2026-09-17 - EU KIDS Act: a minimum age of 15 for social media and tailored rules for AI companions and chatbots
On 15 July, commenting on the delivery of the Special Panel on child safety online’s report, we wrote that European regulation was heading towards access limits, design requirements and a burden of demonstration placed on providers, and that the file should be followed until the proposals were published (
From social consensus to regulation: Europe accelerates on children’s online safety
). The proposal has now arrived.
On 17 September 2026 the European Commission adopted the proposal for a regulation called the EU KIDS Act, short for EU Keeping Internet Digital Spaces Accountable and Trustworthy. The institutional communication foregrounded its most visible feature, a minimum age of 15 to open a social media account. A reading of the provisions shows a broader picture that, on some points, differs from the explanatory materials: the age threshold depends on the risk posed by the service, safety by design extends to AI systems and app stores, and supervision of AI companions and chatbots runs through the AI Act.
This article examines the text of the proposal, not only the press release, and flags the discrepancies between the two where they exist.
What the Commission adopted on 17 September 2026
From the Special Panel’s report to the proposal
The document is the proposal for a regulation of the European Parliament and of the Council COM(2026) 681 final, procedure 2026/0286(COD). It is accompanied by communication COM(2026) 680 final, entitled An EU approach to online child safety, and by staff working document SWD(2026) 681 final analysing the impacts, all available on the
.
links the proposal to the report of the co-chairs of the
Special Panel on child safety online
, Dr Maria Melchior and Prof. Jörg M. Fegert. The panel, made up of more than sixty experts, first met in March 2026 and delivered its report in July 2026. The same press release refers to the Special Eurobarometer on the Digital Decade 2026, according to which 92% of Europeans consider stronger online protection of children and young people a top priority.
The explanatory memorandum sets out a broader political context: the Jutland Declaration of October 2025, signed by 25 Member States; the European Council conclusions of October 2025 and March 2026, which also referred to a digital age of majority; and the European Parliament’s report of November 2025, which called for a harmonised limit of 16, unless parents authorise otherwise, and an absolute threshold of 13. The memorandum also takes note of the national draft laws notified in 2025 and 2026, including Italy’s, and identifies the risk of fragmenting the internal market as the reason for acting. The legal basis is Article 114 TFEU, the same as for the Digital Services Act and the AI Act.
Nature of the act and timeline
Everything that follows is de lege ferenda. This is a proposal submitted to the European Parliament and the Council, which will examine it under the ordinary legislative procedure; the text may change, even substantially. No new legal obligation arises today. As a matter of lex lata, Article 28 of Regulation (EU) 2022/2065 (DSA) and the related Commission guidelines, the GDPR and the AI Act remain the applicable framework.
The timeline in Article 43 of the proposal has several layers:
- the regulation would enter into force on the twentieth day following its publication in the Official Journal;
- it would apply six months after entry into force;
- Article 5, on the compliance plan of very large online platforms, would apply from entry into force;
- Articles 33 and 35, on national strategies and on the expedited procedure, would apply twelve months after entry into force.
The legislative financial statement annexed to the proposal, however, describes a different, more staggered timeline: six months after the start of application for checks on existing accounts and design obligations, and twelve months after the start of application for supervised accounts, the rules on AI companions and chatbots, and the expedited procedure. The two do not match and will need to be aligned during the negotiations; for the purposes of this analysis, Article 43 is the reference.
Scope and definitions
Services and systems covered, services excluded
Article 2(1) identifies seven categories of providers of services or systems accessible to minors: online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots.
Territorial scope follows two criteria. For digital services, the regulation applies irrespective of the provider’s place of establishment where the service is offered to recipients located in the Union (paragraph 2). For AI systems, it applies to providers placing them on the market or putting them into service in the Union, wherever they are established (paragraph 3), echoing the logic of the AI Act.
Paragraph 4 excludes not-for-profit online encyclopaedias, not-for-profit educational and scientific repositories, services designed primarily for educational purposes and operated by or on behalf of educational establishments, open-source software development and sharing platforms (unless the platform is itself a relevant AI system), services developed solely for scientific research, and services operated by public authorities for their exclusive use. The Commission could amend the list by delegated acts (paragraph 5). The Commission’s overview page also lists digital news among the exempted services, which does not appear in the list in Article 2(4).
Two linking clauses deserve attention. For social networks, video-sharing platforms and video gaming platforms subject to Article 28(1) DSA, compliance with the new regulation would count as compliance with that article for the matters covered (paragraph 6). The regulation would, on the other hand, be without prejudice to, among others, the Audiovisual Media Services Directive, consumer and product safety law, the GDPR and Directive 2002/58/EC (paragraph 7).
AI companions and general conversational chatbots
Article 3 refers to the DSA for the notions of online platform and recommender system, to the Digital Markets Act for online social networking services, video-sharing platform services, software application stores and operating systems, and to the AI Act for AI system, general-purpose AI system and provider. A minor is a natural person under the age of 18.
There are two new definitions, and both matter to anyone working on AI:
- AI companion: an AI system, including a general-purpose one, providing sustained, personalised interaction or companionship that simulates or facilitates a social, emotional or interpersonal relationship with a user;
- general conversational chatbot: a general-purpose AI system with general conversational functionalities for direct interaction with users, capable of providing assistance across multiple domains and tasks. Systems whose conversational functionality is limited to a specialised service, task or predefined set of functions are excluded, including customer-service, business-operation, technical-support, transactional, educational, information-retrieval, industrial and manufacturing applications.
The distinguishing criterion is therefore the breadth of the conversational function, not its nature. We will return to this point below.
Age thresholds: a staircase that depends on risk
From 15: autonomous accounts, but only where the service is risky
The press release presents 15 as the minimum age to open one’s own account. Article 6(1) is more precise: providers of social networking and video-sharing services must not allow persons under 15 to create an account or to access the service through an account where the service poses a risk to the privacy, safety or security of the minor.
A service is deemed to pose such a risk where it has at least one of the listed features:
- it allows content to be transmitted in real time to an indeterminate number of recipients, including livestreaming;
- it allows contact or interaction with users outside pre-existing connections or subscriptions;
- it uses a recommender system based on profiling within the meaning of Article 4(4) GDPR;
- it suggests contacts or information that do not come from pre-existing connections;
- it deploys features or interfaces enabling uninterrupted content consumption, incentivising interactions, or sending automated notifications designed to bring the user back.
The Commission could add further features by delegated acts (paragraph 6). In practice, the list describes almost every widely used social network today: the conditionality matters mainly for services built differently, which could remain accessible without the threshold.
For providers relying on consent, paragraph 5 specifies that the new rules would apply in parallel with the age limits in Article 8 GDPR, which therefore remain distinct.
From 13 to under 15: supervised accounts
By way of derogation, providers may allow guardians to set up an account with limited features for minors aged 13 to under 15 (Article 6(2)). The account must have the tools for guardians always activated, a daily time limit set by the guardian not exceeding one hour, and the possibility for the guardian to pre-approve new contacts and cap their number. The provider must establish that the person creating the account holds parental responsibility and that the minor is at least 13 (paragraph 3).
Under 13: access only through the guardian’s account
For services with the risk features in Article 6, no account is provided for under 13, because the derogation in paragraph 2 starts at 13. Article 7 exceptionally allows limited access only to video-sharing platforms specifically designed for children under 13, through the guardian’s own account and subject to cumulative conditions. The minor is not a party to the contract; the provider must have published an assessment of the service’s impact on the relevant age range; the guardian declares the minor’s age, sets a maximum daily duration not exceeding one hour, supervises content, approves contacts and can suspend access at any time. Personalisation, recommender systems and search remain switched off unless the impact assessment shows that activating them is in the minor’s best interests. Access ends when the child turns 13 and cannot be enabled for children under 3 (paragraph 4(b)).
The Commission’s factsheet shows the 0 to 3 age band with the words “no screens”. In the text, that threshold operates as a limit on the guardian-controlled access under Article 7, not as a general ban on screen exposure. Paragraph 2 also makes clear that no provider is required to allow access by children under 13.
Existing accounts
Within six months of the regulation starting to apply, providers would have to establish whether holders of existing accounts are under 15 and disable the accounts of those who are, and of those whose age cannot be established (Article 6(4)). This would be done through an age verification solution compliant with the regulation, unless the provider can establish with a high degree of confidence that the user has reached the minimum age (Article 32(1) and (2)). Very large online platforms would have to submit to the competent authority a plan setting out how they intend to proceed and, if they wish to rely on the exception, how they will establish users’ age (paragraph 4).
The press release gives account creation date and credit card details as examples of the proxies that may be used for the estimate. The provisions do not list these proxies: this is a point we return to under data protection.
Safety by design
A default setting for everyone
The general obligation in Article 8(1) has a reach that the institutional communication does not fully convey. Providers of social media, video-sharing platforms, online games, AI companions, general conversational chatbots and app stores would have to design their services in line with the requirements of Chapter III by default, including where the service is accessible without an account, and could depart from them only after establishing, through age assurance, that the user is an adult. Article 32(3) exempts cases where the provider can establish with a high degree of confidence that the user is not a minor.
It follows that, absent a reliable signal of adulthood, the experience designed for minors would become the starting point for every user.
Addictive design and recommender systems
Article 9 prohibits social networking and video-sharing services from being designed or operated so as to encourage compulsive or excessive use by minors, and deems certain techniques to do so:
- autoplay and uninterrupted consumption without effective breaks that let the minor decide whether to continue;
- notifications unrelated to the minor’s own activity, which undermine the decision to stop using the service;
- incentives to share content or livestream to an indeterminate audience;
- incentives to engage at regular times, including through penalties for not engaging, such as so-called streaks.
Providers would also have to introduce time limits and usage interruptions that protect school time and core sleep hours.
For recommender systems, Article 10 requires optimisation that does not exploit minors’ vulnerability or attention and that includes metrics on quality, safety and mental health. Explicitly stated preferences must take priority; recommendations based on implicit engagement signals are switched off by default; minors’ data collected outside the service cannot be used. Minors must be able to reset their preferences and choose at least one option not based on profiling.
Safe settings and contact safeguards
Article 11 requires geolocation and other tracking features, access to microphone and camera, account recommendations and contact synchronisation, and push notifications to be switched off by default. The provider could change these settings only for minors over 15 who have been informed and have given explicit consent; geolocation enabled by the minor would switch off at the end of the session. Features that increase social comparison or misrepresent the minor’s image, by disproportionately embellishing or idealising it, should not be available.
Article 12 governs contacts: nobody can initiate direct contact with a minor without the minor’s prior approval, and the provider must prevent minors from being enticed or manipulated into granting it; minors do not appear in contact suggestions, join groups only with their explicit agreement, and can block anyone without being identified. Minors’ content is visible only to accepted contacts, their contact details are not disclosed, other users cannot download or screenshot their content, and livestreaming is off by default.
Economic transactions, online games and app stores
Article 13 requires minors to be told in real time that they are about to make an economic transaction, purchases in virtual currency to display the corresponding value in national currency, and the service not to expose minors to variable reward systems.
Online games are subject to a selection of these obligations (Article 15). App stores would have to rate every app by age, publish the rating methodology, prevent minors from accessing or buying apps that are not appropriate for their age, and allow the EU age verification solution to be offered in the store (Article 16).
Tools for guardians
Articles 18 to 21 complete Chapter III with tools supporting minors’ agency, child-friendly reporting mechanisms, tools for guardians and collective complaints. Tools for guardians should be effective, not easily circumvented, and respectful of the minor’s privacy and agency, and the minor must be informed when they are used (Article 20(1) and (2)). Very large online platforms must ensure interoperability with third-party tools (paragraph 5). The Commission’s Q&A stresses that these tools complement providers’ obligations rather than replacing them.
Age assurance and data protection
Zero-knowledge proofs and data minimisation
Chapter V sets out the principles. Age assurance solutions should be accurate, reliable, secure, robust, non-intrusive, privacy-preserving and non-discriminatory (Article 27). Article 28 adds particularly strict data protection rules:
- solutions must not enable users to be identified, nor located, tracked, profiled or targeted with advertising for any purpose;
- providers and entities acting on their behalf may not process more data than strictly necessary to check whether the threshold has been met, nor combine it with other data or with data from other services;
- every age assurance measure must be based on zero-knowledge proofs;
- by way of derogation, the provider may store at account level only the signal that the user has met a given threshold, to avoid repeated checks.
Verification of parental responsibility follows a similar logic (Article 26). Providers could use signals from public databases, signals already in their possession from past interactions of the minor and guardian with the service and, until a delegated act is adopted, the guardian’s self-declaration. Verification should not lead to further processing that could locate, track or profile adults or minors. Member States should provide, free of charge, at least one electronic means of attesting parental responsibility that reveals to providers only that such responsibility exists (Article 31(1)).
The certified EU solution and the operating system’s age signal
For the thresholds in Article 6, providers would have to rely exclusively on an EU age verification solution using an EU proof-of-age attestation, provided by a third party, certified by a public authority and included in the lists kept by the Commission (Articles 29(2) and (3) and 30). European Digital Identity Wallets that meet the scheme would be deemed certified. For the design obligations in Article 8 and for app stores, alternative solutions would be allowed if they meet Articles 27 and 28 (Article 29(4)). Member States should make at least one certified solution available free of charge (Article 31(5)).
Article 29(6) introduces a new element: an operating system provider that has obtained a compliant age signal should enable it to be shared, with the user’s consent, with providers subject to the regulation. The technical, security and privacy requirements for such sharing would be set out in delegated acts (Article 30(3)).
On supervision, Article 34(6) gives GDPR supervisory authorities competence over the processing needed to comply with the regulation, in particular Articles 27, 28 and 29, with fines up to the amount in Article 83(5) GDPR. For an analysis of age verification under current law, see
Age Verification in Europe: DSA Enforcement and EUDI Gap
.
The artificial intelligence chapter
The obligations in Article 14
Section III of Chapter III is dedicated to AI companions and general conversational chatbots. Article 14(1) requires providers to put in place proportionate and effective measures ensuring a high level of protection of the health, safety, fundamental rights, well-being and development of minors who may access the system. At a minimum:
- no addictive design: design features and system behaviours simulating interpersonal relationships likely to create emotional dependency must be avoided, and the measures on compulsive use and time limits in Article 9 apply (point (a));
- safe settings: the measures in Article 11 apply and, by default, the system does not use information or analysis derived from the minor’s prior interactions in subsequent ones, except where necessary to protect the minor’s safety (point (b));
- transparency of economic transactions, under Article 13 (point (c));
- access by children under 13 enabled and controlled only through the tools for guardians (point (d));
- state-of-the-art evaluation and testing of risks to minors before placing on the market or putting into service, with appropriate safeguards (point (e));
- post-market monitoring, including by detecting and responding to serious incidents involving minors, except for micro and small enterprises (point (f)).
Where an AI companion or chatbot is deployed as a functionality of a social network, video-sharing platform or online game, the service provider must ensure that it is not activated automatically or displayed prominently in the interface, that minors are not encouraged to use it, and that they can easily opt out at any time (paragraph 2). Recital 34 gives, as an example of undue nudging, placing the chatbot at the top of the minor’s contact list.
Recital 32 explains the reason for the memory default: preventing these systems from accumulating minors’ sensitive data and reinforcing harmful interaction patterns over time.
Providers adhering to a code of conduct assessed as adequate by the Commission could rely on it to demonstrate compliance (paragraph 3).
The interplay with the AI Act
The proposal presents itself as complementary to the AI Act and without prejudice to the prohibitions and obligations already in place (recital 8). The explanatory memorandum also refers to the recent amendments to the AI Act prohibiting AI systems that generate child sexual abuse material.
Recital 33 addresses general-purpose models: where the companion or chatbot is based on a model with systemic risk, mitigations adopted as part of systemic risk management under Article 55 of the AI Act can be relied upon to demonstrate compliance, and the same applies to DSA risk assessments under Articles 34 and 35 where the chatbot is embedded in a social network or video-sharing platform. The recital specifies, however, that such measures are not sufficient on their own.
The supervisory architecture is the most significant point for those working in the field:
- supervision of the obligations of providers of AI companions and chatbots would follow Chapter IX of the AI Act, and infringements would be subject to the fines in Article 99 of that regulation, up to 6% of total worldwide annual turnover in the preceding financial year, where the provider acted intentionally or negligently (Article 34(2));
- the Commission’s powers under Articles 75a to 75d and Article 99 of the AI Act would extend to supervision of the new regulation (Article 34(4)). Articles 75a to 75d were inserted into the AI Act by Regulation (EU) 2026/1744; we analysed the AI Office’s supervisory and enforcement powers in
Digital Omnibus on AI: Regulation (EU) 2026/1744 Is Published in the Official Journal
;
- complaints about chatbots falling under the AI Office’s exclusive competence under Article 75(1) of the AI Act would be lodged with the AI Office (Article 21(2));
- the Commission would also charge an annual supervisory fee to providers of AI companions and chatbots under its competence, capped at 0.03% of worldwide annual net income (Article 36).
A caveat on sources. The Commission’s Q&A states that AI companions and chatbots cannot be placed on the market until providers can demonstrate compliance and have a monitoring mechanism in place. We did not find a prior authorisation mechanism for these systems in the provisions: Article 14 requires testing and evaluation before placing on the market and monitoring afterwards, but does not make placing on the market conditional on a decision by an authority.
What the KIDS Act does not do: no chat control
No scanning obligation and the ePrivacy safeguard
In the European debate, child protection online is often associated with so-called chat control, the detection of child sexual abuse material and grooming in private communications. It is therefore worth stating clearly what the proposal does not contain.
The text provides for no obligation to detect, to scan content, or to interfere with the encryption of communications. Child sexual abuse appears in the explanatory memorandum only as context: the proposal refers there to the Regulation to prevent and combat child sexual abuse, noting that its adoption is still ongoing.
This is a deliberate choice. The Special Panel co-chairs recommended placing clear obligations on providers to prevent, detect, report and block child sexual abuse online, including in interpersonal communications. The staff working document accompanying the proposal, in the table explaining how the recommendations are implemented, does not assign this recommendation to the KIDS Act: it refers to the ongoing negotiations on the Regulation to prevent and combat child sexual abuse and to the AI Act prohibition of systems generating child sexual abuse material. Chat control therefore remains an open issue, but on a different table.
Article 2(7) is without prejudice to the GDPR and Directive 2002/58/EC, so the confidentiality of communications remains governed by its own framework, including the temporary derogation regime we examined in
.
Nor does the personal scope cover messaging services as such: Article 2 does not mention interpersonal communications services and refers to the Digital Markets Act for the notion of online social networking service. On social networks, Article 12 addresses who may contact a minor, not what is written. The “monitoring obligation” in Article 22 also has a different object from what its heading might suggest: it requires very large online platforms to monitor, test and evaluate the effectiveness of the measures they have adopted, as part of the DSA risk assessment, not users’ content.
The actual privacy and cybersecurity issues
The absence of scanning obligations does not make the proposal neutral for confidentiality and security. The sensitive points lie elsewhere.
The first is the age assurance infrastructure. Exclusive reliance on certified solutions, EU lists of attestation providers, storage of the age signal at account level and its sharing by the operating system create an attestation ecosystem whose security becomes a condition for the effectiveness of the safeguards in Article 28. Zero-knowledge proofs reduce the data exposed, but do not remove the risks linked to compromised components or to the correlation of signals.
The second is indirect signals. Estimating the age of existing account holders, as described in the press release, and using parental-responsibility signals derived from past interactions with the service (Article 26(1)(b)) are processing operations that will need to be assessed against the principles of purpose limitation and data minimisation.
The third concerns conversations with AI systems. Article 14 switches memory off by default, but allows prior interactions to be used where necessary for the minor’s safety, and requires the detection of serious incidents. The text does not say how such incidents can be detected without analysing, to some extent, the content of conversations. The staff working document, when assessing costs, lists among monitoring activities incident reporting, periodic review of interaction patterns and processes to detect harmful or manipulative outcomes. These are not communications between people, and the issue differs from chat control; in my view, however, this is precisely where the future implementing framework will need to specify which data may be processed, for how long and with what safeguards, because unbounded monitoring would end up contradicting the very reason why memory is switched off.
Enforcement: the burden of proof shifts to providers
Compliance plan and independent audit for very large online platforms
The “reversal of the burden of proof” announced by the Commission takes shape in Article 5, which would apply from the day of entry into force. Social networks and video-sharing platforms designated as very large online platforms under the DSA, that is, with 45 million or more average monthly active users in the Union according to the Q&A, would have to notify the Commission of a detailed compliance plan:
- within four months of designation or, for platforms already designated, within thirty days of the regulation starting to apply;
- backed by an independent audit commissioned and paid for by the provider, carried out by auditors with expertise in, among other things, children’s rights, paediatric medicine and child psychiatry;
- with a final report sent simultaneously to the Commission and to the provider within two months of receipt of the plan, a summary of which the provider must publish.
If the Commission finds shortcomings by decision, the provider must submit a corrective action plan within thirty days, to be implemented within a period not exceeding sixty days, and the auditor verifies implementation. After the first notification, the provider reports annually as part of the DSA risk assessment and audits.
One detail reveals the logic of the mechanism: neither the final report nor any inaction by the Commission constitutes a finding of compliance (Article 5(8)). The plan is therefore a burden of demonstration, not an authorisation.
Here too the materials diverge. The Commission’s overview page states that compliance plans for new services, features or functionalities would be assessed within thirty days and that they could be rolled out only after a positive opinion by the Commission. Article 5 of the published text provides for neither that deadline nor a positive opinion as a condition for launch.
As regards ordinary supervision, Chapter IV of the DSA would apply to social networks, video-sharing platforms, video gaming platforms and app stores (Article 34(1)). For providers of online games that are video games, supervision would lie with a designated national authority, with exclusive competence for the Member State of main establishment (paragraph 5). National authorities could not take decisions that run counter to those of the Commission (paragraph 7).
Expedited procedure: what the text provides compared with the institutional communication
The press release and the factsheet refer to investigations concluded within 90 days; the explanatory memorandum and recital 68 mention 30 days for preliminary findings and 90 days for the final decision. Article 35, applicable twelve months after entry into force, concerns very large online platforms and AI systems under the Commission’s exclusive supervision, and provides that the Commission shall endeavour to:
- communicate its preliminary findings within [30] working days of opening proceedings;
- adopt a final decision within 90 working days.
The differences, including those within the proposal itself, are not marginal. In the article the days are working days, not calendar days; the deadline for preliminary findings is still in square brackets and therefore open; and “shall endeavour” expresses an objective, not a mandatory time limit. Finally, Article 38 provides for an incident reaction mechanism coordinated by the Commission with national authorities.
Beyond the text: memory, evidence and systems that act
The observations that follow are my own assessment of the proposed text.
The proposal never mentions AI agents. This is not a surprising gap: the AI Act does not recognise the “agent” as a regulatory category either, and Regulation (EU) 2026/1744 names agentic AI only within a nomenclature code used to designate notified bodies. Nevertheless, three elements of Articles 14 and 5 bear directly on the issues I addressed in the book Agentic AI.
The first is memory. The default in Article 14(1)(b) affects a component that is not incidental in advanced assistants: persistence of information across sessions is what allows a system to continue a task, remember preferences and constraints, and act consistently. In my view, for systems accessible to minors the legislator’s choice turns memory from a feature into a governance decision, to be justified case by case. This is the subject of § 4.3 of the book, Memory and persistence.
The second is the definition. A general conversational chatbot is identified by the breadth of its function, and “transactional” systems are excluded. A general-purpose assistant that, besides conversing, books, buys or sends messages very probably remains within the definition, because the ability to act adds to the generality of the conversation. An agent dedicated to a transactional task and also accessible to minors, by contrast, could fall outside it, while exposing minors to risks that Article 13 seeks to prevent on social networks and that Article 14 extends only to AI companions and general chatbots. In my view this is a point the negotiations should clarify, also in light of what the book observes in § 6.1, The Absence of the “Agent” as a Regulatory Category: when the law classifies systems by label or declared function, rather than by what they can do, systems that act tend to end up in the borderline zones.
The third, and most important, is evidence. Testing before placing on the market, monitoring afterwards, incident detection, an audited compliance plan, an annual report: the proposal asks providers to demonstrate, not to declare. This is the logic I call evidential accountability in the book (§ 7.7), the ability to reconstruct, through preserved evidence, the chain linking objectives, design choices, system behaviour and human interventions. Without an evidentiary apparatus designed from the outset (the subject of chapter 10, Audit Trails, Evidence, and Incident Investigation), the reversal of the burden of proof would remain a formula. The proposal, however, adds a constraint that makes the problem harder: the evidence needed to demonstrate safety must not become an archive of minors’ conversations. In my view the answer lies in distinguishing, already at the design stage, between recording the system’s behaviour, which serves as proof, and retaining the content of interactions, which Article 14 seeks to limit.
What to do now
The text is a proposal and will change. Some work, however, is worth starting now, because it takes time and is useful under the current framework of Article 28 DSA and the AI Act as well.
Providers of AI companions and chatbots
- Qualify your systems against the two new definitions, paying particular attention to the exclusion of specialised and transactional systems.
- Map existing measures against Article 14: memory defaults, pre-release testing of risks to minors, monitoring and incident-handling processes.
- Design monitoring so as to limit processing of conversation content, and document the choices made.
- Check whether the system falls under the AI Office’s exclusive competence under Article 75(1) of the AI Act, which would also determine the supervisory authority under the new regulation.
- Follow any work on codes of conduct, which could become the main tool for demonstrating compliance.
Social networks and video-sharing platforms
- Compare the service’s features with the risk features in Article 6(1), which trigger the 15-year threshold.
- Assess the impact of the rule in Article 8(1), which would make the minors’ experience the default absent a reliable signal of adulthood.
- Plan the review of existing accounts and recommender systems.
- For very large online platforms, bear in mind that Article 5 would apply from entry into force: preparing the compliance plan and selecting auditors takes time.
DPOs and compliance officers
- Start the data protection impact assessment of age assurance and parental-responsibility verification solutions now, in light of Article 28 of the proposal and Article 35 GDPR.
- Coordinate the new thresholds with those in Article 8 GDPR, which would continue to apply in parallel.
- Bear in mind that GDPR supervisory authorities would be competent for Articles 27, 28 and 29, with the related enforcement powers.
- Check the legal basis and retention periods for data used to monitor AI systems accessible to minors.
Concluding remarks
On 15 July we suggested a shift from prescribing protective measures to requiring providers to demonstrate in advance that digital environments for minors are safe. The proposal of 17 September moves in that direction, through an architecture spanning three frameworks: the DSA for platforms, the AI Act for AI systems, and the GDPR for the data processed in age assurance.
The 15-year threshold is what will be debated most. In my view, however, the core of the proposal lies elsewhere: in the rule that makes the protected experience the default, in the extension of safety by design to conversational AI systems, and in the obligation to demonstrate, with evidence, what until now it was enough to declare. The negotiations will show whether these choices survive. In the meantime, the discrepancies between the institutional communication and the provisions suggest a rule of method: to understand what the proposal really requires, one has to read the text.
We will follow the legislative procedure on these pages.
Further reading. Memory in AI systems, evidence and evidential accountability are developed in the book => https://www.nicfab.eu/en/pages/book-agentic-ai/ Agentic AI — Technical Autonomy, Human Responsibility, and Legal Governance , available in English and Italian editions.
Methodological note
This analysis is based on the English text of proposal COM(2026) 681 final, the only version available at the date of publication.
For the relationship with the Special Panel’s recommendations and with the Regulation on child sexual abuse, staff working document SWD(2026) 681 final was also consulted.
The published text contains some formal inaccuracies and some internal inconsistencies, including those noted on the application timeline and on the deadlines of the expedited procedure. The list of risk features in Article 6(1) begins at point (d), and some internal cross-references do not appear to be aligned: for example, Article 7(5) refers to Article 5(2) for limited-feature accounts, which are governed by Article 6(2). In this article provisions are referred to by their content; references should be checked against the official version.
Reference documents
- European Commission, proposal for the EU KIDS Act, COM(2026) 681 final, 2026/0286(COD), 17.9.2026:
https://ec.europa.eu/newsroom/dae/redirection/document/132530
- European Commission, proposal page with the accompanying communication and staff working document:
- European Commission, communication “An EU approach to online child safety”, COM(2026) 680 final, 17.9.2026:
https://ec.europa.eu/newsroom/dae/redirection/document/132528
- European Commission, staff working document, analysis of impacts, SWD(2026) 681 final, 17.9.2026:
https://ec.europa.eu/newsroom/dae/redirection/document/132529
- European Commission, press release IP/26/1890, 17 September 2026:
https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1890
- European Commission, EU KIDS Act factsheet:
- European Commission, news item on Shaping Europe’s digital future, 17 September 2026:
- European Commission, EU KIDS Act overview:
https://digital-strategy.ec.europa.eu/en/policies/kids-act
- European Commission, EU KIDS Act questions and answers:
https://digital-strategy.ec.europa.eu/en/faqs/kids-act-explained
- European Commission, Special Panel on child safety online:
https://commission.europa.eu/topics/digital-economy-and-society/special-panel_en
- Regulation (EU) 2022/2065 (Digital Services Act):
http://data.europa.eu/eli/reg/2022/2065/oj
- Regulation (EU) 2022/1925 (Digital Markets Act):
http://data.europa.eu/eli/reg/2022/1925/oj
- Regulation (EU) 2024/1689 (Artificial Intelligence Act):
http://data.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI):
http://data.europa.eu/eli/reg/2026/1744/oj
- Regulation (EU) 2016/679 (GDPR):
http://data.europa.eu/eli/reg/2016/679/oj
- Directive 2002/58/EC (ePrivacy Directive):
http://data.europa.eu/eli/dir/2002/58/oj
This article is for information purposes only and does not constitute legal advice.
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.