This time last year the Office for Students (OfS) had just published Regulatory Advice 24 – its long-awaited guidance on the free speech duties.
It came alongside an analysis of consultation responses that batted away almost every legal objection the sector had raised.
Providers were handed a flowchart with a simple instruction. If there were reasonably practicable steps that would secure lawful speech, the answer was – take those steps. “Do not restrict the speech.”
Then came 29 April 2026, when the High Court handed down judgment in University of Sussex v Office for Students – a decision in which the regulator lost on six principal issues, including the small matter of how the entire legal framework in its flagship guidance was supposed to work.
And now, with an “updated” date stamp, two extra pages and a press release that pairs the changes with the rules for the new free speech complaints scheme and describes them as “minor updates”, OfS has amended RA24.
The headline is that the regulator has substantially rewritten the central legal architecture of the guidance – adopting positions that consultation respondents argued for, that OfS expressly rejected in June 2025, and that I and others have been banging on about on the site since before the Sussex judgment appeared.
But before you crack open anything fizzy, the amendment is a patch, not a rewrite – most of the guidance’s 54 examples are untouched, the judgment’s findings on remediation and predetermination go unanswered, and there’s a residual inconsistency in the body text that suggests the redraft was done… at pace.
Deleted scenes
Think back to the original three-step framework.
Step 1 asks whether speech is “within the law” for the purposes of the Higher Education (Freedom of Speech) Act‘s amendments to HERA (the 2017 Act under which OfS regulates providers).
Step 2 asks whether there are reasonably practicable steps the provider can take to secure it.
Step 3 – reached, on the original drafting, only if the answer at step 2 was no – asks whether any restriction complies with Article 10 of the European Convention on Human Rights.
“Within the law” just means the speech isn’t itself unlawful – not harassment, not incitement, not defamation.
Under Article 10 public bodies can (and in some cases, should) interfere with speech provided the interference has a legal basis, pursues a legitimate aim (protecting the rights of others, say) and goes no further than necessary. That last requirement is what lawyers call proportionality, and it’s what allows regulating the time, place or manner of speech without banning the viewpoint itself.
The problem, as the High Court found, was that OfS treated success at step 2 as the end of the analysis – if the speech could be secured, it had to be permitted, full stop.
A policy’s capacity to capture lawful speech was treated as more or less sufficient to establish a likely breach, without a proportionality analysis ever being properly run.
The judge held that the reasonable practicability and proportionality analyses “largely or wholly elide” – the same facts do the work in both.
The updated flowchart and summary now say, at step 2: “If yes, take those steps. Secure the speech. If you are interfering with the speech in any way, go to step 3.”
Step 3 is reframed from “restrictions” to “interferences”, and the summary adds that “facts that are relevant at step 3 may also be relevant at step 2”. Paragraph 18(b), which previously said Article 10 proportionality only became necessary “where it is not possible to take reasonably practicable steps to secure freedom of speech within the law”, has had those limiting words deleted.
This matters more than it might look. The original framework presented “secure the speech” and “restrict the speech” as mutually exclusive outcomes – a binary that never matched what universities actually do, which is permit events but move them, and protect viewpoints while regulating conduct aimed at identifiable people.
The updated framework accepts that a provider can meaningfully secure speech while imposing a condition on it, provided that condition is then justified as prescribed by law and proportionate. That is, to be honest, how Article 10 has always worked everywhere else.
Abuse of process
The second substantive change is a new subsection – paragraphs 16A and 16B – on Article 17 of the Convention, which prevents Article 10 being invoked to destroy the rights of others.
It’s the Convention’s abuse clause – you can’t claim the protection of free expression in order to destroy other people’s rights, with Holocaust denial the textbook example.
Speech that meets Article 17’s threshold is excluded from Article 10(1) altogether, and the updated guidance now says explicitly that the three-step framework does not apply to it – no Article 10 protection, no statutory duty, no obligation on the university to secure or host it at all.
This is a good example of OfS adopting a position it had previously expressly declined – respondents asked for exactly this reading in consultation, and the June 2025 response flatly said no.
Fourteen months and one lost judicial review later, Article 17 sits at the front of the framework as a preliminary gateway.
There is some doctrinal face-saving in how it’s done. OfS does not concede that Article 17 speech falls outside domestic legality at step 1 – it treats it as outside Article 10(1) and outside the Act, which allows the regulator to keep its definition of “within the law” intact while delivering the practical result respondents wanted.
And the guidance is at pains to stress that the threshold is exceptional and extreme – this is not a general-purpose category for shocking or discriminatory expression, most of which stays inside Article 10 and requires a proportionality analysis rather than categorical exclusion.
Curiously, the original guidance’s flat statement about Holocaust denial is still not expressly wired up to the new Article 17 route – a loose end for another dispute.
Everybody hurts
The third structural change is new paragraph 64A, which states that a provider which is a public authority would act unlawfully if it acted incompatibly with a Convention right under section 6 of the Human Rights Act 1998 – Article 8, the right to respect for private and family life, being the headline example.
In short – section 6 makes it unlawful for a public body to act incompatibly with anyone’s Convention rights, so if the only way to let the speech go ahead would involve the university itself violating someone else’s, it isn’t in breach of the secure duty (the shorthand for the obligation to take those reasonably practicable steps) for stepping in.
To be fair to OfS, the consultation response had already accepted the underlying principle – paragraph 67 acknowledged that Article 8 might require some workplace bullying to be prohibited. What it rejected was the suggestion that the framework was deficient for not saying so operationally.
Paragraph 64A is a tacit concession that the respondents were right – a principle acknowledged in a consultation response but absent from the operative test is not much use to the person drafting a dignity at work policy.
Article 8 is not a general right not to be offended – the distinction is between ordinary exposure to controversial ideas (protected, tough luck) and targeted conduct affecting dignity, privacy or equal participation in a sufficiently serious and fact-specific way.
Does OfS ever say where a provider positively should interfere? Not quite – where permitting conduct would itself be unlawful, interference stops being optional in practice, but the guidance never squarely models a case where the failure to intervene is the failing.
The duty to protect those on the receiving end of targeted speech remains an inference rather than an instruction.
Worked examples
Four examples do the heavy lifting in illustrating the changes.
New example 24A concerns a medical student on clinical placement, where a professional, statutory and regulatory body requires conduct that maintains patient confidence. The university stops the student sharing political views with patients and their families, while leaving them free to campaign, debate and advocate outside the workplace.
The speech is secured (step 2) because it is protected everywhere except the patient interaction, and the placement restriction is potentially proportionate (step 3) because it serves an important objective, is rationally connected to professional conduct, and goes no wider than the clinical setting.
Critically, the example also marks the boundary – ban the same student from joining a political society and you have probably failed both steps. For providers with heavy professional provision, and those delivering nursing or allied health, it’s the most operationally useful addition in the document.
Example 35, on misgendering, retains its conclusion that a blanket rule requiring preferred pronouns is likely to breach the secure duty – no movement there. But the analysis of targeted conduct has been substantially extended.
Where the original said repeated and deliberate misgendering of a student by a teacher “might amount to harassment” under the Equality Act, the update says permitting it may disproportionately interfere with the student’s Article 8 rights, may not be reasonably practicable to permit, and may be restricted without breaching the duty – an independent route to restriction that no longer depends on first proving Equality Act harassment.
Providers still need to draft narrowly, and still cannot prohibit the expression of a lawful viewpoint as such – but the days of being told that only the Equality Act threshold could justify intervening in targeted conduct are over.
Example 40, on investigations, contains a small deletion with large consequences – the sentence stating that “the investigation itself punished Professor A for lawful expression of a viewpoint”, deliberately added in the consultation response, is gone.
The likely-breach conclusion survives, but the defect is now inadequate triage of an obviously unmeritorious complaint and prolonging the process solely because complainants would be further offended. An investigation is not inherently punitive – the regulatory risk sits in poor triage, avoidable delay and process used as an informal sanction, not in the existence of a process at all.
Example 47, on a conference clashing with a religious celebration, demonstrates the whole new approach. The original claimed that offering an alternative venue meant the university “had not restricted a viewpoint” – a position of some legal creativity, given that moving and delaying an event is self-evidently a regulation of its time and place.
The update drops the pretence – the relocation is an interference, justified through balancing the conference participants’ Article 10 rights against the Articles 8, 9, 10 and 11 rights (privacy, religion, expression and assembly respectively) of staff and students of the faith concerned, with the alternative venue and limited delay doing double duty as evidence that speech was secured and that the least intrusive means was chosen.
The outcome is identical – the reasoning is transformed.
And for SUs, whose event decisions generate a healthy share of the sector’s speech controversies, example 47 is now the model – acknowledge the interference and justify it, rather than pretending a relocation is no restriction at all. (Example 38, on onerous permission regimes for campaigning, also picks up a least-intrusive-means analysis it previously lacked.)
Route one
Respondents to the consultation raised Article 17, competing Convention rights, the rigidity of the step 2 and step 3 relationship, and the investigation-as-punishment problem – OfS rejected or minimised the lot in June 2025 and defended the resulting framework in litigation. The High Court found the underlying analysis unlawful in April 2026, and in August 2026 the regulator has adopted the practical substance of what respondents asked for, while preserving, where it can, the doctrinal labels it originally chose.
That is a climbdown – a retreat from the route OfS insisted was legally mandatory, if not from its destination. What the regulator has not conceded is just as instructive.
An institution still can’t make speech cease to be “within the law” merely by putting a restriction in a contract or code – such a rule is itself an interference requiring legal authority, precision and proportionality. The strong presumption in favour of lawful viewpoints survives, as does the irrelevance of reputational concerns, the hostility to ideological tests, the likely unlawfulness of blanket pronoun mandates, and the expectation that hopeless complaints are dismissed promptly.
Anyone reading the update as a general licence to regulate lawful speech will be disappointed when enforcement arrives.
And the redraft has its own quality control issue. Updated paragraph 124 still opens with “If indeed there are no reasonably practicable steps to secure speech” – the old sequencing, sitting unrevised beneath a summary and flowchart that now say the opposite. The document contains both the corrected test and a trace of the uncorrected one.
Unfinished business
Sussex won on six principal points. OfS interpreted “governing documents” too broadly under the former condition E1 (registration conditions being the rules providers must meet to stay registered with OfS); it treated a policy’s capacity to capture lawful speech as sufficient for breach without properly applying proportionality; it misapplied the statutory definition of academic freedom; it failed to give proper effect to the university’s free speech code and the wider document suite; it failed to consider whether alleged breaches had been remedied by the time of its decision; and the final decision was vitiated by predetermination – the polite legal term for having made your mind up in advance.
The August amendments comprehensively address the second, partially address the third, and bypass the first – RA24 now operates principally through the free speech duty written directly into the legislation (Part A1 of HERA), which applies to a provider’s measures and decisions without needing them to be “governing documents”, so the jurisdictional error is unlikely to recur even though it is never acknowledged or corrected.
On academic freedom, the guidance now accurately states the statutory employment-consequence test and softens example 40, but still doesn’t warn in terms that stress, anxiety, reputational worry or a generalised chilling effect cannot be substituted for jeopardy to jobs and privileges – the substitution the court found OfS had made.
Illustrative purposes only
Which brings us to the structural weakness of the whole exercise. RA24’s framework has been corrected, but the 54 examples through which most readers actually absorb the guidance have mostly not been re-run through the corrected test.
Example 34 (the “social justice” employment clause) still ignores hierarchy provisions and linked safeguards; example 39 (the anonymous microaggression reporting portal) is still assessed in isolation from the surrounding disciplinary framework; examples 3, 32, 36, 50, 51, 52, 53 and 54 are untouched, several still travelling directly from “this could affect lawful speech” to “likely breach” without showing the objective, the alternatives or the balance the revised framework now demands.
The result is a document whose framework is more nuanced than its illustrations – reducing the reliability of the vignettes as stand-alone compliance signals, and leaving providers to work out which conclusions would survive contact with the new test.
That is not a comfortable position on a duty that carries fining powers, and it is why the amendment is best understood as a hasty patch rather than the comprehensive rewrite the judgment invited.
Minor chords
You would not, mind you, learn much of this from the accompanying press release, which announces “minor updates to the regulatory guidance in response to the judgment” – the minor updates in question being the amendment of “the three-step framework to help universities and colleges assess whether restrictions on lawful speech are justified”, plus a “small number” of practical examples amended and one added.
That’s technically accurate, but as an account of a document conceding the core legal analysis the regulator defended all the way to a lost judicial review, “minor” is doing a lot of work.
Arif Ahmed, OfS’s director for freedom of speech and academic freedom, says the regulator has “been carefully reflecting on our approach to protecting freedom of speech in higher education” since Sussex, and is making explicit “some additional points on the scope of the duty and the interaction with the European Convention on Human Rights”.
Ahmed also notes that meetings with “many vice chancellors and other senior staff” have helped resolve “a number of potentially complex free speech issues without the need for further regulatory action”. Never too late, eh.
Complaints department
The amendments arrive packaged with the final rules for the new complaints scheme, which opens on 1 September 2026 – the free-to-use route by which staff (including academics and applicants to academic posts), visiting speakers and others including emeritus professors will be able to complain directly to OfS that their free speech rights have been infringed, while students continue to route complaints through the OIA.
It’s a much narrower scheme than the one consulted on back in December 2023 – students and SUs were in the original proposal as complainants and respondents respectively, but those parts of the Act were never commenced, and OfS has decided the narrowing didn’t warrant a fresh consultation.
SUs shouldn’t relax entirely, mind. A provider’s code of practice has to address the conduct required of its students’ union, and the provider must take reasonably practicable steps to secure the SU’s compliance – so a complaint about a society event, an officer decision or a room booking can be reframed as a complaint that the provider failed to keep its union in line.
The final documents accept that an SU’s legal independence is relevant to what’s reasonably practicable, but offer no boundary between reasonable oversight and inappropriate institutional control – which providers managing their new exposure may be tempted to test.
Against the December 2023 proposals, the final rules make real concessions. The period for engaging with internal processes rises from 30 to 90 days (63 per cent of those commenting thought 30 unreasonable), and provider participation becomes the normal procedure – the respondent sees the complaint, comments, sees the complainant’s reply, and makes representations before final decisions on merits, recommendations and publication, where the original said only that OfS “may” seek views.
Gateway refusals and dismissals – decisions that a complaint can’t be considered at all, or should be thrown out – now attract reconsideration by a different case handler, each complaint in a group must be determined separately rather than via a suspended “lead” case, the odd non-statutory category of “suggestions” has gone, and a settled complaint won’t generate a published outcome.
Judge, jury and invoice
What survives is more alarming. This is not an OIA-style review of whether the provider reached a reasonable decision through a fair process – OfS may determine the statutory free speech question afresh, examining disciplinary, harassment, equality, fitness-to-practise, curriculum and research questions where necessary to decide it, and (unlike the OIA) it isn’t barred from academic judgment, on which it can commission expert advice.
Outcomes come in three flavours – justified, partly justified and not justified – and “partly justified” doesn’t mean some allegations succeeded and others failed. It means OfS found a breach but only minor or trivial consequences for the complainant – and it still carries recommendations, publication, naming and cost recovery.
Recommendations are legally soft but institutionally hard. They can include compensation and they aren’t binding orders – but non-compliance can feed regulatory action, and despite objections OfS has kept cost recovery, so a respondent can be charged the regulator’s costs of deciding the complaint against it.
OfS also rejected calls for a merits appeal. A provider can appeal the costs decision to the First-tier Tribunal, but neither party can appeal the finding itself – judicial review is the only external route, and that tests whether OfS acted lawfully rather than whether it got the answer right.
And on publication, OfS has rejected the consultation’s clearest steer. Some 46 per cent of relevant respondents wanted outcomes anonymised and 33 per cent said not justified complaints shouldn’t be published at all – but the regulator will normally name the provider whatever the outcome, arguing that publishing a not justified case can clear an institution’s name and show would-be complainants what won’t succeed.
It rejected an independent panel for merits decisions too – so the same regulator receives the complaint, gathers the evidence, decides the merits, recommends redress, charges its costs, names the institution and can feed the result into enforcement once the new free speech registration conditions arrive in April 2027, with no firewall between complaints and regulation anywhere in the rules.
Which is where the unfinished business in RA24 stops being an academic quibble. Complaints under the scheme will be argued, on both sides, through this guidance – and a document whose framework now says one thing while dozens of its examples still model another is an invitation to precisely the sort of dispute the scheme is supposed to resolve quickly.
Read it again
As I argued when the original guidance appeared, and again after the judgment, the fundamental problem was always a framework that deferred proportionality and other people’s rights until it was too late for either to do any work – leaving providers overprotecting a speaker while the dignity and participation of those on the receiving end waited at the back of the queue.
The court agreed, in substance, and OfS has now conceded the point in its own guidance.
But a regulator that needed a High Court defeat to accept arguments its own consultees had already made – and that has so far corrected its advice to the sector rather than the decision-making culture the court found wanting – should expect the next enforcement case, whenever it comes, to be read very closely indeed.
