Henna Virkkunen is the European Commission's Executive Vice-President for technological sovereignty, security and democracy. In an interview with the European Newsroom in October, she warned that rapid AI development could grow beyond human control without guardrails and proper evaluation frameworks. She is not arguing that the work should stop. Her point is narrower and harder to argue with: there is still no fast, shared way to check what a newly released model can actually do.
That question sits in the middle of two very different pieces of European policy. One is already enforceable. The other is a proposal that has just started its journey through the institutions.
Rules already in force
Article 50 of the AI Act became applicable on 2 August 2026. In practice it means two things for anyone in Europe using AI products. If you are talking to a chatbot, the chatbot has to make clear it is not a person. If a piece of image, audio or video content was generated or manipulated, it has to be labelled in a format machines can read.
The same date brought a bigger change for the companies behind general-purpose models. The Commission's AI Office received full investigative powers and the ability to fine providers up to €15 million or 3% of global turnover, whichever is higher. The era of voluntary codes of practice without financial consequences ended there.
Not everything arrived at once. Under the EU Digital Omnibus on AI, Regulation (EU) 2026/1744, the compliance deadline for high-risk systems listed in Annex III was pushed back to 2 December 2027. Recruitment tools, credit scoring systems and certain education software fall into that group. Teams that were bracing for an August 2026 deadline now have roughly sixteen more months, but the requirements themselves have not become lighter.
Age brackets in the EU KIDS Act
In September 2026, the Commission presented the EU KIDS Act in Strasbourg. It is the part of the package most parents will notice. The proposal sets three age brackets for social media:
- Under 13: no accounts at all.
- 13 to 15: accounts only when linked to a parent or guardian, a supervised setup rather than a free-standing profile.
- 15 and above: independent accounts allowed, with default privacy settings applied.
The legal logic behind it is a reversal of the usual order. Instead of regulators having to prove that a product harmed a child, platforms would have to demonstrate that their social media, AI chatbots and video games are safe by design for minors. Investigations into suspected non-compliance would have to be completed within 90 days.
Brussels is not starting from nothing. The Commission points to three years of Digital Services Act enforcement as the groundwork for these mechanisms, and to survey data it cites repeatedly: 89% of respondents worry about children being exposed to violent content, 89% about exploitation, and 88% about social media addiction. Only half of children across Europe report feeling safe online.
AI-generated abuse and platform design
Virkkunen named three problems that keep coming back in the Commission's work: algorithm designs built to hold attention, age checks that fail in practice, and illegal sexualised content produced with AI tools. The last one is where the DSA and the AI Act meet. The content is illegal under existing rules, but the volume and the speed of generation have changed what moderation teams are dealing with. For a European parent, the practical question is less about which regulation applies than about whether a report leads to removal and whether the account behind it disappears.
For a wider look at how these rules land in daily use, our magazine covers the practical side of European AI policy.
Expectations for the G7 and G20
The Commission is pursuing international cooperation on AI safety inside the G7 and G20, and Virkkunen has said she expects major AI-developing nations to eventually adopt binding safety rules. That is an expectation, not an agreement. No such framework exists today, and the EU is negotiating from the position of being, so far, the only bloc with a comprehensive law on the books.
What is still only a proposal
The EU KIDS Act is not law. It must go through the European Parliament and the Council, where the age brackets, the 90-day investigation limit and the shift of the burden of proof onto platforms will all be argued over. No final date is set for when the rules would apply, and the text as presented in September can still change.
What applies today is narrower and more concrete: AI systems must disclose themselves, synthetic media must be labelled, providers face fines, and the next fixed date in the calendar is 2 December 2027 for high-risk systems. Everything else is still being written.
Do the age limits in the EU KIDS Act apply right now?
No. The measure was presented by the Commission in September 2026 as a proposal. It needs approval from the European Parliament and EU member states before it can take effect, and the age thresholds may still be amended during those negotiations.
What does the AI Act transparency rule mean for someone editing photos with AI?
Since 2 August 2026, content that has been generated or manipulated in a way that could mislead must carry a machine-readable marking, and people interacting with an AI system must be informed of that. Using AI to retouch a personal photo for a private album is not the same as publishing synthetic media that looks real, and the labelling duty targets the second case.
Are European companies that build AI models already being fined?
The AI Office has held full investigative and penalty powers over general-purpose AI providers since 2 August 2026, with maximum fines of €15 million or 3% of global turnover. Those powers exist; the office has not published a list of penalties comparable to the DSA enforcement record so far.
