Steam Generative AI Policy
In force since January 2024, narrowed and clarified January 2026 · Applies to all games using AI-generated player-facing content
What the policy requires
Valve's policy mandates that any game with AI-generated content must clearly disclose it on the Steamworks store page before launch. The policy draws a hard distinction between two categories:
| Category | Definition | Example |
|---|---|---|
| Pre-Generated | AI was used to create assets during development; the output is fixed in the shipped game | Character portraits generated with Midjourney; background music composed with Suno |
| Live-Generated | AI generates content in real time during gameplay, specific to each session or player | Procedural dialogue via GPT; dynamic NPC faces |
Failure to disclose — or incorrect categorisation — risks Valve rejecting your store page submission or requiring you to add disclosure to an already-released title; Valve has required retroactive disclosure updates from live games before.
Scope limit — read this before you buy. OriginGuard audits Pre-Generated content only. It tracks assets that exist as files in your project and ship fixed in your build. It does not audit Live-Generated content — anything your game produces at runtime, such as procedural dialogue or dynamically generated NPCs — because that content does not exist as a file at build time and so cannot be hashed or tagged at export. If your title generates content live, you still have a Steam disclosure obligation for it, and you will need to document that separately. We would rather tell you that now than have you discover it after purchase.
How OriginGuard satisfies Steam requirements
| Obligation | OriginGuard Output | Status |
|---|---|---|
| Disclose AI-generated player-facing content | steam_disclosure.disclosure_statement — copy-paste ready text |
✓ Covered |
| Distinguish Pre-Generated from Live-Generated content | category field enforced at point-of-export via VS Code extension |
✓ Covered |
| Ensure disclosed content matches shipped assets | SHA-256 hash verification — any modification is flagged as tampered | ✓ Covered |
| Block non-compliant assets from shipping | GitHub Actions build gate — PR blocked if scan fails | ✓ Covered |
originguard scan in CI → copy steam_disclosure.disclosure_statement to your Steamworks page. Done.
EU AI Act — Article 50
Effective August 2, 2026 · Applies to specific in-scope systems — chatbots, synthetic-content generators, deepfake tools, emotion-recognition/biometric-categorisation systems — placed on the EU market or whose output is used in the EU
What Article 50 requires
Article 50 draws a line between two roles. The duty to machine-readably mark AI-generated output (Art. 50(2)) falls on the provider of the generative AI system — Midjourney, Stability AI, and similar tools — not on the studio using their output. A game studio is a deployer, and its own Art. 50 duty is mainly the deepfake-disclosure requirement under Art. 50(4): disclosing when content that resembles real people, places, or events has been artificially generated or manipulated.
- Video games get an artistic/creative-work carve-out that attenuates — but does not remove — that deepfake-disclosure duty: where synthetic content is plainly part of a fictional environment, the deceptive risk Art. 50 targets doesn't arise the same way.
- That carve-out does not extend to marketing material and store pages — those remain fully in scope, with no light touch.
- Deployers should be able to document and evidence which AI systems and content types were used, for their own disclosure decisions and for regulator or platform questions.
How OriginGuard supports your Article 50 evidence base
| Obligation | OriginGuard Output | Status |
|---|---|---|
| Evidence base for deployer disclosure decisions | eu_ai_inventory.tools[] — structured JSON per tool per category |
✓ Covered |
| Tamper-evident record of what shipped | SHA-256 hash in .origin sidecar; any asset modification invalidates the tag |
✓ Covered |
| Retain documentation for audit | Master_Disclosure.json uploaded as a CI artifact with 90-day retention |
✓ Covered |
| Identify AI systems used | tool and category fields per asset in the provenance record |
✓ Covered |
Master_Disclosure.json CI artifact — it's the evidence base for your deployer disclosure decisions and for Valve's content survey alike.
Full compliance coverage at a glance
| Regulatory Obligation | Regulation | OriginGuard Field |
|---|---|---|
| Disclose AI-generated player-facing content | Steam AI Policy | steam_disclosure.disclosure_statement |
| Distinguish Pre-Generated vs Live-Generated | Steam AI Policy | .origin.category |
| Hash-verified asset integrity | Both | .origin.sha256 |
| Evidence base for deployer disclosure duties | EU AI Act Art. 50 | eu_ai_inventory.tools[] |
| Retain documentation for regulatory audit | EU AI Act Art. 50 | Master_Disclosure.json CI artifact |
| Identify AI systems and tools used | EU AI Act Art. 50 | .origin.tool |
| Block non-compliant assets from shipping | Both (best practice) | GitHub Actions build gate |
| Internal audit trail with CRITICAL warnings | Both (best practice) | integrity_report |