Crime and Policing Bill

Baroness Kidron Excerpts

Thursday 27th November 2025 Lords Chamber

Moved by

[Baroness Kidron]

266: Clause 63, page 81, line 34, at end insert—
“46D Child sexual abuse image-generation risk assessment(1) A provider of an online service, including but not limited to a generative AI large language model, must risk assess the likelihood of their service being used to create or facilitate the creation of a CSA image or images as defined by section 46A.(2) If a risk is identified in a CSA risk assessment—(a) where the provider is regulated by the Online Safety Act 2023, a provider must report the risk and agree to steps to reduce, mitigate and manage the risks with OFCOM;(b) where the provider is not regulated by the Online Safety Act 2023, a provider must agree to steps to reduce, mitigate and manage the risks of their online service being used to create or facilitate the creation of CSA images with the National Crime Agency.(3) Where a provider regulated by the Online Safety Act 2023 fails to agree to or implement steps to reduce, mitigate and manage the risks with OFCOM (see subsection (2)(a)), they can be subjected to OFCOM’s enforcement powers set out in Part 7, Chapter 6 (enforcement powers) of that Act.(4) Where a provider not regulated by the Online Safety Act 2023 fails to agree to or implement steps to reduce, mitigate and manage the risks with the National Crime Agency (see subsection (2)(b)), they commit an offence.(5) A provider that commits an offence under this section is liable to be issued with a penalty notice by the National Crime Agency.(6) In this section a “penalty notice” means a notice requiring its recipient to pay a penalty of an amount not exceeding whichever is the greater of—(a) £18 million, or(b) 10% of a provider’s qualifying worldwide revenue for the most recent complete accounting period.(7) A penalty notice may be reissued where a provider continues to commit an offence under this section.”Member’s explanatory statement
This amendment is intended to ensure that services that do not fall into scope of Clause 63 as currently drafted still assess and mitigate the risk of their services being used as an AI child sexual abuse generator.

[Baroness Kidron (CB)]

My Lords, in moving Amendment 266, I will speak also to Amendments 479 and 480, all of which are in my name. I thank the noble Baroness, Lady Morgan, the noble Lords, Lord Clement-Jones and Lord Russell, and the noble Viscount, Lord Colville, for their support.

All three amendments concern illegal or harmful online activity. Amendment 266 places a legal duty on online services, including generative AI services, to conduct risk assessments evaluating the likelihood that their systems could be used to create or facilitate child sexual abuse material. Subsection (1) of the proposed new clause establishes that duty. Subsection (2) requires providers to report the results to Ofcom or the National Crime Agency, depending on whether or not they are regulated under the Online Safety Act. Subsections (3) to (7) set out the enforcement mechanisms, drawing on Ofcom’s existing enforcement powers under the OSA or equivalent powers for the NCA.

Amendment 266 complements Clause 63, which creates the new offence relating to the supply of CSA image generators to which the Minister has just spoken, but it is in addition to those powers. In June 2023, the BBC reported that the open-source AI model Stable Diffusion was being used to generate child sexual abuse material. Researchers at Stanford University subsequently found that Stable Diffusion had been trained on datasets containing child sexual abuse material. This issue is not confined to a single model. The Internet Watch Foundation and the chair of the AI Security Institute have warned of the potential for open-source AI models to be used for the creation of CSAM.

--- Later in debate ---

[Lord Hanson of Flint (Lab)]

I am very happy to arrange a meeting with an appropriate Minister. I would be very happy to sit in on it. Other Ministers may wish to take the lead on this, because there are technology issues as well. I have Home Office responsibilities across the board, but I have never refused a meeting with a Member of this House in my 16 months here and I am not going to start now, so the answer to that question is yes. The basic presumption at the moment is that we are not convinced that the technology is yet at the stage that the noble Lord believes it to be, but that is a matter for future operation. I again give him the assurance that, in the event that the technology proves to be successful, the Government will wish to examine it in some detail.

I have absolutely no doubt that we will revisit these matters but, for the moment, I hope that the noble Baroness can withdraw her amendment.

[Baroness Kidron (CB)]

I pay tribute to the noble Lord, Lord Nash, for his amendment and his fierce following of this issue, and for bringing it to our attention. I recognise that this is a Home Office Bill and that some of these things cross to DSIT, but we are also witnessing crime. The Home Office must understand that not everything can be pushed to DSIT.

Your Lordships have just met the tech Lords. These are incredibly informed people from all over the Chamber who share a view that we want a technological world that puts kids front and centre. We are united in that and, as the Minister has suggested, we will be back.

I have three very quick points. First, legal challenges, operational difficulties and the capacity of the NCA and Ofcom were the exact same reasons why Clause 63 was not in the Online Safety Bill or the Data (Use and Access) Bill. It is unacceptable for officials to always answer with those general things. Many noble Lords said, “It’s so difficult”, and, “This is new”, with the Online Safety Bill. It is not new: we raised these issues before. If we had acted three or four years ago, we would not be in this situation. I urge this Government to get on the front foot, because we know what is coming.