The European Commission has proposed an EU KIDS Act, COM(2026) 681 final, that would require providers of AI companions and general conversational chatbots to test their systems for child-safety risks before market and to avoid designs likely to create emotional dependency in minors, with enforcement routed through the AI Act; nothing in it applies until Parliament and Council adopt it

A proposal, and what a proposal is not

The cover page fixes the facts. Brussels, 17.9.2026, COM(2026) 681 final, procedure 2026/0286 (COD), a proposal for a Regulation of the European Parliament and of the Council titled EU KIDS Act. The Commission has adopted its text, which is addressed to the European Parliament and the Council under procedure 2026/0286 (COD), the ordinary legislative procedure. We did not check either institution's file for any procedural step taken since, so we make no statement about what they have or have not done.

That posture governs every sentence that follows. Where this article says a provider would have to do something, it means: if the Parliament and the Council adopt the Regulation in this form, and once it applies. Article 43 sets entry into force on the twentieth day after publication in the Official Journal, then gives the application dates as bracketed formulas: the Regulation as a whole from [same day as entry into force plus 6 months], Article 5 from [same day as entry into force], and Articles 33 and 35 from [same day as entry into force plus 12 months]. The brackets are in the source. We report them as they stand and do not convert them into calendar dates.

The Commission's own summary of the legislative history, in the explanatory memorandum, records that the President's special panel recommended in July 2026 covering services beyond social media, including app stores, AI companions and some video games. The memorandum also lists countries that notified draft legislation limiting minors' access to certain digital services in 2025 and 2026: Italy, France, Norway, Greece, Austria, Poland and Belgium. Norway is in that list and is not an EU Member State. The proposal is the Commission's answer to that fragmentation, on an Article 114 TFEU internal-market basis.

Which AI systems Article 2 would reach, and which it would not

Article 2(1) lists seven categories of service or system accessible to minors: online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions, and general conversational chatbots. For the two AI categories, Article 2(3) would apply the Regulation to providers placing such systems on the market or putting them into service in the Union, irrespective of where the provider is established or located.

The definitions do the narrowing. Article 3(5)(c) defines an AI companion as an AI system, including a general-purpose AI system, that provides sustained, personalised interaction or companionship which simulates or facilitates a social, emotional or interpersonal relationship with a user. Article 3(5)(d) defines a general conversational chatbot as a general-purpose AI system with general conversational functionalities for direct interaction with users, capable of providing assistance across multiple domains and tasks, and then excludes systems whose conversational functionality is limited to a specialised service, task or pre-defined set of functions. The exclusion names specialised customer-service, business operation, technical-support, transactional, educational, information-retrieval, industrial and manufacturing AI applications. A support bot on a retailer's site is outside the definition as drafted.

Article 2(4) then carves out not-for-profit online encyclopaedias, not-for-profit educational and scientific repositories, primarily educational services operated by or for educational establishments, open-source software-developing and sharing platforms unless the platform itself constitutes an AI system in scope of this Regulation or of the AI Act, services and systems specifically developed and operated for the sole purpose of scientific research and development, and services and systems designed, developed and operated by public authorities, or on their behalf, for the exclusive use of those public authorities. Article 2(5) would let the Commission amend that list by delegated act.

One structural rule matters for platforms. Article 8(3) provides that where a social networking or video-sharing provider deploys an AI companion or general conversational chatbot as a functionality of its service, only Sections III, V and VI of Chapter III apply to that AI system. Section III is Article 14. Article 2(6) adds that providers of those services and of video gaming platforms that comply with this Regulation would be deemed to comply with Article 28(1) of the DSA for matters it covers, including AI systems deployed as a functionality of the platform.

Article 14: six measures for AI companion and chatbot providers, with two exceptions

Article 14(1) opens with a general duty. Providers of AI companions and of general conversational chatbots would have to put in place proportionate and effective measures to ensure a high level of protection of the health, safety, fundamental rights and the well-being and development of minors that may access their AI system. The paragraph then lists what those measures would have to include at least, in points (a) to (f). This is proposed text; none of it binds anyone today.

Point (a), as proposed, is the emotional-dependency rule: ensuring that minors are not exposed to addictive designs, by avoiding design features and system behaviours that simulate interpersonal relations that are likely to create emotional dependencies, and by applying the addictive-design prohibition in Article 9(1) and the time-limit and interruption measures in Article 9(3) to such systems. The trigger is a likelihood of creating emotional dependency. The proposed text does not prohibit every simulated relationship, and we do not read it that way.

Point (b) imports the Article 11 safe-settings measures and adds a memory default: by default, the system would not use information or analysis derived from a minor's prior interactions in subsequent interactions, "except where necessary to protect the minor's safety, to give effect to the settings referred to in Article 11". The exception is in the text. A summary that says chatbots could never carry context forward for a minor overstates it.

Point (c) imports the Article 13 economic-transaction safeguards. Point (d) provides that access for minors below the age of 13 is only enabled and controlled by means of the tools for guardians in Article 20. As drafted, point (d) refers to "services and systems referred to in paragraph 1", which is the paragraph it sits in; we report that wording as it stands.

Point (e) is the pre-market rule. Providers would have to perform state-of-the-art evaluations and testing of the system for risks to the health, safety, fundamental rights and the physical, mental and emotional well-being and development of minors that are likely to arise when minors interact with the system, and implement appropriate safeguards to address those risks, prior to the system's placement on the market or putting into service. The obligation is on the provider to test and safeguard. Point (e) names no regulator, no filing, no certifier and no clearance decision. The proposed article does not establish an approval procedure, and we do not claim one.

Point (f) is post-market monitoring to identify, assess and where appropriate mitigate harms and emerging risks, including through detecting and responding to serious incidents involving minors, "unless the system is provided by a micro or small enterprise within the meaning of Recommendation 2003/361/EC". Two things to note. The exemption is express. And point (f) refers to the risks "referred to in point (d) of this paragraph", although the risk-testing limb is point (e). We report the cross-reference as drafted and do not correct it.

Article 14(2) is a different rule for a different party. Where an AI companion or general conversational chatbot is deployed as a functionality of a social networking service, a video-sharing platform service or an online game, the provider of that service would have to ensure that the AI system is not activated automatically and is not displayed prominently on the online interface, that minors are not encouraged to use it, and that, where enabled, minors can opt out easily and at any time. That is where an "off by default" reading comes from. It attaches to embedded chatbots inside those three service types. It does not attach to a standalone companion app or a standalone general chatbot.

Article 14(3) would offer a route to demonstrate compliance: providers that adhere to a code of conduct assessed as adequate by the Commission under Article 23 could rely on that code. Article 23 frames those codes as voluntary and drawn up with providers, national authorities, civil society, academia, parents and educators.

Article 10 would constrain recommender systems for minors, not ban profiling feeds

Article 10 applies to social networking and video-sharing providers that use recommender systems, not to chatbot providers, though platforms that embed a chatbot will read both. Paragraph 1 would require the information suggested and the optimisation of the recommender to be designed to ensure a high level of privacy, safety and security of minors. Paragraph 2 would require that the optimisation does not exploit a minor's vulnerability or attention and that it includes evaluation metrics capturing quality, safety and mental health outcomes for minors.

The four minimum measures in paragraph 2 are specific, and as proposed they would require providers to: give priority and primary weight to explicit user-stated preferences when suggesting information; disable by default the recommendation of information based on implicit engagement-based signals from minors' behaviour online; not rely on the collection of any personal data of minors captured from outside the service; and not expose minors to suggested information that may pose a risk to their privacy, safety and security, including if encountered repeatedly.

Paragraph 3 would then require prominently displayed tools that let minors modify or control the recommender's parameters, including by easily deleting all previously identified preferences, and choose at least one option not based on profiling as defined in Article 4(4) of the GDPR. The existence of that non-profiling option, offered at account creation and kept directly accessible, is what tells you the proposal does not prohibit profiling-based recommendation for minors outright. It makes engagement-signal recommendation off by default and guarantees an alternative. Separately, Article 6(1) lists a profiling-based recommender as one of the conditions that would bring a service into the under-15 account restriction, which is a different mechanism aimed at a different age band.

Enforcement would run through the DSA and the AI Act, with a qualified 6 percent ceiling

Article 34 splits supervision by service type. For social networking, video-sharing, video gaming platforms and app stores, Chapter IV of the DSA would apply, with references to intermediary-service providers read to include providers covered by this Regulation. For AI companions and general conversational chatbots, Article 34(2) applies Chapter IX of the AI Act, and references there to compliance with the AI Act would be read to include Chapters II, III and IV of this Regulation.

The fine ceiling sits in the same paragraph and is qualified three ways. Non-compliance by an AI companion or chatbot provider would be subject to administrative fines under Article 99 of the AI Act "not exceeding 6 % of the total worldwide annual turnover of the undertaking" in the preceding financial year, "where that provider has been found to have acted intentionally or negligently". So: AI providers, up to 6 percent, preceding financial year, intent or negligence found. Article 34(6) sends data-protection infringements of Articles 27 to 29 to GDPR supervisory authorities under Article 83 of the GDPR instead. Article 34(5) leaves video games that are not platforms to a Member State authority with national penalties. There is no uniform 6 percent fine across the proposal.

Article 35 is the expedited procedure. A calendar-day reading of 30 and 90 days overstates it on three counts. It applies where the Commission opens proceedings against a designated very large online platform or against an AI provider under the Commission's exclusive supervision. The Commission "shall endeavour to" communicate preliminary findings within [30] working days and adopt a final decision within 90 working days of opening proceedings. The first number is bracketed in the source, both are working days, and both are effort targets rather than limitation periods. Article 43 would defer Article 35 to [entry into force plus 12 months].

Article 5 is where the compliance-plan-and-audit mechanism lives, and it is scoped to social networking and video-sharing providers designated as very large online platforms under Article 33 of the DSA. Those providers would have to notify a compliance plan to the Commission, commission an independent audit at their own expense by auditors with expertise in listed fields including child psychiatry, age assurance and recommender design, publish a non-confidential summary of the final report, and fix shortcomings the Commission identifies by decision. Article 5(8) states that neither the audit report nor Commission action or inaction on it constitutes a finding of compliance. The proposal does not apply this mechanism to standalone chatbot providers, and it does not say in terms that the burden of proof is reversed. Article 5(11) also refers to implementing acts under the procedure in Article 39, while the committee procedure is Article 40 and Article 39 governs delegated acts; most other delegated-act provisions, including Articles 2(5), 6(6), 7, 20 and 25, cite Article 40, while Article 30(3) cites Article 39 and Article 30(2) sends implementing acts to Article 40(2). We report those cross-references as they appear.

What we did not verify

What we opened: the full proposal as published, COM(2026) 681 final, 99 PDF pages, retrieved as the first download from the Commission's library page and read from a text extraction of that PDF: the cover, the explanatory memorandum, and Articles 1, 2, 3, 4, 5, 6, 8, 9, 10, 14, 20 (opening), 23 (opening), 34, 35, 39 and 40 (headings), 41, 42 and 43 in full. We checked the SHA-256 of that PDF against a copy the desk's gate reviewer downloaded separately from the official document link; the hashes match.

What we did not open: the accompanying staff working document SWD(2026) 681 final, the separate Communication on the library page, the press release IP/26/1890 and the Commission FAQ (both were read by the sweep, not by us, and we quote neither), the recitals beyond those on AI companions, Articles 7, 11 to 13, 15 to 19, 21, 22 and 24 to 33 in full, the DSA and AI Act provisions the proposal cross-references, Recommendation 2003/361/EC, and any Parliament or Council document on this file.

What we refuse to claim: we do not say the KIDS Act is law or that any provider owes a duty under it today. We do not say all chatbots would be off by default, because Article 14(2) reaches embedded functionalities in three service types. We do not say profiling-based feeds for minors would be banned, because Article 10(3)(b) requires a non-profiling option alongside the default. We do not say providers would need regulator approval before launch, because Article 14(1)(e) requires testing and safeguards and names no clearance procedure. We do not say every provider would have to monitor post-market, because Article 14(1)(f) exempts micro and small enterprises. We do not say the memory default has no exception, because point (b) contains one. We do not say every simulated relationship would be prohibited, because point (a) turns on likelihood of emotional dependency. We do not say all VLOPs face a reversed burden of proof or that an audit approves compliance, because Article 5 covers designated social networking and video-sharing VLOPs and Article 5(8) denies that effect. We do not say proceedings would have to close in 90 calendar days or that all breaches carry 6 percent, because Article 35 uses endeavour targets in working days and Article 34(2) qualifies the ceiling. We give no adoption forecast, no final Regulation number and no calendar commencement date, because none exists. Where the word must or shall appears, it is quoting or closely reporting the proposed text. The quotation we display is Article 14(1), point (a), in full, including its terminal semicolon; the proposal is in English and no translation was needed.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Italy's Garante fines Character.AI over minors and age verification
• Ofcom applies the UK Online Safety Act to AI chatbots
• Commission designates ChatGPT as a very large online search engine under the DSA
• Europe AI regulation tracker
• AI Regulation News hub