Bird & Bird maps six EU regulatory risks facing games studios in 2026

Bird & Bird's Game Plan 2026 report maps six EU rules reshaping game design. The EU AI Act's deepfake and transparency rules have applied since August 2. The Cyber Resilience Act's first reporting obligations began September 11. The CPC acted against Star Stable Entertainment in March 2025 over currency practices. The KIDS Act and Digital Fairness Act add further compliance deadlines through 2028.

The CPC's March 2025 case against Star Stable cited unclear pricing and child-targeted incentives.
The same month, CPC published seven key principles for in-game virtual currencies.
Principles cover real-money price transparency, refund rights, and protection of vulnerable groups.
Coordinated EU and national enforcement actions have run since late September 2025.

The AI Act's labelling duty for generative AI outputs took effect in August.
Studios offering AI UGC tools are typically treated as the content provider.
A grace period for AI systems already on sale runs until December 2, 2026.
Interactive AI systems, like chatbots, must disclose their artificial nature to players unless obvious.
Regulators judge the "obvious" exception more strictly for games played by children.

The DSA classifies video game providers that host public UGC as online platforms.
In August, the Commission designated Roblox a very large online platform, its strictest tier.
Article 28 requires proportionate privacy and safety measures for platforms minors can access.
An "18+" clause in terms and conditions does not remove providers from this scope.

Belgium has treated paid loot boxes as gambling since 2018.
Dutch and Austrian courts have declined to classify football player packs as gambling.
German law assesses each feature separately, weighing chance, stakes, and cash-out options.
PEGI has rated games with paid random items at 16 by default since June.
The Court of Justice is weighing app-store liability for illegal loot boxes.

The Commission plans the first Digital Fairness Act draft for November 11.
The DFA is expected to target dark patterns, pressure timers, and addictive daily streaks.
The DFA is unlikely to take effect before 2028.
The KIDS Act, proposed September 17, requires child-safe defaults until age verified.
Both laws are unlikely to apply before 2028, Bird & Bird notes.

For Publishers & Developers: Show euro prices and drop multi-layer currencies in EU storefronts before enforcement sweeps arrive.
For Investors & VC: Add an EU exposure audit of UGC, AI and currency features to F2P diligence.
For Service Vendors: Pitch machine-readable AI watermarking and moderation tooling to studios shipping player-facing AI creation tools.