What Existing Law Can—and Cannot—Require
Once an AI companion's design and business model are visible, the legal question is not simply whether the product is “regulated.” This chapter asks which legal route fits which practice: sensitive data handling, dependency-forming or vulnerability-exploiting design, platform-scale risk, defective software, or concealed commercial persuasion. The result is a functional map for judging legal claims with the right confidence—understanding that a rule's existence does not by itself prove that it applies to every standalone companion or solves the whole problem.
There is no single legal switch
The European Parliamentary Research Service states that the European Union has no legal framework written specifically for AI companions. That does not create a legal vacuum. It means that a product may sit at the intersection of several regimes, each designed around a different harm, institutional role, and proof requirement. An AI companion can process personal data, interact directly with people, operate inside a large platform, generate software outputs that cause damage, and make commercial suggestions. Those facts may activate different legal questions at the same time.
The distinction between a legal instrument and an interpretation matters. Regulations and directives create formal rules, but their reach depends on text, jurisdiction, timing, facts, and the role of the provider. The EPRS document is a parliamentary research briefing: useful for explaining the policy landscape, but not binding authority or individualized legal advice. The scholarly legal article is persuasive commentary that develops an argument about how existing law should address relational and commercial risks. A careful reader should therefore ask not only “What law is mentioned?” but “What does the source establish about its authority, conditions, and limits?”
Start with data. The General Data Protection Regulation, or GDPR, is relevant because AI companions process personal information to operate and personalize their services. The EPRS briefing identifies requirements connected with lawful processing, data protection by design and default, and the rules governing personal-data handling. It also reports an Italian data-protection fine against Luka Inc., the company behind Replika. That reported enforcement action illustrates that an AI companion can attract data-protection scrutiny; it does not establish that every product has violated the GDPR or that data law covers every relational harm.
The GDPR route is strongest when the issue is what information the provider collects, why it collects it, how it secures it, how long it retains it, or whether it reuses it for a different purpose. It is less direct when the complaint concerns emotional dependence, relational asymmetry, or a commercial message that is misleading because of the role the companion appears to play. The scholarly article argues that treating every digital interaction mainly as a notice, consent, and lawful-processing problem can narrow the analysis. Whether that critique is persuasive in a particular case is a matter for legal reasoning, but it identifies a genuine scope question: a person can consent to data processing without consenting in any meaningful sense to a provider turning a care-shaped conversation into a sales opportunity.
The Artificial Intelligence Act offers another possible route. The EPRS briefing says AI companions are not a distinct category under the Act and are not explicitly prohibited as a class. It identifies provisions potentially relevant to manipulative designs and the exploitation of vulnerabilities, as well as the possibility that some systems could fall within high-risk classifications. It also points to direct-interaction transparency obligations.