AI-Connected Toys for the EU and UK: A Product Safety and Evidence Review Guide

Who this is for: Brands, product teams, supply-chain staff and marketplace operators selling toys with microphones, cameras, wireless connectivity, voice interaction or cloud services into the EU, Great Britain or Northern Ireland.

Bottom line: “AI toy” is not a single conformity route, and there is no universal “CE certificate” covering toy safety, radio, chemicals, data protection and listing claims. Start with the market, the toy classification, the hardware functions and the connected service. Then link every conclusion to the same model, materials, software version and customer-facing claim. This is an evidence-review framework; it does not promise CE marking, UKCA marking, marketplace approval or any regulatory outcome.

1. Separate the markets and define the product

The EU, Great Britain (GB) and Northern Ireland (NI) should not be treated as one “EU/UK” route. The current EU toy-safety framework is still based on Directive 2009/48/EC. Regulation (EU) 2025/2509 has been adopted, but its main application date is 1 August 2030, when it replaces the Directive and introduces, among other measures, a digital product passport for toys. Do not describe the future Regulation, a proposal or a draft standard as a requirement that already applies in 2026.

GB uses the Toys (Safety) Regulations 2011. Current GOV.UK guidance says recognition of products meeting EU requirements, including CE marking, has been extended in GB; the business must still assess whether CE, UKCA or both are appropriate for its product and conformity route. NI has separate guidance and must not be inferred from the GB position. Toy scope generally turns on whether a product is designed or intended for play by children under 14, but age positioning, presentation, functions and exclusions must be checked for each product.

Market	Start with	Do not write
EU/EEA	Toy safety, applicable electrical/radio/chemical rules, manufacturer technical documentation and the DoC; review connected services separately for data protection.	“A test report means the product is EU certified.”
GB	Toys (Safety) Regulations 2011, the UK DoC and technical file, marking, warnings, and manufacturer/importer details.	“UKCA is always the only acceptable mark” or “Amazon is the compliance operator.”
NI	Check the EU rules applying in NI and the Windsor Framework route, including CE, CE UKNI where relevant, and economic-operator information.	“The GB route can be copied into NI.”

2. Let the functions drive the evidence matrix

The matrix below is a starting point, not an automatic applicability list. Each row should point back to the same model, hardware version, software version and market claim. A change in a feature or material can change the affected evidence.

Product feature	Questions to ask	Evidence to retain
Toy and age positioning	Is the product designed or marketed for children? Do the age claim, warnings and foreseeable misuse align?	Product definition, age rationale, risk assessment, warnings, instructions and model photos.
Battery, electronics or motors	What are the power, accessible-part, temperature, charging, fault and EMC risks? Which rules or standards actually apply?	Circuit diagram, BOM, risk assessment, applicable standard versions, test reports and a DoC that does not turn a partial report into a “full compliance” conclusion.
Wi-Fi, Bluetooth or cellular radio	Is the toy radio equipment? Do the bands, power, antenna, software limits and target market match?	Radio-module data, firmware version, radio/EMC assessment, band and power records, and the EU RED or UK radio-equipment applicability conclusion.
Microphone, camera or cloud service	Whose data is collected, through which device, shared with whom, kept for how long, and used for training or profiling?	Data-flow map, controller/processor roles, privacy information, parental controls, deletion process, supplier terms and DPIA decision.
Generative or conversational AI	Does the system interact directly with people? Does it evaluate learners, allocate educational opportunities or act as a safety component of a regulated product?	AI function description, user-interface notice, human oversight and classification record. Do not call every “educational”, child-facing or large-model product high-risk by default.

3. Review chemicals and materials by material, contact and age

Do not reuse an enclosure report for the whole toy. Build a material register covering the enclosure, soft parts, coatings, inks, adhesives, textiles, cables, batteries and packaging. Record whether each part is accessible, lickable, chewable or likely to detach, and connect it to the intended age. Then identify the applicable EU toy-safety requirements, REACH restrictions, UK rules and current market standards.

For every report, check that the sample came from the current production material; the model, colour, formulation and supplier match the product; the method and limit fit the material category; and updates to the law or standard have been assessed. Do not publish a universal testing panel or a single PFAS threshold without the specific legal provision, material category, test scope and market that support it.

4. Separate children’s data protection from AI risk classification

The ICO’s Children’s Code treats connected toys as an important scenario. Where a toy collects and transmits personal data over a network, the service should provide clear information at purchase, setup and use, avoid passive collection, and make it clear to the child or parent when data is being collected. A product that processes data only on the device and does not transmit personal data to a service provider may require a different analysis.

A DPIA is a risk-based assessment, not one universal form that every AI toy automatically “must submit”. Direct-to-child online services, profiling, automated decision-making, persistent listening, location data or biometric identification can increase risk. Screen the processing before launch and record the decision, controller, data-minimisation measures and deletion method. A voice recording is not automatically biometric data; the special-category analysis depends on whether it is processed for the unique identification of a natural person.

Article 50 of the EU AI Act applies from 2 August 2026. For AI systems intended to interact directly with natural persons, the provider must ensure that people are informed that they are interacting with AI unless that is obvious in context. For a child-facing conversational toy, a clear first-interaction notice is a sensible control. High-risk classification is separate: check Article 6 and Annex III against the actual purpose, such as learner evaluation, admission or allocation in education or vocational training, or use as a safety component of a product covered by Union harmonisation legislation. “Children’s educational toy” alone is not enough.

5. Make the page, label and file refer to the same model

1. Create a model master record: manufacturer, model, batch, colour, hardware, firmware, app version and ASIN.
2. Compare the product, packaging, instructions, warnings, age range, radio functions and listing claims. “AI education”, “protects children’s privacy” and “EU certified” each need supporting evidence; a marketing phrase must not enlarge a test report’s conclusion.
3. For EU, GB and NI, separately check manufacturer/importer/authorised-representative or responsible-party information, marking placement, language and access to the DoC and technical documentation. A platform upload field is not a legal document.
4. Keep change records for materials, firmware, cloud models and privacy notices. For each change, assess whether the safety file, test report, data flow or listing statement is affected.

6. A practical SKU evidence register

SKU/model | target market (EU, GB, NI) | toy scope and age rationale | risk assessment | material and chemical evidence | electrical/EMC/radio applicability | software and firmware version | data flow and suppliers | DPIA decision | Article 50 interaction notice | DoC and technical-file location | manufacturer/importer/representative details | warnings and instructions | listing-claim basis | latest change and review date.