A guide to six regulatory risks shaping games in 2026

The EU AI Act now requires labeling of AI-generated content like deepfakes in games, with obligations for providers to mark outputs machine-readably and disclose AI use in interactive systems. Studios offering AI tools for user-generated content are considered providers and must comply, though a grace period extends until December 2, 2026, for existing systems. Exceptions may apply, such as waivers for creative works or notices in credits, but clarity around AI use remains critical, especially for games targeting children.

The Digital Services Act (DSA) classifies game platforms hosting user-generated content as online services, with obligations tiered by size and risk. Roblox was designated a very large online platform in August, facing stricter duties. Providers must enable easy reporting of illegal content and provide reasons for removals, while ensuring privacy and safety measures for minors under Article 28, which cannot be bypassed by terms and conditions.

Loot boxes and pay-to-win mechanics face divergent gambling regulations across EU member states, with Belgium treating paid loot boxes as gambling since 2018. Courts in the Netherlands and Austria have not classified football player packs as gambling, while Germany assesses each feature individually. The European Parliament has called for a ban on loot boxes in games accessible to minors, and PEGI now defaults to a 16 rating for new games with paid random items.

The Digital Fairness Act (DFA), set for a first draft on November 11, aims to codify the CPC’s concerns into binding law, targeting dark patterns, addictive design, and exploitative practices. Features like daily streaks, variable rewards, and push notifications may be regulated, alongside rules on virtual currencies, influencer marketing, and cancellation options, with a focus on protecting minors.