AI-assisted web game prototyping: portal rules, rights and checks

This guide covers process and risk when AI tools are part of your prototyping. It does not rank tools or say how well any model performs. It lists what portals and the US Copyright Office have published, as of 2026-09-30, and the checks that confirm a build works without trusting a tool’s own description of its output.

What portals say about AI-generated content

Portal	Published position
Poki	AI tools are fine while prototyping. Before a player or web fit test, the game should reflect your own perspective and real improvements beyond the tooling. Be ready to show which tools you used, plus prompts and iterations, on request. No AI watermarks or prompt text; everything playtested. AI art does not make a clone original.
CrazyGames	No AI rule published. Game names, assets and content should show originality.
GameDistribution	Only deep-fake content is addressed (guideline 1.5): AI-made or manipulated media that resembles real people, places or events and could pass as authentic must be clearly labelled as artificial.
GameMonetize	Not published.
Y8	AI tools allowed if you hold the required rights and the game meets quality and content rules. Copied, misleading, low-quality, repeatedly reskinned or mass-generated games may be rejected.
itch.io	Tag projects containing generative-AI material in the AI Disclosure section. Traditional game AI such as pathfinding or procedural levels needs no tag. Disclosure is strictly enforced for asset pages, which may be delisted if untagged.
YouTube Playables	No AI rule in the Playables requirements. Content must be original, authorized or properly licensed, with IP and music rights cleared.
Google H5 Games Ads	No games-specific rule. Google’s publisher policies say not to place ads on automatically generated content without manual review or curation.

itch.io also treats mass-produced pages as spam, including projects made predominantly by AI with minimal human intervention. Its guidelines ask you to state AI generation in the description when a project uses it.

Poki’s guidance is the most detailed of these. Its per-craft table accepts AI for code boilerplate, concepts and level drafts, provided a human tests, edits and owns the result. It also expects credit where a tool’s terms require it. Its page on interpreting test results adds that originality and craft can decide the final review: speeding up development with AI and other tools is fine, but games that feel heavily tool-assisted or rapidly assembled are declined.

Copyright: what the US Copyright Office says

The Office’s Part 2 report on copyrightability (January 2025) concludes, in its executive summary:

• Using AI to assist, rather than stand in for, human creativity does not affect protection.
• Copyright does not extend to purely AI-generated material, or to material where the human lacked sufficient control over the expressive elements.
• With current generally available technology, prompts alone do not provide that control.
• Human expression perceptible in an output is protected. So are creative selection, coordination or arrangement of outputs, and creative modifications of them.
• Sufficiency of human contribution is decided case by case.

The Office’s announcement of the report adds that including AI-generated material in a larger human-made work does not bar protection.

If you register a work, the 2023 registration guidance says applicants must disclose AI-generated content and briefly explain the human contribution. It adds that AI-generated content that is more than de minimis should be excluded from the claim, and that the AI tool or its provider should not be listed as an author.

The practical consequence for a game: a sprite sheet used exactly as generated may carry no copyright you can enforce, while your code, level design, arrangement and edits can. This is US law only; other jurisdictions were not checked, and none of this is legal advice.

Read your own tool’s terms

Every AI tool publishes its own terms, and they differ and change. This guide does not summarise any vendor’s terms. Before shipping output from a tool, read its current terms for at least:

• who owns or may use the output, and whether commercial use is allowed on your plan;
• whether attribution is required (Poki notes that some tools require credit or restrict commercial use);
• what happens to the code, art or data you send in.

Record the date you reviewed them, next to each asset (see below).

Asset licence hygiene: keep a manifest

Portals ask about rights after the fact. Poki may ask for your process, Y8 and YouTube require cleared rights, and itch.io requires disclosure. Answering is easier if every file under assets/ has an entry written when it was added:

{
  "manifestVersion": 1,
  "assets": [
    {
      "path": "assets/sprites/player.png",
      "origin": "own-work",
      "author": "Your Name",
      "aiGenerated": false
    },
    {
      "path": "assets/audio/jump.ogg",
      "origin": "third-party",
      "source": "https://example.com/sound-pack",
      "licence": "CC0-1.0",
      "licenceFile": "licences/sound-pack.txt",
      "aiGenerated": false
    },
    {
      "path": "assets/ui/icons.png",
      "origin": "own-work",
      "aiGenerated": true,
      "tool": "Tool name and version",
      "termsReviewed": "YYYY-MM-DD",
      "humanEdits": "Redrawn outlines, recoloured to the game palette",
      "promptLog": "docs/prompts/ui-icons.md"
    }
  ]
}

A small Node script can fail the build when the manifest and the folder disagree:

// file: examples/snippets/ai-assisted-prototyping/check-assets.mjs
// check-assets.mjs: fail the build if an asset is undocumented.
import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
import { join } from 'node:path';

const { assets } = JSON.parse(readFileSync('assets.manifest.json', 'utf8'));
const byPath = new Map(assets.map((a) => [a.path, a]));

const walk = (dir) => readdirSync(dir).flatMap((name) => {
  const p = join(dir, name);
  return statSync(p).isDirectory() ? walk(p) : [p.split('\\').join('/')];
});

const problems = [];
for (const file of walk('assets')) {
  const a = byPath.get(file);
  if (!a) { problems.push(`${file}: no manifest entry`); continue; }
  if (!a.origin) problems.push(`${file}: origin missing`);
  if (a.origin === 'third-party' && !(a.licence && a.source)) {
    problems.push(`${file}: third-party asset needs licence and source`);
  }
  if (a.aiGenerated && !(a.tool && a.termsReviewed && a.humanEdits)) {
    problems.push(`${file}: AI asset needs tool, termsReviewed, humanEdits`);
  }
}
for (const path of byPath.keys()) {
  if (!existsSync(path)) problems.push(`${path}: listed but not found`);
}

if (problems.length) {
  console.error(problems.join('\n'));
  process.exit(1);
}
console.log(`${byPath.size} assets documented`);

The script and the manifest above are covered by tests in the site’s repository (tests/examples/guide-commands.test.ts), which run it with Node.js: it passes for this manifest and fails as intended for an unlisted file, a missing licence field, an AI entry without humanEdits, and a listed file that does not exist. Keep the prompt logs it points to; they are the record Poki says it may ask for.

Verification that does not depend on AI claims

A tool’s summary of what its code does is a claim, not evidence. These checks work the same whoever wrote the code:

• Clean build. Build from a fresh clone with the lockfile committed. A build that works only on the machine where code was pasted in is not reproducible.
• Unit tests for logic. Scoring, progression and save migrations are plain functions you can test in Node; the save-progress guide has a worked example. Write or review the tests yourself, and run them in CI.
• API names against official docs. SDK method names and required call order change. Check every SDK call against the current reference, not a tool’s memory. See the CrazyGames SDK and Poki SDK guides.
• Static scan. The Portal Readiness Checker inspects a zipped build for archive layout, size, SDK calls present, hard-coded external URLs, service workers, viewport and touch handling, audio unlock and storage use. It does not run the game.
• Runtime event order. A static scan cannot see when events fire. Use each portal’s own test environment, for example the YouTube Playables test suite, since that SDK does nothing when served locally.
• Size budget. Measure the zip against each portal’s published limits (comparison, keeping builds small).

What stays your responsibility

No tool takes these over:

• QA and playtesting. Poki’s rule is that no untested generated content ships. Play every level and every ad break on real devices.
• Policy compliance. Originality, rights, content ratings and ad placement are judged against your game, whatever produced it.
• Disclosures. The itch.io AI tag, GameDistribution’s deep-fake label, credit a tool’s terms require, and any registration disclosure.
• Records. Tool names, terms-review dates, prompts and human edits, kept with the project.

A prompting checklist (suggestions)

• Paste the relevant section of the official SDK or portal doc into the prompt rather than relying on the tool’s recall.
• Ask for small, reviewable changes, each with a test.
• State constraints up front: no external requests, no new dependencies without a licence check, the size budget.
• Ask the tool to list assumptions and any API it is unsure exists, then check each one.
• Keep secrets, API keys and player data out of prompts.
• Save prompts and outputs that end up in the game, and link them from the manifest.

What to check before you submit

• Every asset has a manifest entry; check-assets.mjs (or your equivalent) passes.
• No AI watermarks, prompt text or placeholder copy anywhere in the build or store art.
• AI disclosures are made where the portal asks (itch.io) and deep-fake-style media is labelled (GameDistribution).
• Tool terms reviewed and credit given where required.
• Clean build, tests green, Portal Readiness Checker reviewed, portal test tools run.
• A human has played the whole game, including every generated level.

Limits of this guide

Portal positions come from public developer pages read on 2026-09-30. GameMonetize, CrazyGames and YouTube Playables publish no AI-specific rule, and their silence is not permission. Copyright coverage is limited to US Copyright Office publications; courts and other countries may differ. No AI tool’s terms were reviewed here.