 9 September 2026
- Ofcom: Guidance on appropriate proportion of human review for intimate image abuse hash matching — 9 September 2026
- Ofcom: Amendments to Illegal content Codes of Practice for user-to-user services — in force 30 September 2026
- Ofcom to crack down on spread of illegal intimate images and deepfakes, boosting protections for women and girls online — 9 September 2026