AI Regulation Tracker  /  Draft bill, submitted

Mongolia's Draft Child Safety Bill Carries an AI Labeling Duty

On July 22, 2026, members of the State Great Khural submitted a stand-alone bill on children's participation in social networks to Speaker S. Byambatsogt. Article 10.1.6 would require social network service operators to place a visible mark reading 'created using artificial intelligence' on AI-generated content, and Article 3.2 would extend the law to any person providing social network services to users resident in Mongolia. This is a submitted draft. It has not been voted on, it is not law, and it creates no duty today.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Draft bill, submitted

Key facts

Regulatory briefing

Instrument

Draft Law on Regulating Children's Participation in Social Networks (Niigmiin suljeend khuukhdiin oroltsoog zokhitsuulakh tukhai), 6 chapters, 20 articles

Authority

State Great Khural of Mongolia. Bill initiated by members of parliament; supervision assigned in the draft to the Communications Regulatory Commission

Jurisdiction

Mongolia, with Article 3.2 extending the law to persons providing social network services to users resident in the territory

Status

DRAFT. Submitted to the Speaker on July 22, 2026 and listed on the legislative portal under submitted drafts

Bindingness

None today. The bill imposes no obligations unless passed

Effective date

Not set. Article 20.1 names 2027 as the intended year and leaves month and day as ellipses

Primary source

lawforum.parliament.mn, project 11135

The AI clause, in the text

The provision that puts this bill on an AI regulation tracker is a single sub-paragraph in the article listing the rights and duties of social network service operators. Article 10.1.6 of the draft reads:

10.1.6. хиймэл оюун ашиглан бүтээсэн контентод "хиймэл оюун ашиглан бүтээсэн" гэх агуулгатай таних тэмдгийг харагдахуйц байдлаар байрлуулах;Draft Law on Regulating Children's Participation in Social Networks, Article 10.1.6, lawforum.parliament.mn project 11135, text header dated July 23, 2026

In English, and the translation is mine rather than an official one: to place, in a visible manner, an identifying mark bearing the wording 'created using artificial intelligence' on content created using artificial intelligence.

Four things about that drafting are worth pausing on, because they decide how much work the clause actually does.

First, the addressee. The duty sits in Article 10, the article of operator rights and duties, so as drafted it binds social network service operators. It is not written as a duty on every publisher, every advertiser or every person who posts. A US reader used to labeling proposals that reach the creator of the content should notice that this one reaches the service that carries it. The compliance burden is a platform-side detection and marking function, not a user attestation.

Second, the wording of the mark is prescribed. The draft does not say 'disclose that AI was used' and leave the form open. It specifies a mark bearing the phrase 'created using artificial intelligence', and it specifies that the mark be placed so as to be visible. Whether a machine-readable provenance signal alone would satisfy that is not obvious from the text. On the face of it, the clause asks for something a person can see, and it asks for a particular string of Mongolian, which is a localization problem before it is a policy problem.

Third, there is no definition of artificial intelligence anywhere in the bill's definitions article. Article 4.1 supplies eight defined terms: regulated social network, age verification, social network, social network service provider, telecom service operator, prohibited content, content harmful to children, and parental control tool. Artificial intelligence is not among them, and the labeling sub-paragraph carries no carve-out for AI use that is trivial, assistive or cosmetic. In a bill this short, that scope question would normally be settled in committee rather than on the page as submitted.

Fourth, a small textual wrinkle that a translator will hit before a lawyer does. The definitions article defines the social network service provider using one Mongolian noun, and the heading and body of Article 10 address the operator using a different one. Article 3.2, the scope clause, uses a third construction. In ordinary Mongolian these all denote the same actor, and I would not build an argument on the variance. I flag it because if you are mapping duties to defined terms in a compliance matrix, the defined term and the term used in the operative article are not literally the same word.

One more point of housekeeping. The AI mark is a general operator duty in Article 10. It is not drafted as a duty owed only in respect of child accounts, and it is not cross-referenced to the age-based measures the way Article 10.1.7 is cross-referenced to Article 6.3. That is a meaningful detail for a platform sizing the work, because a clause of that shape does not scale with the number of minors on the service.

What the rest of the bill does

Reading the AI clause on its own would misrepresent the instrument. This is a child online safety bill with an AI labeling sub-paragraph inside it, and the surrounding machinery is where most of the operational cost would land.

Article 6.2 would prohibit social networks being used by children who have not reached 13. Article 10.1.2 states the same rule as an operator duty not to register them. For children aged 13 or over but not yet 16, Article 6.3 would require a list of preventive technological protection measures: parental oversight of usage and time, default settings protecting the child's personal data, location and account privacy, limits on direct messages from unknown users, reporting and blocking tools, and the measure at Article 6.3.3, which requires restriction of the visibility, distribution and recommendation algorithms of prohibited content and content harmful to children. That is a ranking-system obligation stated in the language of ranking systems, not a takedown obligation dressed up as one, and it is the clause I would expect platform policy teams to argue about hardest.

Age assurance in the draft is not left to the platform to invent. Article 10.2 provides that age-group information transmitted by telecom service operators is used to verify a user's age, and Article 11.1 puts the matching duties on those operators: issue network numbers to under-16s only against the child's and the guardian's names and civil registration numbers, build the technical and organizational conditions to exchange the necessary information in a form that does not identify the person, and cooperate with the social network operator. Whatever one thinks of that design, it presumes a level of carrier cooperation that a foreign platform cannot supply on its own.

The content timelines are specific, and they are the numbers most likely to be misquoted. Article 10.1.4 would require deletion of prohibited content posted, distributed or promoted on the network within 8 working hours. Article 10.1.5 would require technological measures restricting access to content harmful to children within 72 hours, and that one is expressly triggered by notice from a competent authority. The 8-hour rule as drafted is not conditioned on a notice at all. Read together, they are two different clocks with two different triggers, and a platform that builds one queue for both has misread the article.

The rest of the operator package is familiar in shape: appointment of a resident representative, a representative organization or an official liaison unit, registered with the Communications Regulatory Commission under Article 10.1.8; a direct channel to the competent authorities for urgent child-safety complaints under Article 10.1.9; and an annual report to the Commission under Article 10.1.10 covering Mongolian user numbers, complaint resolution and the technology used in child protection work.

Article 7 builds the escalation path. The Commission would organize a risk assessment on the basis of complaints and information received from persons and legal entities, scored against criteria including user reach, system design, the character of the content distributed, the ability to contact strangers directly, virality, and complaint handling. A network assessed as high risk becomes a regulated social network, is notified by the Commission, and then has 90 days to meet the Article 6 protection requirements and report back. The procedure for assessing risk would be approved not by the Commission but by the central state administrative body for digital development and communications, which is a ministry-level function. Article 7.7 provides that a service which repeatedly fails to implement the protection measures faces staged measures up to and including blocking access to it from Mongolia, and Article 11.1.5 gives telecom operators the duty to take the necessary technical measures on the Commission's notice. That is how the block would actually be executed.

Sanctions are handled by cross-reference. Article 19.1 sends violations by persons and legal entities to the Criminal Code or the Law on Infringements, and Article 19.2 sends non-criminal conduct by officials to the Law on Public Service or the Labour Law. No monetary figure appears anywhere in this bill, so anyone quoting a fine amount for it is quoting something else. If you want to know the exposure, you have to price the referenced statutes, not this one.

Article 3.2 is the clause that makes it your problem

Most national child safety bills are read by foreign platform teams and then filed under 'local market, local subsidiary'. This one contains a scope provision that does not permit that:

3.2. Монгол Улсын нутаг дэвсгэрт оршин суугаа хэрэглэгчид нийгмийн сүлжээний үйлчилгээ үзүүлж буй этгээд нь энэхүү хуулийг нэгэн адил дагаж мөрдөнө.Draft Law on Regulating Children's Participation in Social Networks, Article 3.2, lawforum.parliament.mn project 11135

A person providing social network services to users resident in the territory of Mongolia shall equally comply with this law. That is a plain destination-based test. It does not ask about establishment, incorporation, servers or revenue. It asks where the users live. Article 3.3 reinforces the point from the other direction: a child residing permanently or temporarily in Mongolia is covered regardless of whether the child is a Mongolian citizen.

Combine 3.2 with the resident representative requirement and the annual report to the Commission and the design intent is clear enough. The drafters expect the large foreign services to be inside the perimeter, and they have built the paperwork that lets a regulator address them directly. Whether Mongolia could make that stick against a service with no local presence is a separate question, and it is the same question every jurisdiction with an extraterritorial platform rule faces. Drafting reach and enforcing reach are different things.

Article 7.7 is the honest answer to that question, and it is worth reading as the drafters' own assessment of their leverage. The ultimate sanction contemplated against a non-compliant service is not a fine collected abroad. It is staged measures ending in the blocking of access from Mongolia, carried out through the licensed carriers that Article 11 already regulates. That is a remedy a small jurisdiction can actually execute, and it tells you what the negotiation would look like.

For a US compliance function the practical reading is this. If your product carries user-generated content and has any Mongolian user base, the labeling duty in 10.1.6 is not something your Mongolian entity would own, because you probably do not have one. It would attach to the service. That is a different internal owner and a different budget line than a local licensing rule would be.

Draft means draft, and I want to be exact about it

This item is on the tracker as a signal, not as an obligation. The bill was submitted to Speaker S. Byambatsogt on July 22, 2026 and appears on the parliament's legislative portal under submitted drafts. It has not been voted on. It is not law. Nothing in it binds anyone today.

Article 20.1 makes the point better than I can. The commencement clause as submitted provides that the law shall be observed from a day of a month of 2027, with the month and the day left as ellipses. That is standard Mongolian drafting practice for a bill whose passage date is unknown, and it is also an honest signal: even the sponsors do not yet know when this would start. Do not put a Mongolian commencement date in your compliance calendar, because there is not one to put.

Two dates appear in the record and both are correct. Parliament announced the submission on July 22, 2026. The bill text carried on the legislative portal has a header dated July 23, 2026, in the position where a Mongolian statute carries its adoption date. That is a submission date and a document date, not a contradiction, and it is the kind of small discrepancy that gets misreported as an error.

Attribution is worth getting right too, because two different lists of names circulate. The parliament announcement says the bill was presented to the Speaker by members P. Naranbayar, Ch. Anar, L. Gantumur and P. Ganzorig. The same announcement then describes the drafting group as nine members, adding J. Galbadrakh, B. Javkhlan, S. Lundeg, Ch. Nomin and O. Nominchimeg, and the legislative portal lists all nine as initiators of the draft. Four presenters and nine initiators is not a conflict; it is a delegation naming a subset to walk the file in.

On the consultation history, be careful about what stage this is. The parliament announcement records that this bill and others drafted alongside it were posted on the d.parliament.mn portal to collect public opinion, and that 660 citizens had reviewed them as of June 30, 2026. That window ran before submission. The project page on lawforum carries a per-provision comment and reaction function that is still open to signed-in users, and it showed no comments when I checked it. What the record does not show is a formal post-submission comment period with a closing date, so I am not going to describe one. The next procedural step for a submitted member bill is parliamentary consideration, and the record I have does not tell me when that is scheduled.

One more nuance on provenance, because it changes how you predict the bill's path. Formally this is a member bill, initiated under the members' right of legislative initiative rather than introduced by government. But the parliament announcement states that the initiators carried out staged research and discussions in cooperation with the Ministry of Digital Development, Innovation and Communications, and Eagle News published remarks by P. Naranbayar, in his capacity as Minister of Education, describing the stand-alone bill as being drafted across four ministries and headed for the d.parliament.mn portal for comment. That report carries no date in the version I reviewed, so I use it as background rather than as a fact anchor. The point is that this is not the usual lone-member bill that dies in committee, and I would not price its chances that way.

Finally, what this is not. It is not an AI act, it is not comprehensive AI legislation, and it should not be filed as Mongolia's answer to the EU AI Act. No comprehensive Mongolian AI statute was identified in preparing this entry, but I am not going to convert that into a claim that none exists. An absence I have not verified against a primary source is not a finding.

What to do Monday

If you are a platform lawyer, a compliance officer or an executive with product exposure, the work here is small, and doing it now is cheap insurance against doing it in a hurry later.

First, answer the scope question. Do you provide a social network service to users resident in Mongolia? Not 'do you have a Mongolian entity', which is the question people reflexively answer instead. If your product carries user-generated content and is reachable in Mongolia, assume for planning purposes that Article 3.2 would reach you and confirm with local counsel rather than assuming the reverse. Note the definition in Article 4.1.3, which is broad: an application, website or equivalent service that lets users register, publish, distribute, comment on, share and form groups around content. Plenty of products that do not call themselves social networks sit inside that wording.

Second, look at your AI-labeling capability as a capability rather than as a per-jurisdiction project. You now have labeling duties or draft labeling duties accumulating across several markets, with different prescribed wording, different placement requirements and different triggers. A per-market bolt-on is how you end up with an unlabeled asset in the one market where it mattered. If the answer to 'can we render a visible provenance mark, in a prescribed string, in a specified locale' is not already yes, this bill is another argument for making it yes.

Third, if you already run age assurance work, note the telecom-operator data model in Articles 10.2 and 11.1. It is a design a platform cannot implement unilaterally. It turns into a local partnership requirement and a data-sharing agreement rather than a code change, and the lead time on that kind of arrangement is measured in quarters, not sprints.

Fourth, if you have any Mongolian user base worth naming, put the two content clocks and the 90-day Article 7.6 remediation window in front of whoever owns trust and safety operations. Not to build anything now, but so that the eventual question is 'can we hit 8 working hours' rather than 'what does the bill say'. An 8-working-hour deletion standard and a 72-hour access-restriction standard are staffing questions in whatever time zone your review queue runs in.

Fifth, and most important, do not act as if this were binding. There is no duty, no commencement date and no penalty figure. What there is, is a submitted member bill whose text may be materially different by the time it reaches a vote. If you have a view on the workability of a prescribed-string visible label, or on the algorithmic restriction duty in 6.3.3, the time to have that view drafted and in the hands of local counsel is before committee, not after.

The broader lesson I would take from this one is about where to look. This is the second entry in recent weeks where an AI labeling obligation appeared inside an instrument whose title says nothing about AI; Jordan put one inside a digital media licensing bylaw. Media bylaws, child safety bills, election codes and consumer statutes are all fast vehicles, and a legislature that wants a labeling duty in force does not have to build a horizontal AI framework to get one. A tracker keyed to the phrase 'artificial intelligence' in a bill title will miss them, and they are the ones that bind your product first.

Last verified: August 3, 2026 against the primary sources listed above.