Dr Simon Hembt is counsel at Hen & Hen in Frankfurt, Germany. He advises video games firms on IP, AI/tech, and media regulation. He co-edited Hen & Hen’s Game Plan 2026 report.
Think about a free-to-play shooter with pay-to-win in-game monetization (aka “golden bullets”), numerous in-game gadgets (similar to skins), voice chat, a user-generated-content (UGC) hub, and an AI companion. All comparatively widespread options, however they signify a regulatory puzzle, since every one could be topic to a special regulation at nationwide and European Union stage.
The EU AI Act’s guidelines on “deepfakes” and the representation of real-world locations and people in games have utilized since August 2, and the primary reporting obligations underneath the Cyber Resilience Act adopted on September 11 – however there may be extra nonetheless to return, with the European Fee asserting an additional two landmark tasks.
The EU KIDS Act has proposed guidelines on on-line security that could affect daily log-in bonuses among many other things, whereas the primary draft of the Digital Equity Act (DFA) is prone to include a number of completely different guidelines that have an effect on in-game worlds. As well as, the EU Client Safety Cooperation Community (CPC) has began a series of enforcement actions based on its key principles.
Hen & Hen’s worldwide video video games group has mapped the authorized developments shaping video games, and this text highlights six dangers that studios want to concentrate on, and what they’ll do to remain forward.
The CPC has in-game outlets in its sights
In March 2025, the CPC acted against Swedish studio Star Stable Entertainment, whose recreation Star Secure is fashionable with youngsters. The CPC alleged that the sport makes use of, amongst different issues, incentives for teenagers to purchase gadgets, unclear foreign money pricing, and undisclosed influencer advertising and marketing.
The identical month, the CPC printed its Key Principles on In-Game Virtual Currencies. The fundamental thought is that client regulation covers each buy made with a digital foreign money purchased with actual cash.
These seven key ideas cowl:
- Clear and clear pricing by exhibiting the real-world cash value (for instance, in euros).
- Free of charge-obscuring practices (for instance, a number of foreign money layers).
- No compelled surplus purchases (for instance, gamers shouldn’t be urged to spend more money by way of odd pricing of bundles).
- Clear pre-contractual data.
- The proper of withdrawal to cancel purchases and get refunds for unused digital currencies.
- Honest and comprehensible phrases in plain language.
- The safety of susceptible teams.
For the reason that finish of September, the EU and nationwide authorities have carried out coordinated actions to implement these ideas.
The EU AI Act now enforces transparency
After the backlash over AI outputs recognized by gamers, the difficulty has change into quite delicate, however studios now have a authorized obligation round making AI use clear in some instances.
Offering a generative AI system, similar to a text-to-image mannequin, triggers an obligation by the supplier to mark its output in a machine-readable method and make it detectable as artificially generated or manipulated (Article 50(2) of the EU AI Act). A studio providing gamers its personal AI device for creating UGC would normally be thought of because the supplier. This obligation started in August, though the grace interval for programs already in the marketplace runs till December 2, 2026.
Deepfakes created with third-party AI instruments (which may cowl representations of real-world areas, folks, or occasions) may also want labelling in some instances. Nevertheless, sure exceptions may see the duty waived, or, in an evidently artistic work, a discover within the credit may suffice.
Article 50(1) of the AI Act requires suppliers of interactive AI programs to ensure gamers know they’re coping with AI, except that’s apparent. These programs may embody conversational bots supercharged with AI, and the “apparent” exception could trigger explicit complications in video games performed by youngsters, since within the Fee’s view the usage of AI may not be as apparent to youngsters as it’s to adults.
Earlier than launch, online game suppliers ought to checklist each AI function in every title and work out its potential regulation.
The Digital Providers Act has tightened the foundations for UGC
A video video games supplier that shops UGC similar to footage, texts, or designs on its servers will probably be deemed a internet hosting service underneath the Digital Providers Act (DSA), and making this UGC publicly obtainable to all gamers is prone to make the supplier a web based platform.
The DSA gives for a tiered regime with new obligations for every tier (for instance, middleman, internet hosting service, on-line platform, and really giant on-line platform). In August, the Fee designated Roblox as a very large online platform, the class with the strictest duties.
The DSA doesn’t make online game suppliers examine each add. Suppliers are typically not responsible for unlawful uploads they don’t seem to be conscious of, so long as they act rapidly as soon as they’re. Gamers additionally want a simple option to report in-game content material, and anybody whose UGC the supplier removes or restricts should get an announcement of causes. AI creation instruments elevate the stakes, as a result of gamers can now produce infringing or dangerous content material at scale. A report button alone may not be sufficient.
For a lot of on-line platform video games, nonetheless, Article 28 of the DSA is essential. On-line platforms that minors can entry need to take acceptable and proportionate measures to make sure a excessive stage of privateness, security, and safety for them: An “18+ clause” buried within the phrases and circumstances won’t take the supplier out of scope. The Fee’s guidelines from July 2025 present what it expects. They don’t seem to be binding, however enforcement our bodies measure compliance towards them.
Your in-game financial system may fall foul of playing rules
For some in-game monetization fashions, a radical evaluate of potential playing (or talent recreation) rules is an important step in a online game supplier’s governance course of.
There isn’t any harmonised EU playing regulation, so every EU jurisdiction has its personal guidelines for loot containers and different “staking-like” in-game choices.
Since 2018, Belgium has treated (paid) loot boxes as gambling. Courts within the Netherlands and Austria have declined to deal with soccer participant packs as playing, as a result of they appeared on the recreation as an entire. German playing regulation assesses every function by itself, so the predominance of likelihood over talent and a stake and prize which are value cash are decisive. Whether or not gamers can switch gadgets or money them out usually decides the end result.
In a non-binding decision, the European Parliament has known as for a ban on loot containers in video games prone to be accessible to minors, and since June, PEGI rates new games with paid random items at 16 by default. German youth safety regulation has factored interplay dangers similar to gambling-like mechanisms into its age scores since 2023. The Courtroom of Justice can be contemplating whether or not app shops might be responsible for providing video games with unlawful loot containers.
Earlier than embedding loot containers or comparable options, online game suppliers ought to examine the playing legal guidelines of their goal markets.
The Digital Equity Act will shake-up digital shops
The European Fee plans to publish the primary draft of the DFA on November 11, and a part of the intention is to show the CPC’s issues into binding regulation.
Lots of the huge subjects coated within the DFA may apply to video video games. The Act is prone to sort out darkish patterns in additional depth, from faux shortage to strain timers. Guidelines on addictive design may deal with options constructed to maximise the money and time shoppers spend, together with day by day streaks, variable rewards, and push notifications. Loot containers, pay-to-win mechanics, and digital currencies may also be coated, specifically the place they aim youngsters, and exhibiting real-money costs for in-game gadgets is prone to be regulated. The DFA can be prone to deal with personalisation that exploits vulnerabilities, influencer advertising and marketing, and cancellation choices. An overarching subject is the safety of minors.
The DFA is unlikely to use earlier than 2028, however studios ought to carefully monitor the legislative course of.
On the horizon: the KIDS Act
The European Fee proposed the KIDS Act on September 17. This new Act would cowl any online game that gamers can entry, obtain or purchase on-line. By default, the KIDS Act would require video games to be child-safe till age assurance reveals a participant is an grownup. A self-declared age wouldn’t meet this requirement.
The KIDS Act asks for obligatory parental instruments, and youngsters underneath 13 may solely play by way of these instruments. Video video games would want to make sure that no person can use them to lure youngsters onto dangerous providers elsewhere. UGC platforms would additionally want instruments that allow player-made video games comply.
It appears unlikely that the KIDS Act will apply earlier than 2028. Nevertheless, many features of it are already featured within the Fee’s tips underneath Article 28 of the DSA, so parental instruments and child-safe defaults are value contemplating now.
The place to start out?
The present tempo of regulation at each the EU and nationwide stage is excessive, and plenty of video video games suppliers complain that this “headache checklist” is getting longer. Hen & Hen’s Game Plan 2026 report units out key questions and subsequent steps for a lot of of those dangers. In the end, the sooner that online game suppliers construct these guidelines into their designs, the less prices they’ll face later down the road.