Across 10 years as eSafety Commissioner, I have watched the online world change at extraordinary speed. The challenge for regulators has grown and morphed just as quickly.
New and evolving technologies are reshaping how we connect, learn, work and take part in public life.
Recommender systems now shape much of what people see online. AI is being built into more products and services, opening up powerful possibilities while creating new ways for people to be harmed.
At this juncture, we must consider: what does it take to be a future-ready regulator?
After a decade in this role, I am convinced we need a much clearer view of how technologies and systems behave in practice. Company policies and public statements only give us part of the picture. To regulate effectively, regulators need the ability to directly scrutinise underlying systems, processes and outcomes, rather than relying solely on claims by the companies themselves about how harms are being addressed.
Setting out the core requirements
The online safety environment we are operating in is becoming more personalised, fast-moving and complex. Harms have become increasingly sophisticated and can spread quickly across services and across borders. Platforms change daily. New products and features appear at pace. Technologies that promise convenience or creativity can also be used to manipulate, threaten, exploit or intimidate.
Taking all this into account, a regulator’s effectiveness depends on the people, systems and capabilities which underpin it.
Seeing what happens inside the system
As novel content and conduct harms emerge and converge, we are faced with a unique challenge: how to ensure regulation is ready, capable, and responsive to the evolving risk landscape.
Consider recommender systems as an example. They influence what appears in a person’s feed and what is recommended next. Those experiences can differ markedly from one user to another. Yet the reasons behind those recommendations are often opaque. Greater transparency is needed so people can make informed choices about their online experiences, and regulators can assess how these systems affect users and whether safeguards are working.
AI presents a related challenge. These systems and the services built around them can evolve quickly as providers update models and introduce new features. Regulators need to know not just what an AI service is designed to do, but what it can be made to do – including whether it can generate illegal material such as synthetic child sexual abuse material.
Safeguards at launch are not a permanent guarantee of safety. Where model weights are publicly available, safety behaviours can be weakened or removed through modifications such as ‘abliteration’. Regulators therefore need evidence that safeguards withstand misuse and remain effective after release, supported by ongoing monitoring and lawful, independent testing.
Regulators therefore need access to data, research, systems and processes, providing the ability for them to look beyond a service’s stated safety settings and examine how those safeguards perform in practice.
This is where observability comes in. It means a regulator needs enough visibility into a system to understand what it is doing and what people experience as a result.
That may require access to platform data or technical information. In some cases, regulators will need to test the system directly.
Without that visibility, regulators risk missing emerging harms, accepting safeguards that fail in practice, and intervening only after people have been harmed. Companies’ assurances can too easily substitute for independent scrutiny.
Good regulation needs technical muscle
Access to information is useful only if a regulator can make sense of it through analysis.
This requires people who understand how these technologies work and can interrogate the evidence they produce. It requires systems that can keep pace with the volume and complexity of that evidence, especially in major investigations.
For evolving technologies like recommender systems and AI, specialist expertise, testing and auditing capabilities, and strong evidence gathering and enforcement powers, are paramount.
Bringing together different perspectives
Effective analysis is underpinned by multidisciplinary capability, which spans legal, investigative, technological, behavioural, data science, research and lived-experience expertise.
Lawyers remain essential, but their analysis needs to sit alongside technical expertise. Research can add another perspective by revealing patterns in user experience that a technical audit may miss. Lived and living experience belongs in that work too since the effect of a system is ultimately felt by people, and by rigorously capturing their experiences with technology.
Importantly, multidisciplinary teams give regulators the necessary agility to respond to rapidly changing technologies, harms and business models in a proportionate way.
Testing the claims, not just reading them
Transparency is a critical enabler of effective regulation – you simply cannot have accountability without meaningful transparency. Providers should explain what they are doing to reduce risk and provide evidence for those claims.
Regulators also need powers that let us look more closely when the circumstances demand it.
That can include access to technical specifications or platform data that shows how a system is operating. Testing and auditing will become increasingly important as technologies such as AI and recommender systems are embedded more deeply into online services.
The question is practical: does the safety measure actually reduce risk?
A regulator should be able to find out.
That scrutiny may challenge commercial interests, particularly where business models depend heavily on user engagement. This is why compulsory information-gathering and examination powers have an important place alongside voluntary cooperation through initiatives like #safetybydesign.
Regulators also need the capacity to use those powers properly. Some technical capability should sit inside agencies, while highly specialised work may still require outside expertise. This requires an equally robust, mature and experienced advisory sector that can supplement specialist expertise for regulators and provide critical support to inform regulatory operations.
Global platforms need regulators working together
Most major online services operate across boundaries and borders. The risks they create rarely stop at them. That makes cooperation between regulators part of our job.
Through eSafety’s international work, such as pioneering the Global Online Safety Regulators Network, I have seen the value of that cooperation firsthand. Regulators can compare what they are seeing and learn from action taken elsewhere.
That shared view becomes especially useful when the same company is operating across many jurisdictions. No single regulator sees everything. Together, regulators can build a more complete understanding of emerging risks, platform behaviour and effective regulatory responses. Working as a collective, particularly amongst the middle powers, is the only way we can meet the wealth, stealth and power of the global technology and AI sectors.
Working across these sectors, with researchers and technical standards bodies can also improve how regulators examine complex systems and develop common ways to test them.
Global services demand regulatory cooperation that can cross borders too. The adage that you can move faster alone but further together is one that certainly applies to the regulatory sphere.
What the next decade will require from regulators
In this fast-paced online safety landscape, new and evolving technologies will continue to change the systems people use and the risks those systems create. Regulation must be able to see those changes clearly enough to respond.
That is the standard we should set now: ensuring regulators have the visibility, expertise and proportionate powers to test what is happening inside these complex systems and act before people are put at risk.
The technology will keep moving. Our ability to protect people must move with it.
