Thursday's announcement by Ofcom marks an escalation in a dispute simmering since May. The UK authority has formalized an investigation into whether TikTok is failing to protect children from harmful content under the Online Safety Act. Two aspects are central: whether TikTok has adequate systems to determine if a user is a child, and whether its automatic filters effectively block or limit exposure to harmful material.

It's not new for regulators to eye social giants with suspicion, but this case carries distinct weight. The Online Safety Act imposes stringent duty-of-care obligations and threatens hefty fines for non-compliance. The TikTok probe is one of the first concrete tests: it doesn't merely check for the existence of corporate policies but dives into the technical systems—software, machine-learning algorithms, age-estimation mechanisms—that are supposed to translate those policies into daily action.

The sore point: moderating with AI, but under control

Content moderation at planetary scale is unthinkable without heavy use of artificial intelligence. Text and visual classification models, often based on transformer architectures similar to LLMs, scan enormous streams of posts, videos, and comments to flag violations. TikTok, like other platforms, trains detection systems meant to recognize hate speech, sexually explicit content, or material inciting self-harm. The challenge is twofold: on one hand, model accuracy—false positives and negatives are common; on the other, age verification. Knowing a user's age is crucial to apply differentiated thresholds, but traditional methods (self-declaration, document photo) are weak. Age-assurance techniques based on behavioral analysis or biometric estimation raise further privacy problems.

That's where the Ofcom investigation could dig deeper, asking TikTok to explain how these models are built and evaluated. It's not enough to say 'we use AI': you have to demonstrate that the system was trained on representative data, that performance metrics are monitored, that feedback loops exist to correct errors—a level of technical transparency few platforms offer voluntarily today.

Beyond TikTok: data sovereignty and pressure on infrastructure

For those observing the sector from the infrastructure and deployment side, there's a thread connecting this investigation to broader trends. The regulatory tightening on child protection fits into a context where data sovereignty and control over processing are becoming non-negotiable requirements. If an authority like Ofcom starts demanding deep audits of moderation systems, companies may have to rethink where and how these models run.

TikTok's moderation is likely performed on distributed cloud, with data bouncing between data centers in different jurisdictions. But a strict interpretation of child-protection duties could push toward architectures that keep sensitive data—such as age information or flagged content—within national territory, or at least under more direct platform control. That's where an interesting scenario opens for on-premise or hybrid deployment: having a self-hosted infrastructure for classification models would allow inference to run without moving user data outside a controlled perimeter, easing compliance and audits. It's not science fiction: already today some organizations handling specially protected data choose to keep moderation LLMs on their own servers, cutting out third parties.

Of course, for a giant like TikTok, adopting on-premise solutions would come with significant costs and complexity. But the Ofcom investigation signals a direction: toward greater technical scrutiny, favoring those who can prove full control of their processing chain. It's no longer just about stating a policy, but being able to verify it at system level. And if regulatory pressure keeps rising, even cloud giants may have to offer options with residency guarantees and auditability on par with an on-premise environment.

Ultimately, the TikTok case isn't just a headache for one social network. It's a testing ground for a new era where the AI used to protect vulnerable subjects must itself be put under the microscope. And that shifts technology choice criteria, tipping the balance toward solutions that combine performance and transparency.