Why we turn to AI systems and why cognitive integrity is at stake

Introduction

AI-mediated technologies^[1] are now part of daily life because they address real human needs. People rely on generative AI chatbots and social media to find and make sense of information, maintain relationships and communities, communicate and create, and increasingly to manage emotional distress.

The challenge many users now face is how to fulfil those needs while preserving their autonomy and agency, and continuing to exercise the cognitive capacities, on which those needs ultimately depend. Public debate has tended to focus on the most visible manifestations of harm: compulsive use and “brain rot”^[2], suicide-related cases^[3], AI-induced psychosis^[4], or claims that an entire generation is becoming addicted to social media^[5]. At the other end sit concerns about a future in which societal systems no longer depend on human participation, and so stop being answerable to it^[6]. These cases and scenarios matter, but they also emerge from the gradual and cumulative ways in which humans interact with AI systems.

The governance challenge is therefore to preserve the benefits these technologies can provide while becoming more attentive to effects that are pervasive, cumulative and unevenly distributed. Recent recommendations from the European Commission’s Special Panel on Child Safety Online mark an important step in this direction^[7]. The Panel recognises both the needs these technologies can help fulfil and the importance of supporting children in learning to use them, rather than relying on access restrictions alone. At the same time, it acknowledges that children are particularly sensitive to certain properties of these systems because key cognitive capacities — including attention, social cognition, emotional regulation and behavioural control — are still developing. In practice, this means that some design features can exploit vulnerabilities that are especially pronounced at particular stages of development.

But the Panel’s mandate is necessarily bounded around children. The vulnerabilities it identifies do not disappear at the age of majority. A governance framework capable of addressing cognitive harm therefore needs to recognise heightened vulnerability where it exists, without treating vulnerability as a category into which only some users fall.

A vocabulary that doesn’t reach

Across political, regulatory, and scientific debates in this space, a proliferation of terms describe what is at stake when people interact with these systems: brain health, brain skills, mental health, mental wellbeing, mental integrity, cognitive liberty, neurorights.

Some protect the neurological substrate, others protect states and outcomes, whether a clinical condition, a state of wellbeing, or a skill outcome, each of which registers only once the processes producing it have run their course. Some others protect the contents of the mind and who may access it, locating the wrong in what ends up in someone’s head — a belief, for example — or whether they consented to the source.

The dominant framing in policy discourse remains mental health. The problem is not the concept but its operationalisation, which proceeds through diagnostic categories such as depression, anxiety, addiction, and psychosis. These extremes are how the harms entered public and political awareness, through headlines and bestselling books. Such operationalisation is convenient because diagnostic criteria provide the threshold conditions, measurable outcomes, and causal claims that regulatory arguments require. But it systematically fails as a governance target in two respects.

First, it locates harm at the point of clinical presentation, after the conditions producing it have operated for months or years. Attentional erosion, emotional dependency, the progressive substitution of autonomous judgement by AI-generated outputs: these cause real harm long before any diagnostic threshold is crossed. A governance framework that waits for clinical diagnosis is reactive by design.

Second, psychiatric conditions are multifactorial. Depression emerges from genetic predisposition, family circumstances, developmental stage, and social and economic environment —all of which can be amplified or triggered when interacting with these technologies. Making pathological outcomes the target allows platform executives to invoke causal complexity most effectively. A mechanism-based target changes what the evidence must show: not whether a platform caused a condition, but whether a specific feature operates on an identified risk pathway in a demonstrable way.

The WHO definition of mental health points the same way. Mental health is defined not as the absence of disorder, but as a state of wellbeing that enables people to cope with the stresses of life, realise their abilities, learn and work well, and contribute to their community^[8]. It exists on a continuum, experienced differently across individuals and circumstances, with clinical conditions as extremes and a wide range of mental states associated with distress or impaired functioning in between. That definition already implies a governance standard calibrated to gradual and uneven effects, attentive to erosion of capacity well before it becomes clinically legible. The problem is that without adequate operationalisation, policy instruments cannot reach there.

What follows from these failures is an attempt to build a governance framework adequate to what the mental health tradition, at its most rigorous, already implies. Such a framework would need to measure effects on capacity and functioning before clinical thresholds are crossed, operate with an evidentiary standard based on contributory mechanisms rather than exclusive causation, and track a continuum rather than a binary. Cognitive integrity, developed in the following section, is proposed as a framework that satisfies those requirements.

Cognitive integrity as normative standard

If the relevant mental health harms are sub-clinical, gradual, and mechanism-specific, the normative standard must operate at the level of the cognitive processes that underpin mental health. Cognitive integrity is proposed here as that standard^[9].

We define cognitive integrity as the capacity of individuals to engage autonomously in the cognitive processes that underpin their functioning — including attention, decision-making, critical thinking, and emotional regulation — and to act in ways that reflect their own goals rather than being steered by external systems. Cognitive integrity does not assume the absence of external influence, which is constitutive of human development. It is premised on preserving the conditions under which influence remains compatible with self-determination. Those conditions require, at a minimum, that influence operates through processes a person can in principle be aware of, evaluate against their own goals, and contest. They require, further, that the influencing system does not exploit structural asymmetries of knowledge and power — specifically, of and over a person’s cognitive vulnerabilities — in ways that bypass deliberation.

“Cognitive” reflects the specificity of the harm pathway through which AI-mediated technologies affect human functioning: attentional capture, substitution of autonomous judgement, dependency formation, among others, operate at the level of cognition before they manifest as mental health outcomes. “Integrity” captures two distinct qualities: capacities that remain the person’s own rather than being degraded, hijacked, or replaced by technologies, and that can be exercised and developed across the lifespan. Cognitive integrity therefore represents the baseline condition from which everything else the WHO definition envisions becomes possible.

Cognitive integrity is exercised through the everyday activities for which people increasingly rely on AI-mediated technologies. The analysis therefore starts with the needs that drive that reliance, and with the cognitive capacities involved in fulfilling them.

The “Five Cs”: needs that drive adoption of AI systems

Human beings increasingly adopt and rely on AI-enabled technologies to fulfil core psychological needs: to comprehend the world, connect and communicate with others, create knowledge, meaning and artefacts, express the self, and cope with life’s adversities. Fulfilling those needs cannot simply be outsourced. This framework protects that engagement and the cognitive capacities it requires. The Five Cs — Comprehend, Connect, Create, Communicate, Cope — map the domains where AI-mediated technologies are more deeply involved in how people exercise these capacities, and where losing autonomy over them carries the greatest cost^[10] [11]. Autonomy is the cross-cutting condition: any of the five needs can be fulfilled to varying degrees of it, along a spectrum that runs from genuine human exercise to AI substitution. Psychological research bears this out: needs fulfilled through externally controlled or substituted means do not produce the same wellbeing, identity coherence, or intrinsic motivation as needs fulfilled through autonomous engagement^[12] [13]. And fulfilling these needs draws on cognitive functions — attention, memory, critical thinking, decision-making, emotional regulation, social cognition, and intrinsic motivation among others — that are themselves subject to influence, capture, and degradation. Like physical capacities, cognitive ones are maintained through use: what is systematically bypassed gradually atrophies^[14]. Cognitive integrity names the condition in which these functions are developed through use, oriented by the person’s own goals, and not subverted or exploited by systems optimised for other ends.

As the figure below shows, the pattern is one of displacement: the need appears to be met, while the cognitive capacities through which it would otherwise be fulfilled are exercised less. AI systems can support these capacities; the concern arises when AI systems instead displace the agency and autonomy^[15] with which they are exercised, either by substituting for them or by steering them toward the system’s objectives rather than the person’s own.

Figure 2. The Five Cs under high and low human autonomy. For the sources, see the extended references section.  

Governance of constitutional rights for cognitive integrity

This ‘Five C’s’ framework reframes the protection of cognitive integrity as a structural governance challenge to regulate the conditions under which cognitive functions — indispensable to fulfil psychological needs — are developed, exercised and protected.

The EU Charter of Fundamental Rights and the UN Convention on the Rights of the Child (UNCRC) provide the constitutional foundation for this governance challenge, even without explicitly naming cognitive integrity (See Table 1 below for a summary of main articles and analysis) .

The Charter provisions on human dignity (Article 1), mental and physical integrity (Article 3), respect for private life (Article 7), protection of personal data (Article 8), freedom of thought (Article 10), freedom of expression (Article 11), and rights of the child (Article 24) collectively ground cognitive integrity.

Article 3 on mental and physical integrity suggests strong limits on practices that deliberately target and degrade cognitive functions for commercial purposes. Article 10 on freedom of thought is underused in existing doctrine but arguably the strongest foundation for protecting epistemic autonomy, since freedom of thought protects not just the holding of opinions but also guards against their illegitimate alteration and supports the conditions under which they are formed^[16]. Article 11 on freedom of expression, which encompasses not only the right to communicate but the right to receive information, grounds protection of the informational conditions for cognitive integrity. Article 24 on children’s rights amplifies all of the above, since children’s capacities are still forming and therefore disproportionately vulnerable to cognitive harms. The UNCRC reinforces this specifically through its provisions on cognitive development, protection from manipulation, and the best interest principle.

Existing case-law has already begun operationalising these provisions in ways that implicitly protect cognitive integrity. The German Federal Constitutional Court’s Volkszählungsurteil (1983) established^[17] the right to informational self-determination, reasoning that individuals who cannot know what information is held about them may adjust their behaviour and refrain from exercising their freedoms. This principle influenced European data protection law and is reflected in Article 8 of the EU Charter and the GDPR’s normative foundations. At the ECtHR, surveillance cases^[18] from Szabó and Vissy v. Hungary to Big Brother Watch v. The United Kingdom recognise that modern technologies can generate detailed profiles of individuals’ private lives, implicitly acknowledging that the conditions under which people form their choices fall within the scope of Article 8 ECHR^[19]. Together, these strands suggest that the core conditions for cognitive integrity are already embedded in European rights frameworks, even where the doctrine has not yet been explicitly articulated.

Constitutional rights then operate at three levels in governance design:

1. They ground legislative and regulatory intervention, establishing that the protection of cognitive integrity is enforcement of fundamental rights, not overreach, which matters when commercial interests are invoked against proposed design restrictions.
2. They guide proportionality and interpretation when operational rules are ambiguous: what counts as manipulative, when is profiling harmful, how should vulnerability be defined. These questions gain legal content when assessed against dignity and mental integrity rather than purely against consumer harm or market distortion.
3. They enable claims where existing frameworks don’t clearly reach: technical compliance with data or competition rules is no guarantee that mental integrity and human dignity remain intact.

This means that operational governance layers —market interventions, data protections, design rules, content moderation— are the instruments through which constitutional rights are implemented and the first place where the gap between constitutional principles and their implementation becomes visible.

Constitutional grounding is necessary but several structural gaps constrain its practical impact.

Doctrine remains underdeveloped: courts have not yet translated principles of dignity and mental integrity into enforceable standards for the harmful impact of AI-enabled systems on cognitive integrity, including cognitive manipulation^[20] and attentional capture, though authoritative signals are emerging. The European Commission’s preliminary findings against TikTok for addictive design in February 2026 represent the first administrative operationalisation of DSA systemic risk obligations in relation to mental health^[21].

The Charter rights most central to cognitive integrity, namely dignity, mental integrity, and freedom of thought, do not directly bind private actors in the way that operational frameworks do; legislative and regulatory translation remains necessary, and that translation is always incomplete and subject to sustained industry pressure.

Even where rights clearly apply, enforcement authorities frequently lack the technical expertise, resources, or political will to act. And when they do, economic interests of tech companies often push back: arguments that cognitive protection stifles innovation or restricts expression must be weighed against rights claims, creating persistent tension between protection and permissiveness.

Conclusion

Constitutional grounding is only the starting point. The practical protection of cognitive integrity depends on how those principles are translated into the governance of AI-mediated systems.

The next layers of the framework examine how business incentives shape what systems are optimised for, how those incentives are translated into practice through data and design choices, and how far existing governance frameworks reach each of those layers.

EU governance of cognitive integrity: An overview of regulatory reach and gaps

Please note: Note. This table provides a summary of the policy analysis across the different governance layers. Please refer to the main text for the complete analysis and to the Governance map for a description of all relevant provisions of these and other instruments.

Acknowledgements

We sincerely thank the following people for reviewing this report and for their invaluable comments and feedback:

• Alejandro Tlaie Boria, AI Policy Advisor at Pour Demain
• Andrea Palumbo, Researcher at Centre for IT & IP Law, KU Leuven
• David de Segovia Vicente, Researcher at Media, Innovation and Communication Technologies, Ghent University
• Mike X Cohen, Neuroscientist and independent educator
• Stefano Palminteri,  Professor of Cognitive Artificial Intelligence, École Normale Supérieure Paris; Research Director at Institut National de la Santé et de la Recherche Médicale