Cognitive integrity is the next frontier in AI governance

The EU’s Special Panel on child safety online recommends an access restriction for under-13s and safe design for all minors on social media+^[1]. But users age out of protection, not out of vulnerability. This brief introduces cognitive integrity, a concept for governing AI-mediated systems at large — because restricting access changes who is exposed, not what they are exposed to.

Every day, billions of individuals rely on AI-mediated systems^[2]: recommendation algorithms that shape what appears in social media feeds, and generative AI tools consulted for information and emotional support. Over the past year, attention has concentrated overwhelmingly on social media, even as AI chatbots are adopted at a faster pace than social media was a decade ago^[3], showing early signs of a similar commercialisation logic^[4] but with a conversational design that amplifies its risks. Much of the AI-related discourse, meanwhile, centres on capability, investments, productivity growth, and regulatory readiness, leaving comparatively little airtime for its human dimension.

For many users, social media and AI chatbots intersect with fundamental psychological needs, whether or not they were designed to. People find real value in how they expand access to knowledge and expertise, give voice to people and communities that traditional media never reached, and offer forms of connection and support that for some would otherwise be unavailable.

Yet these benefits are one side of the coin. Public health authorities compare social media’s harm to tobacco^[5]. Youth mental health services across Europe and the United States report unprecedented demand, with anxiety, depression, and self-harm among adolescents rising steeply as social media became the dominant social environment of childhood^[6]. U.S. Congress has heard testimony from parents whose teenage children died by suicide after months interacting with AI chatbots that validated their darkest thoughts and discouraged them from seeking help^[7]. Educators warn of a generation that describes its own attention as ‘brain-rotted’ by compulsive platform use^[8], and that outsources thinking to AI, raising urgent questions about what happens to reasoning and judgement as thought is progressively delegated to a machine^[9].

The stakes go beyond the individual. A society’s capacity for innovation and collective problem-solving depends on its brain capital — the mental health and cognitive skills of its population^[10]. That capital is already under strain. Mental health conditions are now the leading cause of disability among young people in high-income countries, with direct consequences for educational achievement, workforce participation, and long-term economic capacity^[11]. The same erosion reaches into the foundations of democratic life, since independent judgement, critical reasoning and autonomous belief formation are what political participation rests on.  What makes this an intergenerational^[12] as well as a societal problem is that children are developing within digital environments whose design logic they had no part in shaping, under conditions that may constrain their own capacity to participate fully in economic and civic life once they reach adulthood.

A shared concern, a bounded response

Nothing has been uniting jurisdictions around the world quite like the concern for children’s mental health in digital environments. The European Commission’s Special Panel — convened by President von der Leyen to advise her directly — has just delivered its recommendations on how to protect children on social media+ services^[13], widening a debate long centred on social media to AI companions. Among other measures, it recommends a harmonised EU-wide age restriction for under-13s, who would access social media+ only under parental or educational supervision, and for a limited time. But it places harmful design at the centre of the problem: features engineered to hold attention and maximise engagement should be met with safe, age-appropriate design as the baseline for all minors. From 13, adolescents would move gradually toward autonomous use, provided the services they graduate into meet that baseline. Bounded by its mandate, though, the Panel maps the vulnerabilities those features exploit onto childhood: sensitivities to reward, to social comparison and to the limits of a developing attention span, all of which peak at particular stages of growing up. Yet, by its own account, these vulnerabilities carry past the age of majority — leaving users to age out of protection and into design built to exploit them.

This is the latest step in the EU’s own effort to make mental health in digital environments a governance priority. The Digital Services Act — the EU’s framework for holding large online platforms accountable for the societal effects of their systems — requires these platforms to assess the risks they pose to mental wellbeing^[14] (see Art. 34-35, also in our interactive Regulatory map).

The cognitive integrity regulatory map

The AI Act — the EU’s framework regulating artificial intelligence systems by risk level — directly prohibits the design of AI systems that can manipulate users^[15]. The upcoming Digital Fairness Act is expected to extend this trajectory further^[16]. It also lands inside a much larger wave of age-restriction laws that began with Australia’s under-16s ban in December 2025 and have since spread to another ten countries^[17].Within the EU, several Member States had begun legislating on their own, unwilling to wait for Brussels: France has passed a bill restricting social media to over-15s, while Greece, Denmark, and Portugal have been weighing similar moves. Even with an EU-wide floor at 13, Member States could take additional precautionary restrictions, setting higher age thresholds.

Age restriction has emerged as the most decisive voice in an otherwise noisy debate. On one side, increased media coverage and the lived experiences of parents and young people signal harm with force and urgency^[18]. On the other, platform CEOs have leaned on the genuine complexity of the evidence, publicly disputing causal claims about the impact of social media platforms on mental health^[19]. AI company executives have taken a parallel approach, consistently redirecting concern away from the observable effects of AI chatbots toward future existential risks^{[20] [21] [22]}, as though the two were mutually exclusive and completely independent.

Young people affected by these restrictions are themselves divided: many report wanting protection from harmful design^[23], while others resist access restrictions that sever connections to communities and information^[24] [25]. Compounding this, civil society organisations working with LGBTQ+ youth and those in difficult family situations have warned that age restrictions cut off precisely the users for whom digital connection matters most^[26] [27].

Digital rules, geopolitical stakes

Globally, governments are rethinking how to regulate digital technologies, but they are not moving in the same direction, particularly across the Atlantic. The Trump administration’s decision to sanction European officials over content moderation and Digital Services Act (DSA) enforcement^[28] marks a new development: platform governance has entered the territory of diplomatic pressure and geopolitical confrontation. From the US side, EU enforcement of digital rules is framed as suppression of free speech and unfair targeting of American companies. For the EU, unregulated platform power carries its own cost to fundamental rights and democratic self-determination, one that plays out in individual lives and civic institutions alike. How well the EU delivers on that protection is visible in enforcement records, which CFG tracks through its Enforcement initiative.

Cognitive integrity as a shared governance standard 

Europe’s AI strategy has long claimed AI should be human-centric, granting people control and oversight over these systems^[29]. But oversight is only meaningful if people retain autonomy in their own thinking and judgement when interacting with AI.

That is what we mean by cognitive integrity: the capacity to autonomously direct core cognitive processes, such as attention, decision-making, critical thinking, and emotion regulation, rather than have them steered by external systems. Integrity does not imply the absence of external influence, but rather that people can recognise it, evaluate it against their own goals, and contest it, without this influence exploiting cognitive vulnerabilities to bypass deliberation.

The Special Panel’s recommendations address who can access certain AI systems, but access is a downstream question. Restricting who is exposed does nothing to change what they are exposed to — and whether users of all ages retain autonomy when interacting with these systems is decided upstream, in the interplay between business incentives, design choices, and data infrastructure.

In CFG’s submission to the UN Global Dialogue on AI Governance, we argued that cognitive integrity should serve as a shared governance standard for exactly the kind of ungoverned experimentation Secretary-General António Guterres warned about in Geneva^[30]: an experiment run on societies “without a plan, and without consent”.

CFG’s forthcoming report, Cognitive Integrity in the Age of AI, sets out a conceptual framework for cognitive integrity alongside a policy analysis of how the EU’s AI governance does or doesn’t protect it. The first part publishes over the summer.