I’m old enough to remember when the Office for Students (OfS) was defending its approach to free speech all the way through a judicial review.
They were busy firing out flowcharts that told providers to secure lawful speech and almost never restrict it, and treated a policy’s capacity to capture lawful speech as more or less enough to find a breach.
Then came the High Court’s judgment in University of Sussex v Office for Students in April, a hurried patch to Regulatory advice 24 (RA24) in August, a “lessons learned” report a fortnight ago promising “no surprises” for the institutions it regulates, and, on 1 September, the opening of the new free speech complaints scheme.
Now we get the next piece of the jigsaw – the two new conditions of registration that the Higher Education (Freedom of Speech) Act 2023 requires the regulator to introduce, and a consultation on the guidance that will sit underneath them.
The headline is that condition E11, which covers governing documents and management and governance arrangements, and condition E12, which covers compliance with the free speech duties themselves, will apply to all registered providers from 1 April 2027, and there’s new draft guidance on the duty to “promote” the importance of freedom of speech and academic freedom.
The process tone, to be fair, is recognisably that of the new-look regulator – lots of early engagement, repeated references to minimising burden, and a lighter-touch route for further education colleges.
But underneath the tone the old architecture lurks – it turns suggestions into indicators of breach, turns complaint outcomes into something close to regulatory findings, has some astonishing detail on teaching, and turns every breach of the duties into a likely breach of two conditions at once – which, if you recall, is roughly how Sussex ended up with a £585,000 fine.
And it carves free speech out as one of the few ways in which a complaint can link directly to regulation – although given students can’t use the complaints scheme, students themselves can’t access the link.
On and off the table
The legal basis is section 8A of the Higher Education and Research Act 2017 (HERA), inserted by section 6 of the 2023 Act, which makes both conditions mandatory – E11 as an initial and ongoing condition under section 8A(1), and E12 as an ongoing condition under section 8A(2).
The regulator has aligned the wording of both conditions with the statute, and so isn’t consulting on the wording, the duties themselves, the definition of “governing documents”, the move of RA24 into the framework, the three-step framework in RA24, or the existing content of RA24 – that’s page 6 of the consultation, if you’re collecting them.
That’s quite a long list of things that are off the table, and it leaves the consultation focused on the guidance for E11 in question 1, the changes to Regulatory notice 7 on registration applications, the guidance for E12, the additions to RA24, plus the usual general questions on clarity, burden, equality impacts, and unintended consequences.
As DK set out last week, OfS has already narrowed “governing documents” after Sussex, and the definition isn’t open for comment here. What’s new is that E11.1 requires every one of them to be “consistent with compliance” with the free speech duties, with providers expected to review the lot before April 2027. Ironically, a policy statement like the one Sussex was fined over would probably no longer count, so that kind of scrutiny now moves to E11.2 and E12.
Down to the seating plan
Section A3 of HERA requires providers to promote the importance of freedom of speech within the law and academic freedom for academic staff in the provision of higher education, and the new section 4 of RA24 is the first guidance we’ve seen on what that means.
And this is not your granddad’s talk during welcome week, and nor is it one of those interminable online modules in the induction checklist.
Paragraph 215 is clear that the duty is “proactive in character” rather than a duty to “have regard”, and that compliance is likely to result in an environment where students and staff have the confidence to express a very wide range of lawful ideas, including those some find “shocking, disturbing or offensive.”
The detail is eye-watering. Paragraph 222 suggests considering classroom layout, “seating people in small groups around tables rather than in lecture-theatre style seating”, and paragraph 223 lists steps drawn from the regulator’s own research, including “smaller class sizes, e.g. moderated seminars” – a suggestion that will land interestingly in a sector where the same regulator’s financial sustainability work is watching providers cut teaching costs.
Paragraph 223(a) suggests “staff explicitly stating that the class is a safe space to discuss various ideas”, which, given where the phrase “safe space” has sat in the free speech wars of the last decade, is quite something to find in this particular document.
Paragraph 224(b) suggests “discussion sessions/Q&A in lectures that are not recorded”, which sits uneasily with lecture capture as a reasonable adjustment for disabled students – and only a paragraph later, paragraph 225 asks providers to give “careful consideration to the freedom of speech rights of those who share protected characteristics (for instance, race and disability).”
Then paragraph 231 suggests governing bodies “adopt and to state publicly a position of institutional neutrality”, not commenting on national or global events outside the institution’s educational remit – a position that some would argue is itself a contested stance.
It’s also one that providers trying to demonstrate compliance may be tempted to push onto their SUs via the conduct provisions of the code, even though SUs aren’t subject to the promote duty and are already governed by charity law on political activity.
Adequate, effective, and counted twice
Condition E11.2 requires “adequate and effective management and governance arrangements to secure compliance”, and the guidance at Annex A, paragraph 21, on page 28, defines an arrangement as adequate if “it is capable of delivering its stated or implied objective” and effective if “it delivers compliance in practice”.
Capacity and resources are then made central – financial resources, the number and expertise of staff, contractors, and governors, and resources to undertake investigations, respond to complaints, protect students and staff at risk of harassment for their speech, and maintain governing body oversight.
There’s the obligatory nod to diversity of provision, with smaller providers likely to have simpler arrangements, but paragraph 25 on page 29 carries the important rider that resources should be “sufficiently sizeable to enable the provider to meet its duties in full” – which isn’t a phrase that will reassure a small / specialist wondering how many staff a free speech function actually needs.
The bigger issue is logical rather than practical. If an arrangement is only effective when it “delivers compliance in practice”, then any finding that a provider breached A1 in an individual case under E12 is also, more or less by definition, evidence that its arrangements weren’t effective under E11.2.
That’s the pairing that produced the Sussex outcome – a free speech breach alongside a management and governance breach under E2 – and the new conditions build it into the regulatory design for every future case.
From complaint to condition
There are other bits where you wonder whether Sussex lessons really have been learned. Paragraph 27 says that information from the complaints scheme will inform the regulator’s view of risk across all conditions, before adding a line that goes a lot further:
It is important to note that a justified or partly justified free speech complaint would be considered indicative of a breach of condition E12.
The draft E12 guidance then tries to put some distance between the two functions:
A finding that a complaint is justified or partly justified is indicative of a breach of condition E12, but that is not the same as a regulatory decision that a provider has breached, or is breaching, a condition of registration. This is because our role in reviewing complaints is separate from our role in assessing providers against our conditions of registration.
On its face that’s a reasonable thing to say – until you cross ref with what the complaints scheme rules that came into force on 1 September actually require for a complaint to be justified.
Under rules 34 and 35, a complaint is justified if it appears to the regulator that it’s “more likely than not that the respondent has breached, or is breaching, its free speech duty” and the complainant has suffered more than minor or trivial adverse consequences, and partly justified if there’s a breach but no, or only minor, adverse consequences.
Both outcomes therefore rest on a finding, on the balance of probabilities, that the A1 duty has been breached – and E12 requires nothing more than compliance with A1, A2, and A3.
“Indicative” is doing a lot of work there, because the complaints process will already have answered the core E12 question, just through a mainly paper-based review with 14-day response windows, rather than a formal investigation with the procedural protections the lessons learned report now promises.
It gets firmer still when you get to recommendations, which the scheme rules describe as things the regulator “expects” providers to comply with – paragraph 20 of Annex B says that where a provider doesn’t follow a recommendation the regulator “will engage with it as a part of our work to assess compliance” and that “this may escalate to regulatory action where appropriate and proportionate.”
In theory a recommendation remains a recommendation, but in practice a recommendation that you ignore at the risk of a condition breach is a requirement.
And there’s an odd detail in paragraph 21 on page 41, which says that relevant information includes “the content of the complaint as well as its outcome, including whether it was settled, withdrawn, justified, partly justified or not justified.”
If a settled complaint still counts as regulatory intelligence about compliance, providers have less reason to settle – which cuts against the whole point of a scheme that, under rule 37, explicitly contemplates resolution by settlement.
KPMG found the boundary between policy development and enforcement was “blurred” in the Sussex case, and the regulator has since set up a specialist enforcement team “run separately from policy development, ensuring an independent approach.”
A design in which the same regulator reviews a complaint, makes a finding of probable breach, makes a recommendation, and then treats both the finding and the response to the recommendation as evidence for a condition breach doesn’t obviously honour that separation, whatever the guidance says about the two roles being distinct.
Students still complain through the OIA, and OIA information is listed as intelligence under both conditions, at Annex A, paragraph 17(k), and Annex B, paragraph 16(k) – so the pipeline runs from both schemes.
The intelligence lists at Annex A, paragraph 17(j), and Annex B, paragraph 16(j), also include “data submitted… as part of the Prevent accountability and data return”, which means Prevent monitoring data can now feed free speech enforcement – a direction of travel that those who have spent years arguing Prevent chills lawful speech may find more than a little ironic.
Suggestions that become standards
DK covered off what a governing document is last week – but there’s more to governance than PDFs:
a non-exhaustive set of examples of steps related to governance that may, depending on the circumstances, be likely to assist providers.
It covers a senior person or body to oversee and report on free speech, an annual report to the governing body with data on cancelled events, security costs, upheld complaints, court orders, Foreign Influence Registration Scheme registrations, and ideological tests in scholarship selection, confidential reporting routes, human rights due diligence, and escalation of serious negative decisions to a suitably senior level.
Paragraph 36 on page 18 is clear that these are “illustrative only” and that “we would not expect all of these arrangements necessarily to be in place at all providers.”
The E11.1 behaviours at Annex A say that governing documents may indicate non-compliance if they “are not consistent with the governance arrangements set out at paragraphs 189-193F”, and the E11.2 behaviours at paragraph 49 on page 34 describe those same paragraphs as examples of behaviours “whose absence may indicate non-compliance”.
E12 goes further still, with Annex B confirming that the descriptions and illustrations throughout Annex D “contain non-exhaustive examples of behaviours that suggest compliance or non-compliance with E12.”
So a step that “may, depending on the circumstances” help in the guidance becomes a step whose absence “may indicate non-compliance” with a condition of registration carrying fining powers – which is a ratchet, however carefully each individual sentence is hedged.
Record keeping follow the same pattern – consultation paragraph 21 says the regulator won’t routinely ask to see a record of a provider’s arrangements but “suggest[s] it as a matter of good practice”, while E11.1 paragraph 18(d) on page 27 lists “any record of any proportionality analysis undertaken by the provider when determining whether a governing document is consistent with compliance” as something it may request.
Anyone who hasn’t written one down will find the good practice was an expectation all along.
That matters more because, as I and others argued when RA24 was patched in August, most of its 54 examples haven’t been re-run through the corrected three-step test – so vignettes that still travel directly from “this could affect lawful speech” to “likely breach” are about to be promoted into indicators of condition compliance.
The same tension runs through the promote duty material, which paragraph 217 on page 49 describes as “suggestions rather than requirements”, while consultation paragraph 43 on page 19 says the approach “sets a clear minimum standard for compliance without being too detailed or restrictive.”
Suggestions can’t be a minimum standard, and if the regulator does have a floor in mind for the promote duty, providers would presumably quite like to know where it is before April.
SUs and the code
The provisions of the 2023 Act that would have placed duties directly on SUs, and let students and SUs into the complaints scheme, were never commenced – which led some to assume SUs were out of the picture.
New paragraphs 188A and 188B, at Annex C on page 43, are a reminder that they aren’t, restating that under section A2(2) of HERA a provider’s code of practice must set out the procedures to be followed by its SU in organising meetings and activities on the provider’s premises, and the conduct required in connection with them.
Paragraph 188B then adds that the governing body must take reasonably practicable steps to secure compliance with the code “including where appropriate the initiation of disciplinary measures”, and points the reader to example 49.
That’s the one where an SU cancels a politics seminar “out of respect for the feelings of the local A community”, the provider hosts it instead, a protest allegedly led by an elected SU officer disrupts it, and the provider launches an investigation into the conduct of the SU and students – which it describes as potentially a reasonably practicable step to secure compliance with its code.
It’s not hard to see how a complaint about a society event, a room booking, or an officer’s decision can now be framed as a complaint that the provider failed to keep its SU in line, and the regulator still offers no real boundary between reasonable oversight and inappropriate institutional control of a body that is legally independent.
The RA24 glossary also defines “premises” to include property “owned, leased, used, supervised or controlled by the university, college or students’ union” – so the SU building is squarely in scope.
There is, though, something for SUs in here as well.
Paragraph 29 of the E11.2 guidance, on page 30, says a provider’s arrangements “should, where possible, avoid placing unnecessary burden on students and students’ unions”, that the code should give SUs clear guidance on procedures for events and invited speakers, and that providers “should consider carefully how complex and overly onerous forms and risk assessments may contribute to discouraging (‘chilling’) lawful speech.”
The consultation also says on page 6 that it’s “particularly (but not only) interested in hearing from students, staff, students’ union representatives and leaders at providers”, and question 8 explicitly asks about unintended consequences for “relevant students’ union[s]” – so SUs that don’t respond will have only themselves to blame when the final text lands.
Foreign influence everywhere
The new governance paragraphs also cover Foreign Influence Registration Scheme registrations by governors and senior managers at 193C(g), obligations on individuals to monitor lawful expression because of affiliation with a foreign political party or government at 193D(b), and support for those facing coercion “including through the use of strategic litigation against public participation (SLAPPs) and targeted visa denial” at 193D(c).
They also cover arrangements at 193D(e) to prevent a foreign state monitoring internal communications where governors or senior managers are based there.
Paragraph 193D(g) adds human rights due diligence before entering contracts and at review points, “translation of foreign-language versions of contracts with foreign parties”, and contractual transparency where a partner has influence on appointments or the curriculum.
For a large research-intensive university with extensive international partnerships and branch campuses, this is a substantial compliance exercise on top of the due diligence work that already exists, and for a modern university heavily dependent on international recruitment through agents and partnerships, it’s a new set of risks to put on the register at precisely the moment that market is under pressure.
HERA doesn’t require providers to secure freedom of speech “in respect of their activities outside England”, as page 3 notes, so the duties stop at the border while the guidance on partnerships, branch campuses, and foreign-based governors reaches well beyond it – and providers operating across the UK, or with transnational education, will need to work out where one ends and the other begins.
Colleges, franchising, and new entrants
The one place where burden has visibly been reduced is for further education colleges without or not seeking degree awarding powers, which had conditions E2 and E7 disapplied in July and aren’t having them reapplied through the back door.
Instead, at registration they would submit whatever governing documents they hold within the defined set, a free speech self-assessment using the ten-question template at Annex G on pages 63 to 65, and a declaration of any Department for Education interventions on financial health or controls in the preceding 60 months, set out in Annex F on pages 61 and 62.
All other applicants must submit their code of practice at registration, notify amendments within 28 working days, and flag any governing document provision that “may be inconsistent with compliance” along with any review and remediation plan – and may be asked for a self-assessment within 20 working days if their E7 documents don’t make the arrangements clear.
Oh and on franchising, paragraph 30 of the E11.2 guidance makes the registered lead provider responsible for arrangements covering all its students where the delivery partner isn’t registered, and paragraph 48 on page 34 says both parties can be found in breach where both are registered and the failure involves both.
What happens now
The consultation closes on 23 November, there are briefing events to come, and the regulator expects to publish final decisions in spring 2027 ahead of the conditions coming into force on 1 April – alongside an updated regulatory framework, which will need to be laid before Parliament with Annex D in it.
That’s a tight timetable for providers expected to have reviewed their governing documents, resourced their arrangements, and worked out what promoting free speech looks like against guidance they won’t see in final form until weeks before it applies.
The wider question is whether the “no surprises” regulator of the lessons learned report and the architecture in this consultation can coexist – because in practice, for the providers already on the register, nothing is submitted and everything runs on intelligence.
That means complaints, OIA outcomes, and third-party notifications will drive enforcement, each feeding a condition where a finding of probable breach is already baked in and a second governance breach follows close behind.
The covering letter has changed its tone, its leadership, and its three-step test since Sussex – what it hasn’t yet changed is a regulatory design in which a hedged suggestion can become an indicator of breach, and a single bad decision can become two.
