On September 17, 2026, the European Commission proposed the EU KIDS Act (COM(2026) 681 final), a Regulation that would pull AI companions and general conversational chatbots into child-safety rules for the first time and enforce them through the same structures as the Digital Services Act and the EU AI Act. It would also set common rules for social media, video-sharing platforms, online games, app stores and operating systems.
Currently, the EU KIDS Act is only a proposal and has not yet been passed as a law. Feedback runs until December 3, 2026. Adoption could take a year or longer.
The Act is only as strong as its age assurance. Child-protection duties apply by default unless the provider can establish that the user is an adult. Within six months of the rules applying, platforms must check existing accounts and disable those belonging to under-15s or users whose age cannot be established. Self-declaration is not enough. Certified EU verification is mandatory only for social networking and video-sharing services that carry certain risk features. AI companion and chatbot providers may use other methods. Those methods have not yet been proven at scale.
What the EU KIDS Act Actually Requires
The proposal does two things at once: it sets common age rules for the whole EU via an age staircase, and it requires safety-by-design to be built into the services children use most. The age rules apply to social networking and video-sharing services that carry certain risk features.
The Commission states that it “prohibits social media accounts under 13 and provides for parent-supervised accounts at 13 and 14, as well as for independent accounts from 15.” Within six months of the rules applying, platforms must check existing account holders and disable accounts for under-15s or users whose age cannot be established.
Beyond age, services must implement safety-by-design features. The Commission lists techniques it would ban or restrict for minors:
- Endless autoplay and infinite scroll without breaks
- Notifications that entice children back
- Streak mechanics
- Rewards for posting to mass audiences
- Addictive design features
- Unsolicited stranger contact
- Spending traps
Safe settings and transparency of purchasing would be required by default. Tracking and personalisation would be off by default. These duties would apply across social media, video services, games, chatbots and app stores.
AI Companions and Chatbots Face Specific Rules
An AI companion is a system that offers sustained, personalised interactions simulating a social, emotional or interpersonal relationship. A general conversational chatbot is a general-purpose system that can assist across several domains (ChatGPT, Claude, Grok and similar). Specialised task-limited systems, such as certain customer-service bots, fall outside the definition.
Under the proposal, providers of AI companions and general conversational chatbots would have to:
- Avoid design and behavioural features that simulate personal human relationships in ways likely to create emotional dependency
- Switch off, by default, the use of a minor’s earlier conversations in later ones, except where needed for safety
- Conduct pre-market testing for risks to children and post-market monitoring (the latter not required for micro and small enterprises)
- Allow under-13s to use the systems only through guardian tools
- Ensure that if the chatbot is embedded in social media or a game it does not switch on automatically, is not pushed at minors, and is easy to turn off
The Commission explains that AI companions and chatbots “may not use designs that simulate human relationships in ways likely to create emotional dependency.” By default they “may not carry a child’s earlier conversations into later ones.” They must be tested before launch and monitored afterwards.
The memory rule is extremely important. It aims to limit attachment and the accumulation of sensitive information across sessions while still allowing safety-relevant context to be retained.
Who the EU KIDS Act Covers
The Act reaches several categories of provider, but the obligations differ. Only social networking and video-sharing services face the age staircase and the certified verification mandate; the others face design duties.
The rules would apply to providers inside and outside the EU if they offer the service to users in the Union or place the system on the EU market. The Commission would supervise the most widely used platforms and AI systems. An expedited procedure targets preliminary findings within 30 days and a final decision within 90 days for Commission-supervised cases. Providers with 45 million or more monthly EU users would need to present a detailed compliance plan reviewed by independent auditors.
This sits alongside existing DSA enforcement that MRKT 3.0 has tracked, including fines on X, Temu and AliExpress, and the designation of ChatGPT under the DSA. It also extends the EU AI Act logic that the Digital Omnibus only partially delayed.
National Rules Already Differ Across the EU
One stated aim of the Regulation is to prevent Member States from racing ahead with divergent national rules and fragmenting the single market.
Several have already moved:
- France’s parliament adopted an under-15 social-media ban in July 2026, but the Constitutional Council struck the core provision down in August 2026 as disproportionate to freedom of expression. It did not enter into force.
- Greece has planned an under-15 digital restriction from January 1 2027 and has called for a European age-verification mechanism.
- Denmark has agreed restrictions for under-15s, with parental consent possible from 13.
- Spain, Germany and Austria have indicated they intend to legislate their own minimum ages. Spain has also opened a consultation on the Commission proposal itself.
The Commission’s position is that one Regulation enforced at EU level gives every child the same protections and replaces up to 27 national regimes with a single rulebook. Once it applies, national rules that add obligations for the largest platforms would be difficult to sustain. The 15-year threshold would be set in Brussels rather than in national capitals.
The Age Verification Gap That Limits Enforcement
The Act turns on age assurance and rules out self-declaration. Social networking and video-sharing services would be required to use certified EU solutions. The Commission is building the infrastructure itself: a free, open-source app that tells a platform only that a user is above the age threshold, without revealing identity. There is no single central database of ages. Each Member State must provide at least one free way to prove age, including for people without a digital ID. A European Digital Identity Wallet is expected to follow.
The Commission states that the law requires “‘zero knowledge proof’ technology that cannot identify, locate, track or profile anyone.” Platforms do not check identity documents and do not learn who the user is.
Chatbots and AI companion services may use other methods, provided they meet the general principles. Their accuracy at large scale has not yet been demonstrated. The EU app is still in its roll-out phase. The proposal gives providers six months from entry into force for the main checks. The first real test will be how the system handles mass verification of existing accounts.
Privacy Concerns Around Age Checks
The Commission argues that platforms will receive only a certificate that a user is over the age threshold, not a date of birth or identity document, and that the transaction is designed not to be linkable. Critics disagree.
- The Electronic Frontier Foundation has argued that age-verification mandates undermine free expression and put privacy, anonymity and security at risk for all users.
- European Digital Rights (EDRi) has said the Act risks making the internet less safe by shifting the burden onto individuals and expanding age verification while structural harms remain.
- CCIA Europe has noted that if platforms must distinguish minors from adults, adults must also prove their age when they sign up.
For AI providers the proposed act has other issues. Certified zero-knowledge verification is the privacy-preserving route the Commission prefers, yet it is mandated only for social and video services. Chatbot and companion providers can choose their own methods and are bound only by the general principles of privacy, data protection and non-intrusiveness. The privacy outcome therefore depends on what each provider builds or buys.
How AI Is Already Shaping Children
Chatbot use among young people is already widespread, and the evidence on companions is growing but still mostly observational.
- Internet Matters reports that 64% of UK 9- to 17-year-olds use AI chatbots.
- The UK Government Office for Science has noted that around half of children report using AI, and some use AI companions for well-being and emotional regulation.
- Concerns centre on identity exploration, problematic attachment, social substitution and emotional dependence. Systems can also return inaccurate or inappropriate responses.
- Thirteen- to 17-year-olds appear to be the age group most likely to form anthropomorphic attachment. This is the band the Act’s staircase targets for independent accounts.
The House of Lords Library briefing on screen use, artificial intelligence and social media recorded reports of guilt, disappointment, addictiveness, and impacts on mental and physical health, as well as exposure to grooming, abuse and harassment.
What the Rules Mean for the Market
The AI Act’s logic is being extended to consumer products. The proposal complements the existing prohibition on exploiting age-related vulnerabilities by adding design requirements specific to minors. Pre-market testing and post-market monitoring require companies to examine how systems behave over time and to address harmful content or interactions.
Fines of up to 6% of worldwide annual turnover would apply to AI companions and chatbots; other in-scope services under the DSA face the same ceiling. The Commission notes that “fines can reach 6% of total worldwide annual turnover.” Providers under Commission supervision would also pay a supervisory fee of up to 0.03% of worldwide annual net income as a cost-recovery charge. Minors and guardians would gain a right to complain and to mandate organisations to act for them.
Compliance burden varies by provider type:
- For general users, protection applies unless adulthood is established, so memory and personalisation for unverified users become product decisions.
- Companion apps built on persistent memory and relational engagement face the largest redesign.
- Micro and small enterprises are not generally exempt, though post-market monitoring is relaxed. Fines of up to 6% still apply and may deter some startups.
- Non-EU providers are caught if they serve EU users.
Author: Alice Hitchens
