China’s new rules for AI companions mark a significant milestone in the evolution of AI governance. For the first time, a national regulator has introduced a dedicated framework aimed specifically at AI systems designed to build sustained emotional relationships with users. While the Measures are unique in their scope, they are not emerging in isolation. Across Europe, the United States and other jurisdictions, regulators are increasingly converging around similar expectations for transparency, user protection and responsible AI governance.
Within weeks of China’s Measures taking effect, the EU’s AI Act transparency obligations for interactive AI systems became enforceable, several US states introduced chatbot-specific legislation, and Anthropic published details of how it would watermark Claude’s output to meet EU transparency requirements.
Although different jurisdictions are taking different legislative routes, the direction of travel is remarkably consistent. AI companion regulation is moving quickly, and organisations should be assessing their exposure now.
China’s dedicated framework for AI companions
China became the first country to introduce a dedicated national regulatory framework for AI companions when the Interim Measures for the Administration of Anthropomorphic AI Interaction Services took effect on 15 July 2026. Jointly issued by the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation, the Measures establish a bespoke regulatory regime for systems designed to simulate long-term emotional relationships with users.
The Measures define “anthropomorphic interaction services” as technologies that simulate human personality traits, thinking patterns, and communication styles to provide continuous emotional care, companionship, or support through text, image, audio, or video. Importantly, conventional AI applications—such as workplace assistants, customer service tools, educational systems and research applications—remain outside scope unless they are designed to foster sustained emotional interaction.
For services within scope, the obligations are extensive. Providers must implement safeguards against content that threatens national security, encourages self-harm or deliberately manipulates users into emotional dependency. They must also establish real-time risk detection, governance and ethics review processes, secure development practices, and robust controls around training data and user information.
Two aspects of the Measures are particularly notable:
First, providers must make it clear that users are interacting with AI rather than a human. Beyond an initial disclosure, systems must issue dynamic reminders where user behaviour suggests unhealthy emotional dependence.
Second, the Measures introduce comprehensive protections for children. Users under 14 years require guardian consent, while a mandatory “Minor Mode” must include usage limits, reality reminders, guardian notifications, character restrictions and spending controls. Providers must also submit safety assessments when launching services, introducing anthropomorphic features or reaching specified user thresholds.
Europe and the United States are taking different paths to similar outcomes
China’s approach may be the most prescriptive, but it is far from unique. Across other major jurisdictions, regulators are increasingly pursuing the same policy objectives through different legal mechanisms.
In the European Union, Article 50 of the AI Act became directly enforceable on 2 August 2026. The provision requires AI systems that interact directly with individuals to disclose clearly and prominently that users are communicating with AI unless this is already obvious from the context. Organisations that fail to comply may face fines of up to €15 million or 3% of global annual turnover.
The United States has adopted a more fragmented state-by-state approach, yet the underlying themes are strikingly similar. New York introduced companion-specific disclosure requirements and crisis-response obligations for self-harm risks. California followed with enhanced protections for minors, while also strengthening AI transparency requirements through its broader AI legislation. Other states, including Utah, Maine, Washington, Nebraska and Idaho, have introduced or are implementing comparable measures focused on disclosure and child safety.
Although these frameworks differ in their legal structure, they increasingly reflect a common regulatory consensus that:
- users should know when they are interacting with AI,
- vulnerable individuals deserve additional protection, and
- providers should actively manage foreseeable risks associated with emotionally responsive systems.
A broader international trend
The convergence extends beyond China, the EU and the United States.
Brazil’s proposed AI legislation adopts a risk-based framework similar to the EU’s, while interim measures already impose governance obligations on AI systems, including chatbots. Chile continues to develop risk-based legislation inspired by international models, and several Latin American jurisdictions are relying on existing privacy, consumer protection and cybersecurity laws to address AI-related harms.
Meanwhile, the United Arab Emirates has introduced federal AI governance measures, with both the Abu Dhabi Global Market (ADGM) and Dubai International Financial Centre (DIFC) extending AI-related obligations through updates to their data protection regimes. Although these frameworks remain less prescriptive than China’s dedicated Measures or the EU AI Act, they point towards greater transparency, stronger governance and enhanced protection for vulnerable users.
Industry is already adapting
Regulators are not the only organisations responding to these developments.
Anthropic recently announced technical measures designed to support compliance with the EU AI Act’s transparency requirements. New Claude models embed invisible watermarking within generated text, while supported files carry signed provenance metadata using the industry-standard C2PA framework. Anthropic has also acknowledged the limitations of these technologies, noting that watermarking can indicate AI processing but cannot prove authorship, and that heavy editing or translation may remove embedded markers.
The announcement is significant because it demonstrates how regulatory requirements are already influencing engineering decisions. Transparency is no longer simply a policy principle; it is becoming a product design requirement.
What DPOs and privacy teams should be doing now
For organisations deploying conversational or companion-style AI, the immediate priority should be understanding whether any products fall within the scope of emerging regulatory frameworks. This assessment should focus on how users interact with the system rather than how the product is marketed. A customer support chatbot that evolves into providing sustained emotional reassurance may attract regulatory scrutiny even if it was never intended to function as an AI companion.
Where products are within scope, organisations should prioritise three areas.
- Design meaningful AI disclosures – transparency notices should be clear, prominent and repeated throughout ongoing interactions, where appropriate, and not hidden within privacy notices or terms of service.
- Build child safety into product development – age assurance, parental controls and appropriate safeguards for younger users are becoming consistent regulatory expectations across multiple jurisdictions.
- Strengthen supplier due diligence and regulatory monitoring – organisations should understand how foundation model providers implement transparency measures such as watermarking or provenance metadata, while maintaining an active horizon-scanning function to track new AI-specific obligations as they emerge.
Looking ahead
The regulatory landscape for AI companions is evolving rapidly, but its trajectory is becoming increasingly clear. Whether through dedicated legislation, transparency obligations or sector-specific guidance, regulators across major jurisdictions are converging around a common set of expectations: users should know when they are engaging with AI, vulnerable individuals require additional protection, and organisations must demonstrate effective governance over emotionally responsive systems.
HewardMills advises organisations on AI governance, data protection and regulatory horizon scanning across multiple jurisdictions, helping privacy teams translate emerging regulatory developments into practical, risk-based compliance programmes. If your organisation is developing or deploying AI systems and you need help understanding how emerging requirements may affect your products, people or processes, speak to our team to assess your current AI governance and compliance readiness.
