European Commission publishes the EU KIDS Act proposal

The EU KIDS Act is a regulation proposed by the European Commission that would restrict how minors access online services and would require AI companion chatbots to be turned off by default and barred from fostering emotional dependency in children.

On Sept. 17, 2026, the European Commission proposed the EU KIDS Act, a new regulation intended to strengthen protections for minors using digital services and AI systems.

What it is

The Commission published the proposal alongside a Communication from the Commission to the European Parliament and Council on online child safety.

The proposed rules will apply to online services used by minors, including social media, video-sharing platforms, online games, and AI companions and chatbots.

What it requires

Under 13, children will not be able to access social media services.

From age 13 to under 15, children will be able to use social media through a mini account managed by a parent or guardian, with limited features and a time restriction of 1 hour per day.

From age 15 onwards, children will be able to open and manage their own social media account.

Online services and app stores will have to use tools to check users’ ages, while protecting their privacy.

The proposal would also shift the burden of proof from regulators to platforms.

Fines can reach 6% of total worldwide annual turnover.

An expedited procedure would deliver preliminary findings within 30 days and a final decision targeted within 90 days, because there is no time to spare.

The text will now be examined by the European Parliament and the Council, who will negotiate and decide on the final text before it becomes law.

What security leaders should do

Security and product teams running AI companion or general conversational chatbot features should inventory which products meet the proposal's definitions, since providers would need to conduct pre-market risk testing and post-market monitoring of AI companions and chatbots used by minors.

Teams should also review how any conversational memory, default settings, and age-verification integrations would need to change to meet the no-persistent-memory-by-default and off-by-default requirements described above, while tracking the file's progress given that even if adopted, the EU KIDS Act is unlikely to apply before 2028.

Given the planned shift of the burden of proof onto providers, security leaders should start documenting safety-by-design evidence now rather than waiting for the co-legislators to finalize the text.