Government & Policy
If governments are going to require technology companies to make devices safer for children, there is another equally important question they must answer: who safeguards the safeguards?
Public confidence cannot simply be requested. It has to be earned.
Software capable of protecting children from harmful or sexual imagery is extraordinarily powerful technology. It can make smartphones, tablets and computers fundamentally safer. But with that capability comes responsibility.
At SafeToNet, we believe companies providing this technology, including us, should fall within the scope of government regulation, independent oversight and any future legislation relating to on-device child safety. HarmBlock should be judged against exactly the same standards we advocate for everyone else. We do not believe that our own performance claims or those of any supplier should be accepted without independent evidence.
Parents should never have to choose between protecting their children and protecting their privacy. Governments should never ask the public to trust a supplier simply because that supplier says its technology is safer.
There must be evidence. And there must be standards.
If child-safety technology is recommended, approved or mandated by government, the public should be able to assume that it has passed the highest possible standards of privacy, cybersecurity, performance and ethical development.
We believe every provider should therefore be required to satisfy a stringent, independently verified standard before its technology can be approved for deployment. That standard should include nine fundamental principles.
Child-safety software should be designed around privacy from the outset.
It should not collect or retain children’s personal data or images for this purpose. It should not create databases of what children view. The software should be designed around privacy.
Where safeguarding decisions can be made privately on the device, they should stay on the device.
Protecting a child should not require surveilling them.
No supplier should be permitted to mark its own homework.
Technology should undergo rigorous independent technical, cybersecurity, privacy and performance assessment before government approval. Certification should be time-limited: every supplier and every approved product should be independently reassessed at least every 12 months, and sooner following any material change to its architecture, AI models or safeguarding functionality.
We believe there should ultimately be a recognised independent child-safety technology certification. Parents, schools, manufacturers and governments should be able to see that mark and know that the technology has been independently tested against a demanding national standard.
Approval should not be permanent. A Cyber Safety Elite Mark should expire unless the supplier passes its periodic reassessment. Public trust depends on standards being continuously earned, not awarded once and assumed forever.
A safeguarding system is only useful if it is accurate. Accuracy must therefore be measured independently, against test criteria and minimum thresholds set by an independent body rather than by the supplier itself. No supplier should be permitted to present a single headline accuracy figure without disclosing the test dataset, operating threshold, confidence intervals, category-level results and false-positive and false-negative rates.
Testing should cover every environment in which the technology claims to protect a child: imagery being viewed on screen, content appearing in apps and browsers, livestreams, and content being captured or filmed through the device camera.
The assessment must publish meaningful measures of true positives, false positives and false negatives, including performance across different device types, operating conditions and content categories. A product should not receive or retain government approval unless it meets the independently determined thresholds in each relevant mode of operation.
Accuracy should never be a marketing claim. It should be an independently verified standard, carried out by an independent evaluator.
Child protection technology must be practical at an enormous scale. That means it must be engineered to minimise battery consumption, processor utilisation, heat generation and energy use.
Software running continuously on millions of devices cannot be treated as environmentally or technically insignificant. Government standards should therefore include measurable requirements around battery drain, thermal efficiency and computational performance.
Children do not experience online harm slowly. Images appear instantly. Cameras operate in real time. Livestreams happen now.
Safety technology therefore needs to work at the same speed. That means extremely fast inference capable of operating on live video streams and within device cameras - not simply analysing content after the event.
If harmful imagery has already been viewed, filmed or transmitted, the intervention may have come too late.
We believe the strongest model for this form of safeguarding is on-device protection. No cloud connection should be necessary to make the safeguarding decision.
The objective should be clear: prevent children from seeing, filming, storing or sharing nude, sexually explicit and other defined harmful imagery in the first place.
This distinction matters. The safest architecture is not one that watches what a child does and reports afterwards. It is one that prevents the harm while preserving the child’s privacy.
AI is only as trustworthy as the way it has been developed. Providers should therefore be required to demonstrate the provenance of their training data and prove that it was lawfully and ethically sourced.
The standards surrounding Child Sexual Abuse Material (CSAM) must be even more stringent.
Any CSAM-related reference, classification or decision data used in the development or validation of safeguarding systems should only come from a legally authorised and appropriately governed and independently accountable source.
Developers must never create, recreate or artificially generate CSAM themselves in order to train an AI system.
There can be no grey area here. Protecting children can never justify creating further abusive material.
Child-safety software cannot be treated as approved once and then changed without scrutiny. Every update to code, AI models, detection thresholds, safeguarding logic or security-critical components should follow a documented, controlled and secure release process.
That process should include strict access controls, secure code signing, formal change management, testing and peer review, traceable approvals, complete change logs, rollback capability and protections against unauthorised modification.
Before any update is released, the complete update package and the evidence supporting it should be available for full independent audit. Where an update could materially affect safeguarding behaviour, privacy, accuracy, false-positive or false-negative rates, performance, data handling or the defined scope of the technology, independent re-testing should be required before release and re-certification should be triggered where appropriate.
The process must be auditable from end to end. An independent assessor should be able to establish exactly what changed, who authorised it, what testing was performed, what risks were identified and why the update was approved for deployment. Emergency security patches may justify an expedited process, but never an unauditable one.
Trust cannot depend only on what the software did on the day it was certified. It must extend to every version that subsequently reaches a child’s device.
Perhaps one of the most important protections is also one of the simplest: child-safety software approved for a particular safeguarding purpose must not quietly become something else.
Technology authorised to detect defined categories of harmful imagery must not scan for anything else. It should not simultaneously scan for political opinions, communications, religious beliefs, personal interests or other unrelated information.
The scope should be explicit. It should be technically verifiable. And expanding that scope should require fresh scrutiny and authorisation.
This is vital if society is to maintain the distinction between safeguarding and surveillance.
There is significant public support for making children’s devices safer. But that support depends upon confidence in how the technology works.
Parents need to know that protecting their child does not mean surrendering that child’s privacy. Manufacturers need confidence that the safeguarding technology embedded within their products is secure and efficient. Governments need confidence that the companies they endorse operate to exceptional technical and ethical standards.
And children deserve to know that technology designed to protect them genuinely has their interests at its heart.
That is why SafeToNet believes suppliers such as ourselves should welcome regulation rather than resist it. We should welcome independent testing. We should welcome scrutiny of our privacy architecture, our AI, our cybersecurity, our training data, our efficiency, our speed, our update governance and, critically, our accuracy and false-positive performance.
Companies asking society to trust technology this important should be prepared to prove that trust is deserved.
Governments have an opportunity to establish a new international benchmark for child-safety technology. But legislation should not simply say that children must be protected.
It should establish how trustworthy protection is delivered, and who is qualified to deliver it.
Only suppliers that can demonstrate exceptional privacy, security, independently verified accuracy, performance, ethical development, secure update governance and technological transparency should receive government approval.
That may make the bar difficult to reach. It should.
When technology sits between a child and some of the most harmful material on the internet, there can be no place for shortcuts.
Government endorsement should represent the highest possible standard, a standard that must evolve as the threats evolve over time. Public confidence depends upon it. And ultimately, so does the success of the technology that could help make the online world safer for every child.
September 10th, 2026 • By The SafeToNet Team