Check your content against UK speech law frameworks

Home / Blog / The Crime and Policing Act 2026: A Plain-English Overview for Publishers

← Back to Blog

The Crime and Policing Act 2026: A Plain-English Overview for Publishers

Published 9 July 2026

On 29 April 2026, the Crime and Policing Act received Royal Assent — the newest layer in the UK's sprawling framework of speech-related legislation. It does not replace any existing law. It adds to it. And for publishers, content creators, and anyone running a platform where users post content, it contains several provisions that matter directly.

This guide focuses on the sections most relevant to publishers: the new intimate image generator offence, the expanded public order powers, the OFCOM-related provisions, and — most significantly — the expansion of corporate criminal liability that means your company can now be prosecuted for the actions of any senior manager.

Disclaimer: General information, not legal advice. The CPA 2026 is very new — the law is still developing. Speak to a solicitor if your platform or content falls within its scope.

Jurisdiction: England and Wales. The Act extends UK-wide with some provisions applying differently in Scotland and Northern Ireland.

Crime and Policing Act 2026: Speech-Relevant Provisions s.99 — INTIMATE IMAGE GENERATORS Making/supplying tools for creating non-consensual intimate images Up to 3 years' imprisonment ss.157-169 — PUBLIC ORDER Concealing identity at protests (ss.157-159) Places of worship (s.164), cumulative disruption (s.165) Harassment via home protest (s.169) ss.247-248 — ONLINE SAFETY OFCOM notices to ISPs (s.247) Ministerial power to amend OSA priority content (s.248) s.250 — CORPORATE LIABILITY Companies liable for ALL criminal offences by senior managers — from 29 June 2026 Also: Stalking — "Right to Know" identity of online stalkers. Enhanced protections covering online aliases. Part 5: sexual offences, anti-social behaviour provisions, and sentencing reforms. Key dates: Royal Assent 29 April 2026. s.250 (corporate liability) in force 29 June 2026. Most provisions effective 28 July 2026 onwards. Sources: CPA 2026; Home Office Explanatory Notes.
The four speech-relevant clusters of the CPA 2026: intimate images, public order, online safety, and corporate liability.

Section 99: Intimate Image Generators — The "Nudification" Offence

The most directly speech-relevant provision for publishers and platform operators. Section 99 makes it an offence to make, adapt, supply, or offer to supply a device or software designed or adapted to produce non-consensual intimate images — so-called "nudification" tools. The offence covers the creators and distributors of the tools themselves, not just the people who use them to generate images. Maximum: 3 years' imprisonment on indictment.

For platform operators and publishers, this means: if your platform hosts, distributes, or facilitates access to tools that can generate non-consensual intimate images, you may now face criminal liability — not just for the images themselves, but for the tools used to create them. This is a new category of liability that did not exist before April 2026.

Public Order: Sections 157-169

The CPA 2026 expanded police powers in several ways relevant to publishers covering protests and public demonstrations:

Concealing Identity (ss.157-159): New powers to designate areas where concealing identity — wearing masks, balaclavas, or other facial coverings — during protests is an offence. Journalists and publishers covering protests need to be aware that footage or images of protesters with concealed identities may now be evidence of an offence.

Places of Worship (s.164): Police can impose conditions on protests near places of worship if they may intimidate persons from accessing worship. This is a new category of protected space.

Cumulative Disruption (s.165): Police must now consider the cumulative effect of multiple protests when deciding whether to impose conditions. A single protest that would not justify restrictions may do so when combined with others — a significant change for protest organisers and those covering them.

Home Harassment (s.169): Broader powers to restrict protests outside someone's home about their past conduct. Previously, such powers were limited; the CPA extends them.

Section 250: The Biggest Change for Companies BEFORE CPA 2026 Corporations liable for economic crimes "Directing mind and will" test limited liability to the very top — CEO, board level only AFTER CPA 2026 (FROM 29 JUNE) Corporations liable for ALL criminal offences by ANY senior manager — not just directors Unlimited fines. Criminal conviction for the company. What this means: if a senior manager knowingly allows illegal content on your platform, your company faces criminal prosecution Combined with OSA 2023 platform duties and OFCOM enforcement powers — a dramatically expanded liability framework This is the most significant expansion of corporate criminal liability in UK law in decades "Senior manager" includes those who play a significant role in decision-making or managing the organisation
Section 250 is the most significant change for companies — expanding corporate criminal liability from the boardroom to any senior manager.

How the CPA Fits With Other Laws

The CPA 2026 does not replace any existing statute — it adds to them. The speech-law landscape is now a patchwork of thirteen separate Acts, with the CPA as the newest and least-tested layer.

Online Safety Act 2023: The OSA created platform duties and individual criminal offences. The CPA adds to this: ss.247-248 give OFCOM and ministers more powers, and s.250 dramatically expands the consequences of non-compliance by making companies criminally liable for senior managers' failures.

Communications Act 2003, s.127: Still the workhorse for individual online-speech prosecution. The CPA does not affect s.127 directly — but a senior manager who knowingly allows s.127-offending content to remain on a platform could now expose the company to criminal liability under s.250.

Human Rights Act 1998, Article 10: The free-expression counterweight. The CPA's public order provisions — particularly around protests — will need to be assessed for compatibility with Article 10. The "cumulative disruption" test (s.165) and the home-harassment extension (s.169) are the provisions most likely to generate Article 10 challenges.

Practical Takeaways for Publishers 1. Nudification tools are illegal Making or supplying them: 3 years 2. Corporate liability expanded Any senior manager's offence = company liable 3. Protest coverage changed New restrictions on identity, locations CPA 2026 is the newest layer. It does not replace anything — it adds. Most provisions effective from July 2026. UK Content Comply analyses content against 13 UK speech law frameworks. See resources page. Sources: CPA 2026; Home Office Circular 004/2026; legislation.gov.uk
Three key takeaways for publishers covering the newest layer of UK speech law.

Sources