Ask what changed in Trust & Safety since 2024 and most people say AI. Id say its what you have to prove. The question used to be whether you had a policy. Now its whether you can show it works.
Last month I wrote that you cant moderate your way out of a systems problem. That idea now comes with deadlines. Under the UK Online Safety Act, services with UK users owed written illegal content risk assessments by March 2025, and any significant change needs a fresh one before it ships. That last part turns a one-off filing into a record you have to keep current.
Age assurance is the foundation. Australia's social media minimum age of 16 took effect in December 2025, and the EU's July 2025 guidelines on minors recommend age estimation even where a platforms own minimum age is under 18. The method matters less than what each level of check unlocks, and since a threshold touches product, safety, legal and privacy at once, it needs one owner.
Removal runs on a clock too. Since May 2026 the US TAKE IT DOWN Act gives covered platforms 48 hours from a valid request to remove a nonconsensual intimate image, AI-made ones included. The tooling floor moved as well. ROOST launched in February 2025 and publishes free open-source review tools, open-weight models can classify content against a written policy, and were too small is a weaker answer now.
If a CEO asked me where to start, Id ask who owns all four before I picked one. In most companies the risk assessment sits with Legal, the age checks with Product and the takedown inbox with Support, and nobody sees them side by side until a regulator does.
The fix is one owner for the whole picture, named by the leadership team and agreed out loud, so nobody assumes someone else has it.
If you can't name that person today, start there. It's cheaper than finding out from a regulator.
#TrustAndSafety #OnlineSafety #AgeAssurance #SafetyByDesign #Compliance