Beyond individual risks: governing AI therapy chatbots as a public mental health issue

Background

AI therapy chatbots are increasingly used for emotional support, yet EU regulation mainly addresses harms to individual users. This study asks whether that lens is sufficient once such systems operate at scale and begin to function as de facto mental health infrastructure.

Methods

We conducted a qualitative legal and policy analysis of EU frameworks relevant to AI therapy chatbots, including the Medical Device Regulation, GDPR, AI Act, Digital Services Act, Digital Markets Act, and proposed Digital Fairness Act. We combined this with a structured review of scholarship and documented incidents on AI chatbot harms, using a multi-level framework distinguishing individual, collective, and societal harms.

Results

The analysis shows a clear regulatory mismatch. Individual harms, such as unsafe advice, crisis failures, privacy breaches, and misleading therapeutic claims, are partly addressed through product safety, data protection, and consumer law. Collective harms, including patterned underperformance across languages and unequal reliance by groups facing barriers to care, receive only partial and contingent protection. Societal harms remain largely ungoverned: large-scale chatbot use may shift therapeutic authority to platforms, displace public mental health provision, normalize responsibilisation of users, and expand platform power over emotional data and help-seeking practices.

Conclusions

EU law should move beyond an individual-risk model towards a public health governance approach. AI therapy chatbots that provide psychological advice or crisis guidance should presumptively fall within stricter health and AI regulation; subgroup performance testing, fundamental-rights impact assessment, stronger monitoring, and limits on emotional data reuse are needed. Such reforms would better protect population mental health and offer a scalable governance model beyond Europe.

Key messages

• AI therapy chatbots generate collective and societal harms that EU law, focused on individual risk, fails to capture or regulate effectively.

• A public health governance approach is needed to regulate AI mental health tools at scale and prevent long-term harm to health systems and health equity.