EU Kids Act draft puts your chatbot in scope

The European Commission presents the EU Kids Act on Thursday, and the draft that leaked ahead of it does something most operators have not priced in: it puts AI chatbots and companions in scope alongside social media and video-sharing platforms. If you run a conversational assistant that European consumers can reach, this is your regulation too — not somebody else's Big Tech problem.

What actually happened

Commission President Ursula von der Leyen and tech chief Henna Virkkunen present the proposal on September 17, with von der Leyen having previewed it in her State of the Union address. Reuters and Euronews both reported the leaked draft this week.

The structure is a set of age tiers rather than one ban. Under-3s get nothing. Children roughly 3 to 12 get child-appropriate services under adult supervision. 13- and 14-year-olds get restricted introductory accounts with limited features and parental controls. Independent accounts start at 15.

The scope is the part to read carefully. The draft covers AI-powered chatbots and companions, described as virtual tools that can offer mental-health and personal-development advice to minors. Reuters reports online games are covered too, with age verification required before a download.

On verification: social media and video-sharing platforms must verify age when a user opens a new account. Existing accounts get proportionate verification based on factors like how long the account has been active. The Commission expects an EU-wide age-verification app to be available across the bloc, with national solutions as an alternative. The draft also pushes the burden of proof onto companies — platforms judged systemically risky would need Commission sign-off before launching features that affect children.

This is a proposal, not law. It still has to survive Parliament and the Council. Treat the timeline as long and the direction as settled.

Why the EU Kids Act matters for your business

"We don't serve minors" is not a control. It is a sentence in your terms of service. The draft's whole thrust is that platforms must demonstrate compliance, not assert it. If your support bot, booking assistant or product-recommendation chat is reachable by anyone with a browser in the EU, "our users are adults" is an assumption you cannot currently evidence.

Age verification is an integration, and integrations take quarters. The Commission is pointing at an EU-level verification app plus national schemes. That means a third-party identity call in your signup flow, a stored assurance signal, and a decision about what happens when verification fails or is unavailable. None of that is hard. All of it is work you would rather not discover during an enforcement letter.

Scope creep is the real risk for small teams. The draft's chatbot language turns on advice-like behaviour — mental health, personal development. Plenty of assistants drift there without anyone deciding they should. A wellness brand's support bot answering "I'm stressed about my order" is one prompt away from territory it was never designed for. Write the refusal behaviour now, and log it.

Build the age signal where you can reuse it. If verification is coming, capture the result as a first-class attribute in your own data model — not buried in a vendor's session. Rules will change and vendors will change; the attribute should outlive both.

Sources: Euronews, Reuters via Rappler.