On 12 December 2025 the European Union published the Toy Safety Regulation (EU) 2025/2509 in its Official Journal, replacing the Toy Safety Directive 2009/48/EC that had been in use for well over a decade. The regulation entered into force on 1 January 2026, yet it only starts applying on 1 August 2030, after a four-and-a-half-year transition. That sounds like plenty of runway. For brands building AI toys, it probably is not.
Digital Toys Enter Toy Law for the First Time
The old directive was built around physical and chemical risk. The new regulation brings digital toys into scope and requires an assessment of the risks they pose to children's mental health and cognitive development. The classification matters more than the wording: an AI toy containing an AI system that needs third-party assessment falls into the high-risk lane, and connected toys with social interaction or location tracking also require third-party conformity assessment. Manufacturers must additionally assess how a digital toy affects children's mental health and data privacy.
That path does not stop at toy law. In the UK government's 2026 reading, a connected toy may fall under the EU AI Act and the Cyber Resilience Act at the same time. The AI Act prohibits certain systems outright, an AI toy that encourages children toward risky behaviour being the example given, while others must meet high-risk rules. The Cyber Resilience Act adds technical, vulnerability reporting and conformity duties for connected products. A single AI toy can therefore span three regulations, even though the toy regulation itself says fairly little about AI or cybersecurity.
Chemistry is tightening too, and worth noting alongside: the regulation bans intentional use of PFAS, prohibits the most dangerous bisphenols, and bars allergenic fragrances from toys for children under 36 months and from toys designed to go in the mouth.
The Real Hurdle Is the Digital Product Passport
The new rules replace the declaration of conformity with a digital product passport. It lives on a data carrier, typically a QR code, affixed to the toy or its label, and consumers can open it without downloading an app, registering or entering a password. It carries the CE marking, the customs commodity code, compliance information and how to contact the manufacturer with a complaint. Manufacturers must upload the data to an EU digital registry that is itself still under construction.
The timeline runs roughly like this: published in December 2025, in force from January 2026, delegated acts setting out the registry, data field formats and customs interoperability expected between 2026 and 2028, and mandatory application from 1 August 2030. Online marketplaces are pulled in as well: platforms must display the seller's CE marking, safety warnings and a link to the digital product passport, and non-compliant toys count as illegal content under the Digital Services Act.
Three things are worth starting on now. First, manage the legal moment of placing on the market: stock already shipped by the manufacturer to wholesalers or retailers before 1 August 2030 may keep selling until it runs out, so shipping a day late puts you in a different compliance state. Second, prepare the third-party assessment material for the AI portion early, since it usually takes longer than chemical testing. Third, wire data fields and batch traceability into the production line, because a digital product passport is not a QR code stuck on at the end. The UK is also consulting on its own toy rules in 2026 and still recognises CE marking, so plan separate compliance paths for Europe and Britain.
© SWPO. All rights reserved.