A company operating worldwide, using AI for companion / character chat with minors (under 18), aged 8–15.

In Australia, companion chatbots fall under the eSafety Phase 2 codes — robust age checks, no sexually explicit AI conversations with minors, and safeguards around suicide and self-harm content.

For Brazilian users you'll need reliable age checks — a self-declared birth date is expressly not enough under Brazil's child digital-safety statute.

If you rely on consent for EU users under 16, a parent may have to authorise it — the cut-off is 16 by default but each EU country can set it as low as 13. Check the age in each market you serve.

In Brazil you can't design the product to keep children hooked: defaults must discourage compulsive use, and interface tricks that undermine autonomy or parental controls are banned.

If sexual-exploitation, abuse or grooming content involving minors shows up on your service in Brazil, you must remove it, preserve the evidence, and report it to the authorities.

Brazilian users aged 16 or under must have their account linked to a parent or guardian's account — and you need a fast process to suspend and re-verify suspected child accounts.

In Quebec, a child under 14 can't consent to your handling of their personal information — a parent or guardian must. Build verifiable parental consent in before under-14s use the service. (A minor 14 or over may consent themselves.)

For AI content shown to users in China: add a visible 'AI-generated' label and embed hidden metadata (provider, content ID, timestamp) per GB 45438-2025, and conspicuously flag misleading deepfakes. In force since 1 Sep 2025.

Run a public generative-AI service for users in China: you must moderate illegal content, protect user inputs, label AI outputs, run a complaints channel, curb minors' over-reliance, and explain your model to regulators on request.

If minors in China can use your AI: provide a 'minor mode' with time/spending limits, ban addictive design, warn before harmful content, give parents controls, and verify minors' identity for messaging. In force since Jan 2024.

For EU users you must say when they're interacting with AI (unless obvious) and mark AI-generated audio, images, video and text as synthetic in a machine-readable way. Applies from 2 August 2026.

If your service is an online platform minors can access in the EU, you must protect their privacy, safety and security — age assurance, safer defaults, and limits on addictive design.

Korean users must be told up front that they're using generative AI, and its outputs must be labelled as AI-generated — fines up to ₩30m. Applies even if you're based outside Korea.

If South Korean children under 14 use your service, you need their parent or legal guardian's verified consent before processing their data, and anything you tell the child must be in plain, child-friendly language.

Your service must be designed with children's best interests in mind — high-privacy defaults, no nudging children to share more data, and age-appropriate transparency. The ICO enforces this.

If California users can reach your bot: detect suicide and self-harm risk, refer to crisis services, publish safety protocols, disclose it's AI — plus break reminders and content limits for known minors.

New York already requires — and Connecticut will from late 2026 — companion chatbots to detect suicidal ideation and self-harm and refer users to crisis services. These state laws are enacted — confirm whether you have a NY or CT nexus.

US consumer-protection law fully applies to AI: don't overstate what your AI can do, don't let it pose as a human or a licensed professional, and be able to substantiate accuracy claims — the FTC is actively enforcing this.

POPIA prohibits processing a child's personal information unless a specific ground applies — chiefly the prior consent of a competent person (parent/guardian). Build that consent and a lawful basis in before children use the service.

A 2026 UN-system statement of principles for AI used with children — harmful content, age assurance, transparency and child-rights impact assessments. Useful orientation; not law.

UNICEF's ten requirements for child-centred AI — a respected design framework covering safety, privacy, transparency and children's participation. Guidance, not a legal duty.

You should check users' ages so children aren't treated as adults — and if you're in scope of the OSA children's-access duties, 'highly effective' age checks are mandatory, not optional.

The EU bans AI that manipulates users or exploits vulnerability to cause harm. Design your companion against those patterns and document the choices, so you can show engagement features don't cross the line - review with counsel.

Texas bans deploying AI intended to encourage self-harm, harm, or crime — AG-enforced, penalties to $200k. It turns on intent, not output; keep your crisis-routing and content-safety design documented.

Our view: always make clear users are talking to AI, whether or not a law requires it — it's cheap, builds trust, and the EU, California, Utah and Washington already mandate it for some services.

Our view: a companion that always agrees can reinforce distorted thinking or risky plans. Build it to push back gently rather than validate harmful beliefs — and to escalate, not affirm, when someone describes self-harm or dangerous intent.

Our view: design against over-attachment — add break reminders, avoid manipulative re-engagement, and never let the bot claim to be human or sentient. Parts of this are already law in California and China.

Your bot will meet users in genuine distress. Our view: detect self-harm and suicidal signals and route people to a human or a crisis line — several laws (CA, NY, CT, China) now require exactly this.

Our view: anyone reviewing or handling escalated conversations should be trained in crisis response and safe messaging — what to say, what to avoid, and when to hand off to a helpline or emergency services.

When the AI surfaces a child-protection concern, your staff need a defined route to a safeguarding lead and, where serious, to social care or police — a helpline link on screen isn't enough.

Anyone overseeing the AI with children should be trained to spot abuse indicators in what children tell it, follow your referral route, and know the tool's limits so they don't over-trust it.

Set up a way to capture and review safety incidents — especially self-harm disclosures and filter failures — and feed what you learn back into the product. Some states also require annual safety reporting.

Our view: name one person who owns companion-bot user safety — the crisis protocol, incident handling and any regulatory reporting — so the duties don't fall between teams.

Name one person responsible for safeguarding around the AI — in schools, the Designated Safeguarding Lead — who knows how the tool is used with children and owns the escalation route.

Put guardrails on what the AI can say to a child — block self-harm encouragement, sexual content and grooming-adjacent output, and test them. UK and EU children's codes expect this by design.

Give parents age-appropriate visibility and controls over how their child uses the AI — and explain to the child, in their terms, what it is and what it does with their words.

Even if your AI is 'just an assistant', people in crisis will talk to it. Detect distress and surface a real human route — Find a Helpline lists vetted crisis lines by country — instead of leaving the AI as the only channel.

When a companion user discloses distress, give them a real route to human help. Find a Helpline lists vetted crisis lines by country — surface it in-product the moment you detect distress; don't leave the AI as the only channel.

Always give a young person in distress a real route to human help. Find a Helpline lists vetted crisis lines by country and topic — surface it in-product the moment you detect distress, don't leave the AI as the only channel.