On 14 October 2026, Ofcom published an update on X. It contains two findings. X's first quarterly report on reported hate and terror content shows faster reviews, within the timeframes X committed to in May. Ofcom also says it has "ongoing concerns around the effectiveness of X's response to taking down illegal hate and terror content." Speed is being met. Whether the speed produces correct outcomes is still open.
The case for tough scrutiny
The strongest argument for close regulatory pressure on X is that a platform can game any process metric. A review is not a removal. If X reviews reports quickly but reaches the wrong decision, or reviews quickly and acts on little, the headline numbers improve while users see no change. Ofcom appears to take that view. It says it will cross-check X's figures against its own tests, and it says X "must, as a minimum, sustain this performance." Critics of light-touch oversight would add that a single quarter proves little, and that Ofcom has already received "mixed reports" on whether X is sustaining its promise to engage third-party experts.
That argument is fair. It also describes what Ofcom is doing.
What X committed to, and what it delivered
On 15 May 2026, Ofcom accepted commitments from X. X would review suspected illegal terrorist and hate content reported through its dedicated UK tool within 24 hours on average, measured over three months. It would review at least 85% of such reports within 48 hours as a backstop. It would withhold UK access to accounts run by or for UK-proscribed terrorist organisations. It would engage experts on its reporting systems. And it would submit performance data quarterly for 12 months.
Ofcom's October update says the first report suggests faster response times than earlier evidence and falls within the agreed timeframes. Ofcom's online safety director, Oliver Griffiths, had called the May commitments "a step forward, but there's a lot more to do". Ofcom expects to publish further analysis in early 2027.
This is a regulator using a negotiated, monitored undertaking instead of opening with a penalty. That approach has real advantages. It produces a measurable commitment on a short timeline, and it avoids years of adversarial litigation over a single decision. The cost is that the metric is an input. Review time is easy to measure and to report. Removal accuracy is harder, and it is the thing that matters to the people reporting abuse.
The narrowed Grok investigation
Ofcom opened its Online Safety Act investigation into X in January after reports that the Grok account on X was being used to create and share demeaning sexual deepfakes of real people, including children. It has now narrowed the investigation to X's illegal content duties and its complaints and reporting duties. The reason it gives is that X has changed its approach: "content labelled as pornography is consistently restricted for accounts that have not completed age assurance." Ofcom had found that age-gated pornography was in some circumstances still reachable by accounts not verified as 18 or over. It says it continues to monitor how well X's age checks work.
This is a sensible use of enforcement. A regulator that drops a limb of an investigation once the problem is fixed gives companies a reason to fix problems quickly. The alternative, keeping every allegation open until a final decision regardless of remediation, rewards delay. If Ofcom reaches reasonable grounds to believe X failed its duties, it will issue a provisional view and X will have a full opportunity to respond before any final decision.
The chatbot gap
The most consequential detail may be what Ofcom could not investigate. When it opened the case, it said it was unable to investigate the creation of illegal images within the standalone Grok service, because of "gaps in the way chatbots are covered under the Act." The Online Safety Act was written around user-to-user services and search. A standalone generative AI tool, where the user is talking to a model and not posting to other users, does not fit the structure neatly.
In practice, the gap was closed by negotiation, not by law. After engagement with Ofcom, SpaceXAI (formerly xAI) restricted users from generating or viewing images of real people in revealing attire. It has since restricted UK-IP users from viewing, generating or sharing pornographic content through standalone Grok's image generation, and stopped companion chatbots such as 'Ani' from engaging in sexually explicit conversations with UK users. Ofcom says it will monitor these restrictions and engage with SpaceXAI on how the Act applies more broadly to the standalone service.
That outcome should please nobody who values legal certainty. Voluntary restrictions reached under regulatory pressure can be withdrawn, and a company cannot know in advance which of its products the regime covers. A pro-innovation position is not an argument for leaving the gap open. It is an argument for closing it deliberately, with a narrow, parliament-defined scope for generative AI services, instead of regulator-by-regulator improvisation.
What a proportionate approach looks like
Three things follow from the update.
- Measure outcomes, not only speed. Quarterly review-time data is a start. Ofcom's own tests of whether illegal content is actually removed, and removed correctly, are the real check. Over-removal is also a risk: faster review under a regulatory deadline pushes platforms toward taking down lawful speech. Ofcom should publish how it will test for errors in both directions.
- Keep remedies tied to fixes. Narrowing the Grok case after the age-check change is the right signal. It should be applied consistently to other services.
- Legislate the chatbot question. If standalone AI services should carry duties, Parliament should say which and why. If they should not, that should also be explicit.
The update is neither a vindication of X nor a failure of the regime. It shows a regulator extracting measurable improvements through monitoring, and it shows the limits of the statute as written.