The EU AI Act takes effect in stages: GPAI obligations since 02 August 2025, standard obligations from 02 August 2026, high-risk applications in the education context from 02 December 2027. Anyone offering AI experiences for children will be scrutinised first, and without clean provenance, a documented risk assessment and transparent parent flows, products will be off-shelf. A briefing on what changes and what providers should prepare today.

What the GPAI stage from 02 August 2026 brings

Articles 53 ff. of the AI Act bring the GPAI obligations into force: providers of large AI models must produce technical documentation, training-data summaries, copyright compliance and safety evaluations. The duties cascade through the value chain - anyone integrating those models into children's products co-owns responsibility, including logging, escalation paths and blocklists.

For children-facing products, JuSchG requirements and the Digital Services Act stack on top. Together they form a checklist that most engagement-driven companion apps structurally cannot - and will not - meet.

Why children's products get audited first

Market surveillance authorities prioritise especially vulnerable user groups; children explicitly count. The AI Act itself highlights minors in Recital 56 - manipulative design patterns are prohibited, and parental information is mandatory, not optional.

What providers should prepare now

  • AI Act mapping per use case with clear risk classification (prohibited · high · limited · minimal)
  • Parent information and escalation flows documented and visible in the UI
  • Training-data provenance and moderation pipeline verifiable end-to-end
  • Block-lists for minor-specific risks (suicide, eating disorder, companion behaviour) implemented
  • JuSchG risk assessment and DSA notice-and-action pathways in place

Where HillcrownAI plugs in

HillcrownAI delivers the building blocks needed for 2 Aug 2026 as an Infrastructure-as-a-Service: own servers in Germany, own moderation, an in-house CMS and a klicksafe-aligned risk matrix with documented answers per risk category. Anyone building a Kids-AI surface should resolve the make-or-buy question now - and not look at engineering cost alone, but at regulatory cost.

More detail in our German infrastructure architecture, the research base on children's AI literacy and our klicksafe-aligned safety matrix.

This article is not legal advice. It summarises the state of play as of April 2026 from a provider perspective and is aimed at product and compliance leads building a roadmap to the upcoming AI Act stages.