The other day I made a “rip it up and start again” case for how to handle the Higher Education Freedom of Speech Act 2023 (HEFoSA) in light of the judgment in The University of Sussex v The Office for Students (OfS).
Let’s imagine that doesn’t happen. That will leave us with Regulatory Advice 24 – which purports to set out in broad terms how providers might ensure they meet the new duties.
It was guidance that OfS didn’t originally even want to issue – until a U-turn, the idea was that complaints casework would send signals instead. But it’s there now. And there may be problems.
The core of the guidance is a set of 54 vignettes that inevitably create expectations – for providers about how to comply, and for OfS about how it will assess whether they have.
After Sussex, several of those examples seem to model the wrong reasoning, moving too quickly from “this policy could restrict lawful speech” to “this is likely a breach”, without showing the whole-framework, proportionality-based analysis the court says is required.
I am no lawyer. But I do want to understand where it may no longer be safe for universities or their SUs to follow the illustrations without question. I have tried to be careful about what Sussex actually decided rather than what various parties would like it to have decided. And where I am uncertain I have tried to say so.
Three steps
RA24 structures its compliance framework as three sequential steps. First – is the speech within the law? Second – are there reasonably practicable steps to secure it? Third – if not, is any restriction proportionate under Article 10 of the European Convention on Human Rights?
OfS was right about one thing at step one. A university can’t write internal rules and then say “this speech breaches our policy, therefore it is no longer free speech within the law.” Within the law means law in the proper sense – statute, common law, court decisions – not whatever a provider puts in a handbook.
But OfS then made its own mirror-image error, treating “freedom of speech within the law” as if it meant – all speech that is not directly unlawful must be secured, and any policy that may touch it is presumptively suspect. The court’s answer – no.
That phrase sits inside a statutory duty to take reasonably practicable steps – and that can’t be separated from Article 10 proportionality. OfS told universities they could not use their own rules to shrink the statutory phrase. The court told OfS it could not use its regulatory theory to expand it into an absolutist duty.
That is why steps two and three “largely if not wholly elide” – asking whether there are reasonably practicable steps to protect speech, and asking whether any restriction is proportionate, are effectively the same question from two directions. A provider rule can’t decide whether speech is “within the law.” But a provider rule can still be part of a lawful, proportionate restriction on speech that remains “within the law.” OfS blurred the second point. Sussex restores it.
Some are arguing that under the new HEFoSA regime, since OfS is no longer confined to looking at “governing documents,” it will be easier to investigate a single equality policy or a one-off event in isolation. That is partly true – individual decisions and events are now within OfS jurisdiction. But the absolutist point from Sussex is independent of the architecture. Even looking at a single measure under the new regime, OfS still can’t treat its potential to capture lawful speech as sufficient to establish breach. The proportionality analysis is still required.
The examples
1. The investigation is the punishment (Example 40)
Example 40 is about a professor who gives a clearly lawful political speech at a protest. Students complain. The university runs a lengthy investigation, finds no case to answer, but OfS says the university should have closed it at the outset. The example concludes that the investigation itself “punished” the professor for lawful expression and that the university is “likely” in breach of its secure duty.
That framing feels too broad after Sussex. The court drew a sharp line between two different things – the statutory academic freedom standard (placing an academic “in jeopardy of losing their job or privileges”) and a chilling effect (from the existence of a complaint or investigation). Stress, reputational damage, and anxiety arising from a prolonged investigation are real harms. They can be relevant to whether the provider breached its freedom of speech duties by chilling lawful expression. But they don’t, on their own, seem to establish a breach of the specific academic freedom limb, which requires the process to carry a real risk of job loss or loss of privileges.
The Scottish case of Keogh v Abertay University is interesting on this. Lisa Keogh, a final-year law student, sued Abertay after a two-month investigation into complaints about her gender-critical comments in a seminar. The complaint wasn’t upheld. She argued the investigation itself was a detriment. Sheriff Murray dismissed the case, finding that the university’s code “obliged” it to investigate, and that the circumstances – multiple complainants, three final-year students approaching exams – placed the university in exactly the kind of “tricky territory” that entitled it to investigate. The fact of an investigation couldn’t, on its own, amount to discriminatory detriment.
That’s a Scottish discrimination case rather than a HEFoSA secure-duty case, but you see the point. RA24’s Example 40 assumes that institutions can readily identify at the outset which complaints have no merit. In practice, an investigation may be the means by which the institution discovers the complaint has no merit – and may be obliged by its own disciplinary code to undertake it. RA24 would be more useful if it distinguished between investigations that should never have been opened and investigations that legitimately needed to happen but should have been concluded faster.
Similar issues pop up in Example 22, on a professor disciplined for publicly criticising his employer’s employment practices – that example would be stronger if it acknowledged that a preliminary triage to check whether a post disclosed confidential information might be permissible, while making clear that an investigation conducted because the criticism was reputationally inconvenient is not.
2. Micro reporting, major gaps (Example 39)
Example 39 involves an anonymous reporting portal through which students are encouraged to flag “microaggressions” using free-text boxes that can name individuals. RA24 says this may discourage lawful discussion and recommends removing the identifying fields, narrowing the category of reportable speech, and making clear that anonymous reports lead to no further action.
Vagueness, foreseeability, and the chilling effect of nominally anonymous but actually identifying reports are genuine problems. But the example seems to assess the portal in isolation. After Sussex, the compliance risk created by the portal depends heavily on the surrounding framework – does the harassment policy define reportable conduct using objective legal standards? Does the free speech code make clear that lawful speech will not trigger action? Do disciplinary rules require proper triage before any investigation begins?
RA24 itself notes that institutions may legitimately collect anonymised statistical data, so the portal is not necessarily unlawful – the question is whether it creates a route into disciplinary or external consequences without adequate objective safeguards.
3. He said, she said, the guidance said too much (Example 35)
Example 35 addresses a student handbook rule stating that “misgendering is never acceptable” and that students must always address others using their preferred pronouns. RA24 says this blanket ban “is likely to breach the ‘secure’ duty.” It contrasts lawful academic usage of “he” for a trans woman in a dissertation with repeated, deliberate misgendering of a specific student by their teacher, which may amount to harassment.
The core distinction seems fine – a blanket rule risks suppressing lawful gender-critical and sex-based speech. But Sussex makes the analysis more demanding. The university’s revised policies in that case contained anti-harassment wording, a safeguarding statement, and cross-references to academic freedom protections.
The court found OfS had erred in treating the policy as in breach without working through whether those safeguards were sufficient to ensure the three-part analysis had been done. Under the new regime, a pronoun rule that expressly carves out lawful academic expression, research, and quotation within the same policy document is materially different from a freestanding ban, and a finding of breach against the former would face the same proportionality challenge the OfS failed in Sussex.
4. Uphold everything except lawful disagreement (Example 34)
Example 34 says an employment contract requiring staff to “uphold the college’s commitment to social justice” may suppress lawful scepticism about some conceptions of social justice. RA24 says removing the clause is “likely to be a reasonably practicable step.”
After Sussex, this feels too blunt. A phrase that looks restrictive in isolation might sit alongside academic freedom provisions, hierarchy clauses, or free speech statements within the same contract. If the same contract that contains the social justice clause also expressly preserves lawful disagreement, academic freedom, and political expression, the compliance risk is significantly reduced. Cross-document protections – in a separate free speech code or a related equality policy – remain relevant to the overall proportionality assessment.
5. One person’s offensive is another’s seminar (Example 36)
Example 36 says an IT policy prohibiting transmission of “offensive material” using university systems may restrict lawful academic debate. RA24 says it would be better amended to refer instead to unlawful material – citing the Malicious Communications Act, the Communications Act, and the Online Safety Act.
“Offensive” seems too vague to serve as a disciplinary standard under Article 10(2), which requires restrictions to be formulated with enough precision to be foreseeable. But the example may imply that the only compliant IT policy is one limited to unlawful material, which seems to go too far the other way.
A policy might legitimately restrict some lawful expression in some contexts – mass unsolicited messages, targeted abuse conducted through institutional systems, or material that disrupts essential functions – where the restriction is precise, viewpoint-neutral, linked to a legitimate operational aim, and proportionate.
6. Cancelled: the proportionality test (Example 3)
Example 3 describes a professor with gender-critical beliefs who is required to cancel a seminar and conference following protests about transphobia, and is told not to speak to her department about her research or the cancellation. RA24 says the university “may have directly discriminated against” her and is “likely to have breached its ‘secure’ duty.”
That conclusion may well be right. But after Sussex, the analysis needs to show its working. The court confirmed that lawful speech can sometimes be restricted where it is not reasonably practicable to avoid restriction and where the restriction is proportionate. The example fails to explore what risks the institution actually identified, what alternatives it considered, or whether the restriction was genuinely because of the protected belief rather than some independently lawful operational concern.
7. Diversity of thought not required (Example 32)
Example 32 says requiring all academic promotion candidates to submit a 500-word statement of commitment to equality, diversity and inclusion may restrict lawful viewpoints – for instance deterring or penalising a lecturer sceptical of some aspects of EDI. RA24 says removing the requirement is “likely to be a reasonably practicable step.”
The genuinely risky element is compelled ideological endorsement. But a promotion process might legitimately ask for evidence of lawful professional practice – inclusive teaching, accessible supervision, compliance with equality law, or contribution to widening participation. Sussex ought to push OfS to avoid treating “EDI” as inherently viewpoint-prescriptive – that conflation seems itself a form of the absolutism the court rejected.
8. Trigger warning: this example needs work (Example 50)
Example 50 says a college likely breaches the secure duty by requiring a speaker to omit extreme and polarising examples from an academic seminar on political violence, and suggests welfare support as an alternative. It then warns that a standing requirement to use content notes may create chilling effects by encouraging intrusive investigation of seminar content.
The basic thrust seems sound. But the case study rhetoric is more sceptical of content notes than RA24’s own caveat, which acknowledges that specific content notes may be helpful to enable students to access material where there is evidence that they are helpful. After Sussex, the caveat needs to do more work.
The question is always whether a restriction was proportionate in context, and there may be settings where a specific content note or sequencing decision is a proportionate access measure rather than a speech restriction.
9. The flattest line in 65 pages (the Holocaust denial sentence)
RA24 states, without elaboration: “The OfS will not protect Holocaust denial.” It is the only categorical carve-out of its kind in the guidance, and it appears without legal analysis.
After Sussex, unexplained categorical positions feel legally exposed. The real problem with this sentence is that it short-circuits RA24’s own method without identifying which legal route it is taking. Is Holocaust denial excluded at step one because it is unlawful speech – for instance where it amounts to antisemitic harassment, racial hatred, or incitement to discrimination? Is it excluded because it amounts to an abuse of Convention rights under Article 17 ECHR, applicable where speech aims to destroy the rights of others? Or is it lawfully restrictable at steps two and three under Article 10(2)? Those are different analyses, and RA24 does not say which applies, or when.
10. Due regard, not due prohibition (Example 37)
Example 37 criticises institutional guidance stating, without qualification, that the university has “a duty to prevent extremism” or “a duty to foster good relations” – on the basis that these misstatements may encourage staff to restrict lawful speech. RA24 says such guidance “may discourage” lawful expression and would be better corrected.
After Sussex it feels like it underexplains the lesson. The Prevent duty is a duty to have “due regard” to the need to prevent radicalisation, not a duty to achieve the result. Sussex extends the point – the court found that OfS itself had translated qualified requirements into something closer to an absolute prohibition.
The guidance would be more useful if it said that any institutional guidance on duties that interact with free speech – Prevent, PSED, harassment, safeguarding, fitness to practise – would benefit from stating the actual legal standard, the balancing exercise it requires, and the role of Article 10.
11. The guidance mostly teaches when not to restrict
Almost all of RA24’s examples are written from one direction – they identify situations where providers have restricted speech when they should not have. But condition E6, the harassment and sexual misconduct condition that came into full force on 1 August 2025, creates obligations that point the other way.
There are situations where failing to restrict is itself the breach – and where the free speech duty and the harassment duty are not in tension at all, because the students whose speech is being chilled by harassment are owed protection under both.
OfS has acknowledged the tension in practice. In letters to universities about campus protests – including in the context of anti-Israel demonstrations and concerns about Jewish students’ experiences – it has been explicit that institutions may be expected to move protests away from locations where they intimidate students in their accommodation, interfere with lectures, or create an atmosphere hostile to the exercise of lawful religious expression. These are not just permissions to restrict. In some circumstances they amount to regulatory expectations, backed by the E6 condition.
RA24 has precious few case studies that model from that direction. The guidance would benefit from more. The objectivity test for harassment – whether a reasonable person would think the conduct created an intimidating environment because of a protected characteristic – would benefit from being stated clearly, alongside the point that subjective distress alone is not sufficient.
12. In glowing terms (Example 51 and a missing example)
Example 51 says a university requirement that all teaching materials on British history must represent Britain in a positive light suppresses viewpoint and should be removed. That seems right, and it maps well onto the Sussex facts – the university’s 2018 policy required relevant materials to “positively represent trans people and trans lives,” and the university itself accepted that those words should not have been included.
But presumably the British history example was chosen precisely because it avoids protected-characteristic complications. The guidance would be clearer if it explained that the problem is viewpoint prescription – the obligation to endorse a positive view of a subject – not the entirely legitimate aim of fair, accurate, or inclusive curriculum design.
Example 52, on an accreditation body requiring endorsement of a particular principle, is in the same territory and would be stronger if it distinguished between mandatory professional competence standards and ideological endorsement requirements. Example 30, on a lecturer who teaches an incoherent alternative theory of calculus, usefully models what the essential teaching function protection actually looks like, and that lesson is worth signposting in the other examples too.
13. Just a heads up (Examples 53 and 54)
Examples 53 and 54 distinguish two types of race-awareness training. Example 53 – induction that requires students to affirm “all white people are complicit in structural racism” before they can matriculate – is treated as a likely breach because it compels assent to a contested viewpoint. Example 54 – induction that teaches the same proposition and marks a wrong answer wrong, but doesn’t require active affirmation – is treated as fine.
The distinction is useful as far as it goes. But it leaves a gap that’s particularly relevant after Sussex, because a whole-framework approach should be able to recognise more than two states.
Take a softer hypothetical – an induction module that says “playing with someone’s braided hair without permission may cause real offence, and many students would find it intrusive.” That isn’t compelled assent. Students aren’t required to affirm the view, aren’t marked wrong if they disagree, and won’t face disciplinary action for not internalising it. It’s just awareness-raising – information about how some students might experience particular conduct, in circumstances where the conduct itself may not be unlawful but may upset other students.
RA24 is silent on whether material like that is fine. After Sussex it almost certainly is – none of the indicators of viewpoint compulsion are present, no disciplinary mechanism is engaged, and the material doesn’t restrict speech at all. But a provider reading Examples 53 and 54 in isolation might reasonably worry that any awareness content about specific groups falls into the same suspicious category as the matriculation-bar version.
That’s the broader point. RA24’s binary framing – compelled affirmation bad, right-wrong question fine – has no space for the actually quite common middle ground in which universities and SUs help students understand how their behaviour might land with others, without either compelling agreement or attaching consequences. Sussex makes that middle ground easier to defend, not harder.
The same logic applies to broader campus messaging on good relations, sensitivity, and the social texture of how students treat each other – none of which RA24 currently engages with as a positive model.
And there’s a broader irony
I’m sure there are other examples. But poring through them again, it strikes me there is an irony.
The guidance is supposed to be about securing free speech. But it is itself not especially neutral about those it regulates. Almost all of its 54 case studies model institutions getting the balance wrong in one direction – over-restriction, silencing, chilling. Very few model institutions navigating competing obligations sensibly.
None model a provider failing students by not acting at all. The implicit working assumption throughout seems to be that providers have a persistent thirst for suppressing speech – which is itself a form of presumption that the guidance’s own three-step framework is designed to guard against.
Universities reading RA24 find a document that often seems to assume they are always the problem, rather than one that helps them balance competing legal obligations in good faith. That framing makes it harder, not easier, to get things right.
And it sits awkwardly with the Regulators’ Code, which says that guidance should help those regulated to understand and meet their responsibilities, distinguish legal requirements from suggested good practice, and says regulators should seek to create an environment in which those they regulate have confidence in the advice they receive, and provide advice that can be relied on.
After Sussex, RA24 needs a rewrite.
