01
Children’s data governance across products
The ICO’s Children’s Code and COPPA require games likely to be accessed by children to apply heightened design standards — with documented compliance at product level. Most studios cannot evidence that these standards were considered at design, let alone maintained throughout the product’s active life.
Children’s data obligations structured within the product lifecycle from inception — design decisions documented, age-appropriate standards evidenced, and compliance maintained as the product evolves.
02
Loot box design and disclosure documentation
Platform policies from Apple, Google, and Steam now require loot box probability disclosure. Regulatory scrutiny is advancing in the UK, EU, Belgium, Netherlands, and Australia. Studios need documented evidence of how loot box mechanics were designed, what probabilities were set, and how these decisions were governed — both for regulatory review and platform compliance.
Loot box design decisions documented within the product record — probabilities tracked, platform disclosure obligations evidenced, and governance maintained as mechanics evolve.
03
Online Safety Act risk assessment obligations
Games with multiplayer, social, or user-generated content features are captured by the Online Safety Act — requiring documented risk assessments, safety measure implementation, and ongoing governance of product features that could expose users to harm. This applies to any UK-accessible game with user-to-user functionality.
Safety risk assessments structured within the product lifecycle — harmful feature risks documented, mitigation measures evidenced, and Ofcom-ready governance maintained continuously.
04
AI system governance in games
The EU AI Act applies to AI systems used in games — including personalisation engines, dynamic difficulty systems, and behavioural targeting for in-game purchases. Where these systems create manipulative interactions, particularly for minors, they may be classified as prohibited or high-risk, creating direct product governance documentation obligations.
AI system classifications documented within product records — risk assessments evidenced, human oversight obligations tracked, and EU AI Act compliance maintained as AI features evolve.
05
Age rating and classification compliance
PEGI, ESRB, and the Australian Classification Board all require up-to-date ratings reflecting a game’s current content — including in-game purchasing mechanics and online features. Managing age rating governance across product updates, DLC releases, and live service changes without structured tooling creates compliance gaps and distribution risk.
Age rating status tracked alongside product change governance — content updates flagged against classification implications, rating documentation current, and distribution compliance maintained.
06
App store and platform policy compliance
Apple App Store and Google Play impose product governance requirements that function as de facto global regulation for mobile games — with platform removal the consequence of non-compliance. Managing policy compliance across multiple platforms, product updates, and evolving store rules requires structured governance infrastructure that most studios lack.
Platform policy compliance tracked within product records — App Store and Google Play requirements version-controlled, compliance status current, and platform governance evidence maintained for every title.