Episode 38: EU KIDS Act Reaches AI Chatbots

EU tables the KIDS Act. The Commission's proposal would bar under-15s from autonomously creating social and video-sharing accounts and, for the first time at EU level, reaches AI chatbots and companion apps. It is still only a proposal — the age-15 floor may move toward the Parliament's age-16 resolution.

FedRAMP OSCAL mandate hits 30 September. Every Rev5 cloud provider — not just 20x pilot participants — must submit new authorization packages in machine-readable form; a grace period to 30 September 2027 covers converting existing authorizations.

NIS2 deadlines land in weeks. Austria's NISG 2026 enters full force 1 October; Poland's essential/important-entity registration closes 3 October; Italy's basic-security milestone follows 31 October. Obligations attach through each Member State's transposition law, so dates differ by country.

China widens police cyber checks. MPS Order No. 176 replaces the 2018 Order No. 151 and, from 1 October, authorises online patrol, remote vulnerability-probing and penetration-testing of non-critical (non-CII) systems.

Ireland opens its first Online Safety Code probe — into X. Coimisiún na Meán is investigating X's age-assurance measures; a breach can draw up to 10% of relevant annual turnover or €20 million, whichever is greater.

FinCEN's Alert FIN-2026-Alert005 ties roughly $12.7 billion in Bank Secrecy Act–reported activity to overseas scam-center investment fraud; examiners will expect the red-flag typologies folded into transaction monitoring and SAR narratives.

Alabama's enforcement clock against OpenAI — the first US clock aimed at what a model did autonomously, on a consumer-protection statute — fell due 14 September.