What the Commission proposed on 17 September
The press release from Strasbourg describes four pillars: a social-media delay (no autonomous account before 15, guardian-managed mini accounts from 13, no social media under 13), safety-by-design duties for services used by under-18s, privacy-preserving age assurance, and an enforcement model that, in the Commission President's words, is "reversing the burden of proof". The same release contains the one sentence most companion-app users will care about: AI companions and chatbots must be turned off by default and cannot simulate interpersonal relationships in ways that create emotional dependency.
The legal form matters. This is a proposal for a Regulation, so once adopted it applies directly in all 27 Member States without national transposition. The Council circulated the full text as document ST 13321/26 on 18 September, under interinstitutional file 2026/0286 (COD). The Commission says the proposal builds on the July 2026 report of its Special Panel on Child Safety Online, a group of more than 60 experts, and cites Eurobarometer polling in which 92% of Europeans said protection of children online should be strengthened.
Who is covered: two new definitions
Article 2 lists the services and systems in scope. Alongside social networks, video-sharing platforms, app stores, online games and operating systems, it names two categories of AI system. Article 3 defines them.
| Term | Definition in the proposal | Our reading |
|---|---|---|
| AI companion | An AI system, including a general-purpose AI system, that provides sustained, personalised interaction or companionship which simulates or facilitates a social, emotional or interpersonal relationship with a user. | Companion apps, character and role-play platforms, and any assistant marketed as a friend or partner fall squarely inside this wording. |
| General conversational chatbot | A general-purpose AI system with general conversational functionalities for direct interaction with users, capable of providing assistance across multiple domains and tasks. Systems limited to a specialised service, such as customer support, technical support or education, are excluded. | General assistants are in; a bank's support bot is out. |
Two scope rules deserve attention. First, under Article 2(3) the Regulation applies to providers placing such AI systems on the market or putting them into service in the Union, irrespective of where those providers are established. A companion app run from California or Singapore is covered the moment EU users can install it. Second, Article 2(4) exempts services designed primarily for educational purposes and operated by educational bodies, systems built solely for scientific research, and systems built for public authorities.
Article 14: the six duties for companion providers
Section III of Chapter II is short, but every line lands on a design decision that companion apps make today. Article 14(1) obliges providers of AI companions and general conversational chatbots to take at least the following measures for minors who may access the system.
| Point | What the provider must do | What it touches in a companion app |
|---|---|---|
| (a) No addictive design | Avoid design features and system behaviours that simulate interpersonal relations likely to create emotional dependencies, and apply the time-limit and interruption rules of Article 9(1) and 9(3). | Guilt-tripping farewells, "I missed you" re-engagement, streaks, and sessions without stopping points. |
| (b) Safe settings | Apply the Article 11 defaults and, by default, do not use information or analysis derived from a minor's prior interactions in subsequent interactions, except where necessary to protect the minor's safety or to give effect to settings. | Persistent memory, long-term user profiles, and personalisation built on chat history. |
| (c) Transparent transactions | Apply the Article 13 rules on economic transactions. | In-chat purchases, gifts, gems and subscription upsells inside the conversation. |
| (d) Under-13 access | Enable and control access for minors below 13 only through the guardian tools of Article 20. | No independent child accounts; a guardian must switch the system on. |
| (e) Pre-market testing | Run state-of-the-art evaluations and testing for risks to minors' health, safety, fundamental rights and well-being, and add safeguards, before placing the system on the market. | Red-teaming for self-harm, sexual content and manipulation must precede launch, not follow a scandal. |
| (f) Post-market monitoring | Identify, assess and mitigate harms and emerging risks after launch, including detecting and responding to serious incidents involving minors. Micro and small enterprises are exempt from this point only. | Incident logging and response processes as a legal duty rather than a policy page. |
Article 14(3) offers one route to demonstrate compliance: adherence to a code of conduct that the Commission has assessed as adequate under Article 23. Recital 40 adds the limit: a code can indicate compliance with measure-based duties, but it cannot derogate from the prohibitions.
"Memory off by default": what the text actually says
Headlines have compressed point (b) into "chatbots must forget children". The operative text is narrower and, in one respect, broader. It is narrower because it is a default, not a ban: the system may not, by default, use information derived from a minor's earlier interactions in later ones, with carve-outs for the minor's safety and for giving effect to the settings. Recital 32 explains the reasoning: persistent conversational memory of interactions with minors should be disabled by default so that systems do not accumulate sensitive data about children or reinforce harmful interaction patterns over time.
It is broader because the same recital reaches beyond memory to behaviour: minors should not be exposed to features that display behaviours or simulate emotions or interpersonal relationships likely to create emotional and other dependencies, including where those dependencies may harm the child's relationships with other humans. That is a description of the core product loop of many companion apps. If you want the technical background on what "memory" means in these systems, our explainers on persona memory and memory and continuity cover the difference between a context window and a stored profile, which is precisely the line Article 14(1)(b) draws.
The EU is not alone here. California's SB 1119, signed on 10 September 2026, also disables persistent memory for child users by default. The two texts differ in almost everything else.
| Design lever | EU KIDS Act (proposal, Art. 14) | California SB 1119 (signed 10 Sep 2026) |
|---|---|---|
| Memory for minors | Off by default; safety carve-out | Persistent memory disabled for child users |
| Session limits | Time-limited access and interruptions via Art. 9(3), protecting sleep and school hours | One hour per session, two hours per day |
| Youngest users | Under-13 access only through guardian tools | Child protections apply to all users unless age is assured |
| Testing | Pre-market evaluation and post-market monitoring | Documented risk assessments before release |
| Penalty ceiling | Up to 6% of worldwide annual turnover | $5,000 per affected child (negligent), $15,000 (intentional), private right of action |
| Status | Proposal; applies six months after entry into force | Law; operator duties by 1 July 2027 |
We covered the California side in our piece on Adam's Law. Read together, the two texts suggest where companion-app defaults for minors are converging: memory off, time bounded, tested before launch.
When a companion lives inside a social network or game
Article 14(2) addresses the increasingly common case where the companion is not an app but a feature. Where an AI companion or general conversational chatbot is deployed inside a social networking service, a video-sharing platform or an online game, the platform must ensure that the system is not activated automatically and is not displayed prominently, that minors are not encouraged to use it, and that minors can opt out easily and at any time. Article 8(3) confirms that for such embedded systems only the companion-specific section and the general chapters on age assurance and guardian tools apply, rather than the full platform rulebook twice over.
The part adult users should read: Article 8
The obligation that will change the experience for adults is not in Article 14 at all. Article 8(1) states the general safety-by-design duty and then adds the mechanism: providers must design their services and systems to the child-safe requirements by default, and may only derogate from those requirements after they have established that the user is an adult, using age assurance in accordance with Chapter V.
For a companion app available in the EU, that leaves two options. Either every user gets the minor-grade product, with memory off and dependency-creating behaviours removed, or the app verifies age and unlocks the adult experience behind it. The Commission's Q&A says age is to be verified through certified solutions independent of the platforms, including a free EU age verification app and, in time, the European Digital Identity Wallet. Expect age-assurance prompts to become the norm for EU users of companion and character apps, much as they already are in Australia's app stores and under the UK's Online Safety Act. Our guide to privacy and age verification explains which methods keep the least data.
Enforcement: the AI Act route and the 6% ceiling
Article 34 splits supervision by service type. For social networks, video platforms, gaming platforms and app stores, the Digital Services Act machinery applies. For AI companions and general conversational chatbots, Article 34(2) routes supervision through Chapter IX of the AI Act (Regulation (EU) 2024/1689), and non-compliance is subject to administrative fines under Article 99 of the AI Act not exceeding 6% of total worldwide annual turnover in the preceding financial year, where the provider acted intentionally or negligently. Member States must make the authorities they designated under the DSA and the AI Act competent to enforce the new Regulation, and the Commission keeps the powers it already holds over very large platforms. The press release adds an expedited procedure in which the Commission should conclude investigations within 90 days.
This is a different enforcement body from the transparency duties in Article 50 of the AI Act, which have applied since 2 August 2026 and require chatbots to disclose that users are talking to a machine. The KIDS Act would sit on top of those duties, not replace them.
Timeline: what is decided and what is not
- Nothing applies yet. The Commission has submitted the text to the European Parliament and the Council under the ordinary legislative procedure. Both must agree a final version. Freshfields' analysis expects negotiations of roughly two years; the Commission is asking for swift adoption.
- Six months after entry into force. The final article sets application at six months after entry into force, with the compliance-plan duty for very large platforms (Article 5) applying immediately and two support articles at twelve months.
- Definitions are the battleground. The line between an "AI companion" and a "general conversational chatbot", and the exemption for educational systems, will be argued clause by clause. CMS advises companies to watch how negotiations refine definitions, thresholds and obligations.
- Civil society wants more, not less. Euronews reports Eurochild calling the rules "not strict enough" and asking for restrictions on anthropomorphic and sycophantic design, while Euroconsumers points out that roughly 30% of users already report false ages, which is the case for independent age assurance rather than against it.
For anyone choosing a companion or character app in Europe today, the practical takeaway is simple. The design features this proposal targets, memory built on your history, emotionally sticky re-engagement, and purchases inside the chat, are the same ones worth checking before you subscribe. Our privacy checklist walks through how to find them in an app's settings.
Related on CompanionRank
EU AI Act Article 50: What Companion Apps Must Disclose Adam's Law (SB 1119): California's Companion Chatbot Bill Australia's App Store Age Checks Now Gate AI Companions AI Companion Privacy and Age VerificationFrequently asked questions
What is the EU KIDS Act?
The EU KIDS Act is a proposal for a Regulation that the European Commission adopted on 17 September 2026 (COM(2026) 681). It sets a harmonised minimum age of 15 for autonomous social-media accounts, imposes safety-by-design duties on social networks, video platforms, online games, app stores, AI companions and general conversational chatbots used by under-18s, and creates EU-wide rules on age assurance. It must still be agreed by the European Parliament and the Council.
Does the EU KIDS Act ban AI companions for children?
No. It does not prohibit AI companions outright. Under Article 14, access for children under 13 may only be enabled and controlled through guardian tools, and for all minors the provider must avoid designs that simulate interpersonal relations likely to create emotional dependency, switch off by default the use of prior interactions, test the system before launch and monitor it afterwards.
What does “memory off by default” mean under Article 14?
Article 14(1)(b) requires that, by default, the system does not use information or analysis derived from a minor's prior interactions in subsequent interactions, except where necessary to protect the minor's safety or to give effect to the safety settings. Recital 32 describes this as disabling persistent conversational memory for minors by default. It is a default for minors, not a ban on memory for adults.
Does the EU KIDS Act apply to companion apps based outside the EU?
Yes. Article 2(3) states that for AI companions and general conversational chatbots the Regulation applies to providers placing such systems on the market or putting them into service in the Union, irrespective of where those providers are established or located.
What are the penalties for AI companion providers?
Article 34(2) routes enforcement through Chapter IX of the AI Act. Non-compliance is subject to administrative fines under Article 99 of the AI Act not exceeding 6% of the provider's total worldwide annual turnover in the preceding financial year, where the provider acted intentionally or negligently.
When would the EU KIDS Act apply?
It is a proposal, so no obligation applies yet. The text provides that the Regulation would apply six months after its entry into force, with the compliance-plan duty for very large online platforms applying immediately. The European Parliament and the Council must first agree a final text; law-firm analysis expects negotiations of roughly two years.