Testing AI for Child Safety Under the Crime and Policing Act 2026
Listen to this article
DESIGNATION CRITERIA FOR AUTHORISED TESTERS: A PRACTITIONER’S PROPOSAL
What the technology testing defence regulations need to say if AI systems are to be tested for child safety at the point of deployment, not just at the point of development.
1. Purpose
Section 111 of the Crime and Policing Act 2026 empowers the Secretary of State to make regulations providing a defence to specified offences for persons authorised to carry out technology testing. The Government has said it intends to designate AI developers and child protection organisations, and that an expert group will help design the safeguards under which testing is done.
This paper sets out, from the perspective of a firm that runs adversarial testing on AI models for large technology companies and regulated enterprises, what the regulations need to cover for the regime to work in practice. It proposes eligibility criteria, minimum conditions of authorisation, a common evaluation scope, and an operating model for running authorised tests. It is offered as a contribution to the expert group’s work.
2. The Problem the Regulations Need to Solve
Three things are true at once. First, generative AI is being misused to create child sexual abuse material at scale, and the material is increasingly realistic and increasingly severe. Second, the organisations best placed to find safeguard failures before deployment have, until now, been legally unable to look, because generating or possessing the material to test for it is itself an offence. Third, most AI that reaches the public is deployed by organisations that did not build the underlying model. Their child safety testing is commissioned from independent assurance providers, not from the developer, and not from a charity.
If the regulations authorise only developers and charities, the regime will cover the frontier laboratories and leave the deployment layer, which is where children actually encounter these systems, outside the safe testing perimeter.
The Existing Baseline
In December 2025, AISI and Thorn jointly published an AI CSAM safety protocol addressed to developers of AI models and tools, and to model hosting platforms and other intermediaries. It sets out safe-by-design principles, routes for non-developer organisations to identify and mitigate misuse through monitoring, access controls and response processes, and it identifies unresolved technical challenges including reliably detecting CSAM in training data and in model outputs.
This paper builds on that protocol rather than restating it. The protocol addresses developers and hosts. It does not resolve how an organisation that deploys a third-party model obtains lawful testing of that deployment, nor does it specify an evaluation scope against which different testers’ results can be compared. Those are the two questions the section 111 regulations must answer.
3. What the Evidence Says About the Testing Gap
Independent research and industry practice point to five weaknesses in how child safety testing is currently done. Each should be addressed by the conditions of authorisation:
Single-prompt testing misses real misuse.
Law enforcement research reports that current AI safety evaluations do not reflect how offenders actually interact with systems: multi-turn conversations, incremental escalation, and workflows that chain tools. Testing that checks only whether a single prompt is refused will pass systems that fail in practice.
Image generation is one surface among several.
Editing of uploaded images, model-assisted creative tools, and text-based facilitation (grooming scripts, evasion advice) are all misuse vectors. The Government has already recognised that the defence must extend to text such as grooming advice.
Overblocking is a real cost.
Users report legitimate content (survivor testimony, education, fiction with no sexual content) being refused inconsistently. A regime that measures only harmful outputs, and not false positives, will push platforms towards blanket refusals that reduce trust without improving safety.
No common metrics exist.
Providers describe their safeguards in general terms but do not publish test suites, thresholds, or pass and fail criteria. There is no way today for a regulator, a platform, or a board to compare one system’s child safety performance with another’s.
Companion bots blur the line between output and relationship.
Sustained, emotionally attentive conversation with a minor is now a product category, not an edge case. Harm emerges from the relationship over time rather than from any single output, so the signals that identify grooming when a human is the perpetrator (secrecy, escalation, isolation from trusted adults) are harder to detect when the system itself is the counterpart, and harder still when it is designed to maximise engagement. Single-turn testing cannot see this at all; it requires longitudinal, persona-based scenarios and an explicit definition of what the system must not become to a child.
4. A Common Evaluation Scope for Authorised Testing
Authorisation should be tied to a defined scope of testing, so that the outputs of different authorised testers are comparable and so that the boundary of the defence is clear.
4.1 Harm Categories
Testing should be organised around the shape of the harm, not around any one platform’s policy taxonomy. Three categories cover the field, each treated as violative by default regardless of realism or style, with age uncertainty resolved conservatively:
Depiction. Any sexualised or nude representation of a minor, whether generated, edited or described, including implicit and non-photorealistic output.
Facilitation. Any output that advances abuse without depicting it: grooming and sextortion technique, evasion of detection, normalisation of exploitation, and assistance with locating or producing material.
Response. How the system behaves when a minor, or someone speaking about a minor, discloses exploitation: the correct behaviour is signposting and reporting, not engagement, deflection or silence.
Evaluation scope: harm categories by surface
Legitimate-use controls (education, survivor accounts, journalism) run across every cell to measure false positives.
Test Generation
Companion Bots
Image & Video
Editing of uploads
Embedded tools
Depiction
Implicit requests age ambiguity
Longitudinal persona
Age ambiguity non-photoreal
Modification of real images
Creative assistant probes
Facilitation
Multi-turn escalation
Secrecy, dependency, isolation
Evasion of detection
Evasion of detection
Attacker workflow
Response
Disclosure scenarios
Disclosure over sessions
Reporting route
Reporting route
Escalation triggers
4.2 Surfaces and Modalities
Text generation, including multi-turn and role-play contexts.
Companion, persona and relationship-style interaction, where the risk accumulates over sessions rather than in a single output.
Image and video generation, including non-photorealistic and stylised output.
Editing and modification of user-uploaded images.
Model-assisted tools embedded in other products (creative assistants, chat features in apps and games).
4.3 Probe Types
Age-ambiguity probes: conflicting, absent, or obscured age cues.
Implicit and euphemistic requests that avoid explicit terms.
Multi-turn escalation and attacker-workflow scenarios.
Longitudinal persona scenarios: a simulated minor user over many sessions, testing for secrecy, dependency, and isolation behaviours.
Legitimate-use controls: education, survivor accounts, journalism, fiction without sexual content, to measure false positives.
4.4 Pipeline Checks
Detection: hash-matching and classifier integration, precision and recall on held-out data.
Escalation: that internal safety escalation triggers fire as designed.
Reporting: that statutory and voluntary reporting routes are invoked where required.
Training data provenance: filtering applied and evidence retained, relevant to the Act’s new offence on models optimised for abuse.
5. Proposed Designation Criteria
5.1 Who May Be Authorised
Three classes, each subject to the same minimum conditions:
AI developers, for their own models, pre and post deployment.
Child protection organisations already licensed to handle material, such as the Internet Watch Foundation.
Independent assurance providers, either designated in their own right or named as sub-authorised testers under a client’s or partner’s authorisation, with the scope of sub-authorisation recorded.
Without the third class, deployers of third-party models have no lawful route to commission testing, and the regime will not reach the systems the public actually uses.
5.2 Minimum Conditions of Authorisation
Area
Minimum Condition
Governance
A named accountable officer; a written testing protocol approved before each engagement; scope tied to the categories and surfaces in section 4.
Personnel
The highest level of DBS check for which the role is eligible, with the regulations making authorised testing an eligible role; named supervisor on every session; documented welfare and psychological support arrangements.
Environment
Isolated tenancy with no external egress; automated classifier in front of every human reviewer; no raw output reaches a person unless the protocol requires it and the authorisation permits it.
Logging and retention
Prompts, classifier verdicts and metadata retained for audit; generated content not retained beyond what the authorisation specifies; destruction certified.
Reporting
Mandatory reporting route agreed in advance (NCA CEOP, IWF, and NCMEC for US-facing work); any genuine material discovered is reported, not merely deleted.
Legal
Written authorisation naming the tester, the scope and the period; engagement contracts allocating liability and prohibiting transfer of material to the tester’s own systems.
Output
A findings report describing failure modes, not content; a retest after remediation; a summary statement suitable for Ofcom or a board.
Audit
Authorised testers subject to periodic review by the Home Office or a nominated body; authorisation revocable.
5.3 Scope of the Defence
The defence should expressly cover text-based facilitation (grooming advice, evasion technique) as well as imagery, and should cover testing of editing and tool surfaces, not only generation. It should also cover the retention of information necessary for audit, as the delegated powers memorandum anticipates.
6. A Proposed Operating Model for Authorised Testing
Designation criteria say who may test and under what conditions. An operating model says how a test is actually run so that the conditions are met and the results are defensible.
The Eight-Step Operating Model
Scope and Threat ModelDefine what is being tested against the three harm categories and five surfaces. Split each item into: no authorisation needed; authorisation needed; executed by a licensed partner.
Legal GateCounsel confirms the scope against the current law. Nothing in the authorised column starts until a written authorisation naming the tester, the scope and the period exists.
ContractEngagement terms covering scope, liability, the environment in which testing runs, the rule that tester personnel never receive, view or store outputs, and who reports what to whom if genuine material is found.
EnvironmentIsolated tenancy, no external egress, classifier in front of every human reviewer, automated blocking and hashing, logging of prompts, verdicts and metadata only.
Test DesignPass condition is refusal or blocked output. Graders see classifier verdicts and redacted transcripts, never raw generations. Sample sizes, multi-turn scenarios, legitimate-use controls and the grading rubric are fixed before execution.
ExecutionNamed supervisor on every session, welfare check-ins, session logs retained to the standard the authorisation sets. Anything requiring authorised handling of material is executed by the designated party.
Findings and RemediationThe report describes failure modes, safeguard gaps, escalation weaknesses and provenance risks. It contains no examples of content.
Destruction, Reporting and RetestRetained material is destroyed and certified; required and agreed reports are filed; the same battery is rerun after remediation and a summary statement issued that a platform can show to Ofcom or a board.
Run this way, the tester’s exposure is confined to steps that the authorisation expressly covers, the client obtains comparable and repeatable evidence, and the regulator obtains an audit trail rather than an assurance.
7. What T3 Can Contribute
T3 is an AI assurance consultancy for high-risk industries. We design and run adversarial testing on models and AI systems, advising Big Tech and regulated enterprises, and we contributed to the standards against which authorised testing will be measured: the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework.
We can offer the expert group: a working evaluation specification for the three harm categories and five surfaces in section 4; the operating model in section 6, with the environment specification, protocol templates and grading rubrics behind it; and evidence from live engagements, at pattern level, on where safeguards fail today. We would welcome the opportunity to present this in person.
Lana Hampicke
Managing Partner, AI Safety and Assurance
T3 | lana.hampicke@t-3.ai | 07807 007762
References
Legislation
Crime and Policing Act 2026 (c.20), sections 111 and 112
Home Office, Delegated Powers Memorandum, 12 November 2025
Government Policy
Home Office, “New law to tackle AI child abuse images at source as reports more than double”, 12 November 2025
Home Office, Crime and Policing Act 2026: child sexual abuse material factsheet, May 2026
AI Security Institute, “Our approach to tackling AI-generated child sexual abuse material”, 17 December 2025
UK AISI and Thorn, UK AISI / Thorn Recommended Practice for AI-G CSEA Prevention, December 2025
Data & Research
Internet Watch Foundation, Annual Data and Insights Report 2025
Generative AI in child sexual exploitation and abuse: views from UK law enforcement, AI & SOCIETY, 2026
