Dr Simon Hembt is counsel at Fowl & Fowl in Frankfurt, Germany. He advises games firms on IP, AI/tech, and media regulation. He co-edited Fowl & Fowl’s Game Plan 2026 report.
Think about a free-to-play shooter with pay-to-win in-game monetization (aka “golden bullets”), numerous in-game gadgets (akin to skins), voice chat, a user-generated-content (UGC) hub, and an AI companion. All comparatively frequent options, however they symbolize a regulatory puzzle, since each may be topic to a special regulation at nationwide and European Union stage.
The EU AI Act’s guidelines on “deepfakes” and the illustration of real-world places and other people in games have utilized since August 2, and the primary reporting obligations below the Cyber Resilience Act adopted on September 11 – however there’s extra nonetheless to come, with the European Fee saying an extra two landmark tasks.
The EU KIDS Act has proposed guidelines on on-line security that would have an effect on each day log-in bonuses amongst many different issues, whereas the primary draft of the Digital Equity Act (DFA) is probably going to include a number of completely different guidelines that have an effect on in-game worlds. As well as, the EU Client Safety Cooperation Community (CPC) has began a collection of enforcement actions primarily based on its key ideas.
Fowl & Fowl’s worldwide video games group has mapped the authorized developments shaping games, and this text highlights six risks that studios want to pay attention to, and what they will do to keep forward.
The CPC has in-game outlets in its sights
In March 2025, the CPC acted against Swedish studio Star Stable Entertainment, whose recreation Star Secure is standard with kids. The CPC alleged that the sport makes use of, amongst different issues, incentives for teenagers to purchase gadgets, unclear forex pricing, and undisclosed influencer advertising and marketing.
The identical month, the CPC printed its Key Principles on In-Game Virtual Currencies. The essential concept is that shopper regulation covers each buy made with a digital forex purchased with actual cash.
These seven key ideas cowl:
- Clear and clear pricing by exhibiting the real-world cash worth (for instance, in euros).
- Free of charge-obscuring practices (for instance, a number of forex layers).
- No pressured surplus purchases (for instance, gamers shouldn’t be urged to spend extra cash via odd pricing of bundles).
- Clear pre-contractual info.
- The precise of withdrawal to cancel purchases and get refunds for unused digital currencies.
- Honest and comprehensible phrases in plain language.
- The safety of susceptible teams.
For the reason that finish of September, the EU and nationwide authorities have carried out coordinated actions to implement these ideas.
The EU AI Act now enforces transparency
After the backlash over AI outputs recognized by gamers, the difficulty has turn into relatively delicate, however studios now have a authorized obligation round making AI use clear in some instances.
Offering a generative AI system, akin to a text-to-image mannequin, triggers an obligation by the supplier to mark its output in a machine-readable manner and make it detectable as artificially generated or manipulated (Article 50(2) of the EU AI Act). A studio providing gamers its personal AI software for creating UGC would often be thought of because the supplier. This obligation started in August, though the grace interval for programs already in the marketplace runs till December 2, 2026.
Deepfakes created with third-party AI instruments (which may cowl representations of real-world places, individuals, or occasions) may additionally want labelling in some instances. Nevertheless, sure exceptions may see the duty waived, or, in an evidently inventive work, a discover in the credit would possibly suffice.
Article 50(1) of the AI Act requires suppliers of interactive AI programs to ensure gamers know they’re coping with AI, until that’s apparent. These programs may embrace conversational bots supercharged with AI, and the “apparent” exception could trigger explicit complications in games performed by kids, since in the Fee’s view using AI may not be as apparent to kids as it’s to adults.
Earlier than launch, online game suppliers ought to checklist each AI characteristic in every title and work out its potential regulation.
The Digital Companies Act has tightened the foundations for UGC
A video games supplier that shops UGC akin to footage, texts, or designs on its servers will probably be deemed a internet hosting service below the Digital Companies Act (DSA), and making this UGC publicly out there to all gamers is probably going to make the supplier an internet platform.
The DSA gives for a tiered regime with new obligations for every tier (for instance, middleman, internet hosting service, on-line platform, and really giant on-line platform). In August, the Fee designated Roblox as a really giant on-line platform, the class with the strictest duties.
The DSA doesn’t make online game suppliers test each add. Suppliers are usually not answerable for unlawful uploads they aren’t conscious of, so long as they act shortly as soon as they’re. Gamers additionally want a simple manner to report in-game content material, and anybody whose UGC the supplier removes or restricts should get an announcement of causes. AI creation instruments increase the stakes, as a result of gamers can now produce infringing or dangerous content material at scale. A report button alone would possibly now not be sufficient.
For a lot of on-line platform games, nonetheless, Article 28 of the DSA is vital. On-line platforms that minors can entry have to take acceptable and proportionate measures to guarantee a excessive stage of privateness, security, and safety for them: An “18+ clause” buried in the phrases and circumstances won’t take the supplier out of scope. The Fee’s guidelines from July 2025 present what it expects. They aren’t binding, however enforcement our bodies measure compliance towards them.
Your in-game financial system may fall foul of playing laws
For some in-game monetization fashions, an intensive evaluate of potential playing (or ability recreation) laws is an important step in a online game supplier’s governance course of.
There isn’t a harmonised EU playing regulation, so every EU jurisdiction has its personal guidelines for loot packing containers and different “staking-like” in-game choices.
Since 2018, Belgium has handled (paid) loot packing containers as playing. Courts in the Netherlands and Austria have declined to deal with soccer participant packs as playing, as a result of they regarded on the recreation as an entire. German playing regulation assesses every characteristic by itself, so the predominance of probability over ability and a stake and prize which can be value cash are decisive. Whether or not gamers can switch gadgets or money them out typically decides the result.
In a non-binding decision, the European Parliament has known as for a ban on loot packing containers in games doubtless to be accessible to minors, and since June, PEGI charges new games with paid random gadgets at 16 by default. German youth safety regulation has factored interplay risks akin to gambling-like mechanisms into its age scores since 2023. The Court docket of Justice can also be contemplating whether or not app shops will be answerable for providing games with unlawful loot packing containers.
Earlier than embedding loot packing containers or comparable options, online game suppliers ought to test the playing legal guidelines in their goal markets.
The Digital Equity Act will shake-up digital shops
The European Fee plans to publish the primary draft of the DFA on November 11, and a part of the goal is to flip the CPC’s considerations into binding regulation.
Most of the huge subjects lined in the DFA may apply to video games. The Act is probably going to sort out darkish patterns in extra depth, from faux shortage to strain timers. Guidelines on addictive design would possibly handle options constructed to maximise the money and time shoppers spend, together with each day streaks, variable rewards, and push notifications. Loot packing containers, pay-to-win mechanics, and digital currencies may additionally be lined, in explicit the place they aim kids, and exhibiting real-money costs for in-game gadgets is probably going to be regulated. The DFA can also be doubtless to handle personalisation that exploits vulnerabilities, influencer advertising and marketing, and cancellation choices. An overarching subject is the safety of minors.
The DFA is unlikely to apply earlier than 2028, however studios ought to intently monitor the legislative course of.
On the horizon: the KIDS Act
The European Fee proposed the KIDS Act on September 17. This new Act would cowl any online game that gamers can entry, obtain or purchase on-line. By default, the KIDS Act would require games to be child-safe till age assurance reveals a participant is an grownup. A self-declared age wouldn’t meet this requirement.
The KIDS Act asks for necessary parental instruments, and youngsters below 13 may solely play via these instruments. Video games would wish to make sure that no person can use them to lure kids onto dangerous companies elsewhere. UGC platforms would additionally want instruments that allow player-made games comply.
It appears unlikely that the KIDS Act will apply earlier than 2028. Nevertheless, many elements of it are already featured in the Fee’s pointers below Article 28 of the DSA, so parental instruments and child-safe defaults are value contemplating now.
The place to begin?
The present tempo of regulation at each the EU and nationwide stage is excessive, and plenty of video games suppliers complain that this “headache checklist” is getting longer. Fowl & Fowl’s Game Plan 2026 report units out key questions and subsequent steps for a lot of of those risks. Finally, the sooner that online game suppliers construct these guidelines into their designs, the less prices they may face later down the road.