The news

On 17 September 2026 the European Commission adopted a proposal for the EU KIDS Act (full expansion on the FAQ page: EU Keeping Internet Digital Spaces Accountable and Trustworthy). Primary pages: the KIDS Act policy brief and the dated FAQ The KIDS Act explained (17 September 2026). Press framing: IP/26/1890. Reuters wire same day: What is in the EU's planned KIDS Act?.

The proposal does two things the Commission keeps paired: (1) EU-wide age stairs for social media and video-sharing accounts; (2) safety-by-design duties on the services minors actually use, including AI chatbots and companions, games, app stores, and operating systems. Encyclopaedias, educational platforms, and digital news are proposed as exemptions for key information access.

This dispatch focuses on how those stairs and duties hit AI companions / conversational chatbots, not only the social-media age headline.

Who is bound

  • Providers of social networking and video-sharing services with the risky features the age rules target (FAQ: age stairs apply to those services).
  • Providers of online games, AI companions and chatbots, app stores, and operating systems when their services are designed for or accessible to children / users below 18 (policy page and FAQ).
  • Very large online platforms (VLOPs) at 45 million or more active monthly users in the EU: ex-ante compliance plans, independent audits paid by the platform, Commission review (policy: new services/features assessed within 30 days and rolled out only after positive opinion; FAQ: reverse burden of proof before contact with children under the new regime).
  • Enforcement spine: Digital Services Act structures for online platforms; AI Act structures for AI companions and chatbots. Commission directly supervises the most widely used platforms and chatbots; Digital Services Coordinators and national market surveillance authorities cover other services and AI systems. National authorities designated by Member States supervise video games that are not online platforms.
  • Parents / guardians: tools to set screen time, approve contacts, manage settings, and report harmful content; free privacy-preserving proof of parental responsibility in every Member State. FAQ insists parental tools complement, and do not replace, provider obligations.
  • Still required for the Act to bite: agreement by the European Parliament and the Council. Reuters: the text can be revised before enactment.

What's new

  1. Age stairs (social / video-sharing). Under 13: no account (narrow parent-mediated access only on child-designed video services). Ages 13 to under 15: guardian-set limited mini accounts; FAQ adds daily time limit of at most one hour, parental tools always on, parental approval of contacts. From 15: autonomous accounts on services that must be safe by design. Policy page and FAQ both state the EU-wide minimum age of 15 for autonomous social accounts.
  2. Existing under-15 accounts. Within six months of the rules applying, platforms must check whether existing holders are under 15 and disable accounts that are under 15 or whose age cannot be established. High-confidence adult estimates can skip a new check (FAQ; Reuters).
  3. Age assurance. Self-declared age is explicitly not enough. Certified age verification, including a free EU age-verification app and later the European Digital Identity Wallet, with zero-knowledge yes/no age signals; platforms do not receive identity documents (FAQ).
  4. Safety-by-design for minors across in-scope services: bans on infinite scroll / endless autoplay without real breaks; notifications designed to pull the child back unrelated to their actions; streak / mass-audience reward mechanics; push notifications during sleep hours (Commission wording on the policy page and IP/26/1890; a specific 10 p.m. to 8 a.m. eight-hour window appears in Reuters secondary coverage and is UNKNOWN on the FAQ and press PDF we used). Recommenders for minors must prioritise safety, quality, and mental health over engagement; tracking-based personalisation off by default; feed reset and at least one non-profiled option. Default private accounts; no stranger messaging without pre-approval; no livestream by default for minors.
  5. AI companions and chatbots (FAQ, answering "Are AI chatbots and AI companions covered?"). Yes. Designs that simulate human relationships in ways likely to create emotional dependency are out. By default, companions may not carry a child's earlier conversations into later ones. They must be tested for risks to children before launch and monitored for harm afterwards. Under-13s: only through parental control tools. Built into a platform or game: chatbot may not switch on automatically, may not be pushed at children, and must be easy to turn off. Press IP/26/1890: companions and chatbots must be turned off by default and cannot simulate interpersonal relationships in ways that create emotional dependency. FAQ: AI companions and chatbots cannot be placed on the market until providers demonstrate compliance and have a monitoring mechanism for emerging risks and incidents.
  6. Enforcement tempo and money. Expedited Commission path: preliminary findings within 30 days, final decision targeted within 90 days. Fines can reach 6% of total worldwide annual turnover (FAQ).

What it does not settle

  • Not law yet. Proposal stage. Final text, timelines for application, and any trilogue edits are UNKNOWN until Parliament and Council finish.
  • Specific sleep-hour clock (for example 10 p.m. to 8 a.m.) is UNKNOWN on the Commission FAQ and IP/26/1890; only "sleep hours" / "sleeping hours" appear there.
  • Which exact chatbot products qualify as "AI companions and chatbots" versus productivity assistants, search helpers, or educational tutors is not enumerated as a product list on the policy or FAQ pages. Edge classification remains UNKNOWN here.
  • How "emotional dependency" will be measured in audits or Commission decisions is not operationalised on these primaries.
  • Interaction with the AI Act high-risk and GPAI clocks beyond the FAQ's pointer that companion enforcement builds on AI Act structures is not fully mapped on these pages.
  • National age laws already in force or struck down (Reuters notes France's push after a Constitutional Court strike-down of a national under-15 bill) will be replaced in the Commission's design, but transition mechanics for each Member State are UNKNOWN here.

What to do now

  1. Product counsel for companion / chatbot teams with EU minors in the user base: map current default-on, memory-across-session, and relationship-simulation features against the FAQ's companion rules; assume off-by-default and no cross-session memory for minors until the final text says otherwise.
  2. Age-assurance and account ops: inventory how you know a user is under 13, 13-14, or 15+ today; plan certified verification rather than DOB fields; budget the six-month existing-account check.
  3. VLOP program managers: start the compliance-plan and auditor independence path early; the proposal puts ex-ante proof on you before child contact under the new regime.
  4. Do not treat Reuters or press kits as the statute. Cite the policy page and FAQ until a regulation text is published in the Official Journal.