Theodoros Zarkos, MSc, Medical Ethicist - Social Scientist - European Social Policy and
Social Rights; Independent Researcher, Kiato, Greece
Photo credit: maido155,
via Wikimedia Commons
The European Commission’s proposal for an EU KIDS Act, published on
17 September 2026, contains a provision that is easy to misread if it is viewed
in isolation. Article 14 would create specific duties for AI companions and
general conversational chatbots accessible to minors. Yet the proposal does not
begin from an empty legal field. Online platforms, AI systems and the
processing of children’s personal data are already governed by overlapping EU
rules. The legal question is therefore not whether Article 14 “regulates AI for
minors” for the first time, but what kind of legal layer it adds to the Digital
Services Act (DSA), the Commission’s 2025 minors Guidelines, the AI Act and the
GDPR.
Primary text: COM(2026) 681 final - proposed EU KIDS Act
From a horizontal child-safety duty to AI-specific
obligations
The DSA already establishes a broad child-protection baseline.
Article 28(1) requires providers of online platforms accessible to minors to
put in place appropriate and proportionate measures ensuring a high level of
privacy, safety and security for minors on their service. The provision is
deliberately general. It does not attempt to enumerate every risky interface or
emerging technology.
See: Digital
Services Act, Article 28
The Commission’s 2025 Guidelines under Article 28(4) made that
baseline more concrete. For AI features integrated into an online platform
accessible to minors, the Guidelines recommend that the feature should not be
activated automatically, that minors should not be encouraged or enticed to use
it, that it should be easy to turn off, and that providers should assess risks
before making it available. They also recommend visible warnings distinguishing
AI interaction from human interaction. The Guidelines are non-binding; the
Commission nevertheless uses them as a reference point when assessing
compliance with Article 28(1).
See: Commission Guidelines on the protection of minors under
the DSA (2025)
Article 14(2) of the proposed KIDS Act closely tracks part of that
earlier guidance. Where an AI companion or general conversational chatbot is
embedded in a social network, video-sharing service or online game, the host
provider would have to ensure that the feature is not activated automatically
or displayed prominently, that minors are not encouraged to use it, and that
they can opt out easily at any time. In that limited deployment context, the
proposal would move several safeguards from Commission guidance into an
operative legislative rule. In doctrinal terms, this operates largely as
specification of an existing DSA child-safety direction rather than the
creation of an entirely new policy idea.
The new element is relational design itself
Other parts of Article 14 go further than the DSA guidance. Article
14(1)(a) would require providers to avoid design features and system behaviours
that simulate interpersonal relations where they are likely to create emotional
dependencies. It also imports the anti-addictive and excessive-use measures set
out elsewhere in the proposal. The legal object is therefore not merely “harmful
content” or “screen time”; it is a design pathway in which interpersonal
simulation and engagement architecture may shape a minor’s continued use of the
system.
The AI Act does not make this provision redundant. Article 5 of the
AI Act prohibits certain manipulative or deceptive AI practices, and the
exploitation of vulnerabilities including those related to age, when the
statutory conditions concerning behavioural distortion and harm are met.
Article 50, separately, requires transparency where natural persons interact
directly with AI, unless the artificial nature of the interaction is obvious in
the circumstances. These are important rules, but they perform different
functions. Article 14(1)(a) would create a child-specific, ex ante design
obligation directed at relational dependency. It does not depend on first
establishing the full set of conditions required by the AI Act’s
prohibited-practices regime.
See: Artificial
Intelligence Act, Articles 5 and 50
Conceptually, the proposed text does not prohibit anthropomorphism,
emotional tone or perceived closeness as such. Its trigger is narrower:
interpersonal simulation that is likely to create emotional dependency. That
wording leaves a substantial implementation question about how “likely” and
“emotional dependency” will be operationalised in testing, supervision and
enforcement.
What the empirical evidence does—and does not—show
An adolescent–parent experiment published
online in September 2026 compared matched written chatbot replies using either
a relational or a more transparent conversational profile. In 284 dyads,
adolescents rated the relational profile more highly for such immediate
qualities as anthropomorphism, emotional closeness and trust. Preference for
that profile was associated with lower family-relationship quality and higher
reported stress and anxiety. The experiment supports a design-sensitivity
claim: conversational framing can affect immediate perceptions. It does not establish
that chatbot use caused those family or mental-health circumstances, or that
long-term dependence follows (Kim, Xie and Yang, 2026).
The evidentiary boundary is equally
important in regulatory design. Self-selected adolescent narratives of
overreliance and disengagement illuminate possible mechanisms, but cannot
establish their frequency or a causal effect. In addition, children’s evolving
capacities require age-sensitive safeguards rather than an assumption that
maximal parental control is always desirable. An Article 14 assessment should
therefore distinguish experimentally observed responses, plausible longer-term
risks and independently justified rights protections (Namvarpour et al., 2026;
UN Convention on the Rights of the Child, Articles 5 and 12).
Research source: Kim, Xie and Yang (2026)
Conversational memory: overlap with the GDPR, but a
different legal function
Article 14(1)(b) introduces another distinctive rule. By default, a
covered system should not use information or analysis derived from a minor’s
prior interactions in subsequent interactions, subject to the exceptions set
out in the provision. This is more precise than saying that the proposal simply
“bans memory”. It establishes a default configuration concerning the reuse of
prior-interaction information and analysis.
The GDPR is obviously relevant whenever conversational memory
involves personal data. Its principles of lawfulness, fairness and
transparency, purpose limitation and data minimisation continue to apply, as
does Article 25 on data protection by design and by default. Article 8
addresses a child’s consent in relation to information society services where
processing relies on consent, with Member States permitted to set the relevant
age between 13 and 16. None of those provisions, however, is a general
relational-safety rule for conversational systems.
See: General
Data Protection Regulation, Articles 5, 8 and 25
The proposed KIDS Act operates at a different legal level. The GDPR
asks whether and how personal data may lawfully be processed. Article 14(1)(b)
would additionally regulate how a product for minors is configured to carry
relational context from one interaction into the next. In practice, the two
regimes may apply to the same technical feature, but they answer different
legal questions.
Testing and monitoring create an ex ante / ex post cycle
Article 14 also proposes a governance cycle that is more specific
than the horizontal baseline. Before placing a covered system on the market or
putting it into service, providers would have to carry out state-of-the-art
evaluation and testing for risks to minors’ health, safety, fundamental rights
and physical, mental and emotional well-being and development, and implement
appropriate safeguards. After market entry, providers would have to monitor
harms and emerging risks and respond to serious incidents involving minors. The
post-market monitoring duty contains a narrow exception for micro and small
enterprises; it is not a general exemption from Article 14.
For children below 13, Article 14(1)(d) would also require access to
be enabled and controlled through the guardian tools established by Article 20.
That rule should not be confused with GDPR Article 8. One concerns access
architecture and guardian controls under the proposed KIDS Act; the other
concerns the validity of consent as a lawful basis for specified personal-data
processing.
Existing enforcement is not evidence of developmental
efficacy
An earlier enforcement example helps
separate existing obligations from the proposal’s added design duties. In its
decision of 10 April 2025 concerning Replika, the Italian data-protection
authority examined transparency, legal bases and deficient age-assurance
measures for a conversational service. The case shows that regulators can
already intervene in access and data-governance arrangements involving minors
without Article 14. It does not establish that relational chatbots cause
long-term developmental harm or demonstrate that the proposed relational
safeguards will be effective. Article 14 would extend the architecture of
prevention; its practical effects would still require evaluation.
Primary enforcement decision: Italian
Garante, 10 April 2025
What is specification, what is extension, and what remains
mixed?
My recent evidence-to-regulation study approached this layering
question by separating three categories: Specification, where Article 14
largely turns an existing baseline into a more concrete rule; Extension, where
it introduces a materially new child-specific relational safeguard; and Mixed,
where both functions are present. This is an analytical classification, not
language used by the Commission itself.
On that basis, the activation and disengagement controls in Article
14(2) are the clearest case of Specification because they closely translate the
Commission’s 2025 guidance for integrated AI features into proposed operative
obligations. The dependency-oriented design rule, the prior-interaction
default, and the treatment of human-relationship displacement are better
understood as Extensions of the identified baseline. Addictive or compulsive
engagement and trust or emotional closeness have a mixed relationship with
earlier instruments because relevant duties already exist, but Article 14
reorganises them around a specifically relational and child-focused context.
The same study also cautions against treating legal correspondence
as proof of regulatory effectiveness. Its scientific corpus comprised 36 active
sources and 111 mechanism-level extraction rows, alongside 20 normative and
legal sources. Nine studies met a strict criterion for direct minor-specific
empirical evidence. No long-term causal harm study was identified within that
strict subset. The evidence was especially limited for conversational memory as
an isolated causal mechanism, and much of the empirical literature remains
weighted towards adolescents rather than younger children.
Underlying study: Bioethical
Governance of Relational AI for Minors: Evidence-Regulation Alignment in
Article 14 of the Proposed EU KIDS Act
The limits of layering
The proposal’s layered structure also creates boundaries that should
remain visible. Article 14(2) applies its activation, prominence, encouragement
and opt-out controls only when the qualifying AI is deployed as a functionality
of a social network, video-sharing service or online game. The underlying
relational mechanisms can also arise in standalone systems, but those specific
paragraph 2 controls do not follow them there. Other Article 14 duties do apply
more broadly to covered AI companions and general conversational chatbots.
Likewise, trust and emotional closeness are not independently
regulated outcomes. They may be relevant to dependency, transparency, testing
and monitoring, but the proposal does not create a general legal threshold for
when a minor’s trust in a system becomes impermissible. Nor does the proposal
itself establish that a particular safeguard will reduce long-term dependency
or displacement of human relationships. Those are implementation and evidence
questions that arise after the legal duty has been defined.
A relational-safety layer, not a replacement regime
Article 14 is therefore better read as a new relational-safety layer
within an already dense EU digital framework. The DSA continues to supply the
horizontal platform duty; the 2025 Guidelines remain relevant to the
interpretation and practical application of that duty; the AI Act retains its
own thresholds for prohibited manipulation, exploitation and transparency; and
the GDPR continues to govern personal-data processing. The proposed KIDS Act
adds rules that are more directly tied to the architecture of interaction
between minors and conversational AI.
The resulting structure is cumulative rather than substitutive. Some
provisions would harden existing Commission guidance into legislation. Others
would extend the baseline by addressing emotional dependency, prior-interaction
reuse, pre-market testing and post-market monitoring in a child-specific way.
The overlap is real, but so are the differences in legal trigger, scope and
function. If the proposal advances through the ordinary legislative procedure,
those distinctions will matter when lawmakers, providers and regulators decide
what Article 14 requires in practice.
*Prior
related work and methods disclosure. This post
develops a distinct doctrinal analysis drawing on the author’s DOI-registered,
non-peer-reviewed preprint
and related research synthesized in an unpublished monograph. A related, broader
evidence-focused commentary by the author appeared in The European Scientist in
September 2026. Editorial assistance with structure and wording involved an AI
tool; the author is responsible for source verification, interpretation and the
submitted text.
No comments:
Post a Comment