Both stores now name AI apps in their rules. Apple's App Review Guidelines, last updated 16 October 2026, put AI content creation apps under guideline 1.2, which asks for content filtering, a way to report content, a way to block abusive users and published contact details, and guideline 5.1.2(i) requires explicit permission before personal data goes to third-party AI. Google Play's AI-Generated Content policy makes developers responsible for offensive output, and Google says users must be able to report it in the app. Give reviewers a demo account with every AI feature switched on, and keep your test records.
The short answer
An AI app has to clear the same review as any other app, plus a short list of rules that name AI directly. On Apple's side, the App Review Guidelines were updated on 16 October 2026, and guideline 1.2 now lists AI content creation apps next to social media and user-generated content platforms. That brings four requirements: filter objectionable material, offer a way to report content with timely responses, let users block abusive users, and publish contact information. Guideline 5.1.2(i) separately requires you to disclose when personal data goes to third-party AI and to get explicit permission first.
On Google's side, the AI-Generated Content policy makes developers responsible for what a generative AI app produces, and Google's own developer posts add two practical points: users must be able to report or flag offensive content without leaving the app, and reviewers must be able to reach every AI feature. This page sets the two side by side and ends with a checklist. It is general information, not legal advice, and neither store promises approval.
What changed in Apple's guidelines on 16 October 2026
We compared two copies of Apple's App Review Guidelines: the version last updated on 6 February 2026 and the version last updated on 16 October 2026. The comparison showed 56 changed blocks, most of them editorial, such as "e.g." becoming "such as". The ones that matter to an AI app are these:
| Guideline | What the October 2026 text adds or changes |
|---|---|
| 1.2 User-Generated Content | Now covers apps that let users create, generate, upload, share or contribute content, and says this includes AI content creation apps. It names nonconsensual intimate imagery as a risk, and says it is your responsibility to remove violating content. Failure to put safeguards in place or to fix violations after notice can breach the Developer Code of Conduct |
| Before You Submit | Adds a line asking for required documentation for apps and features that need regulatory approval |
| Kids and teens introduction | Now speaks of kids and teens and asks developers to make sure kids get age-appropriate experiences inside the app |
| 2.5.19 | The ban on hidden, dormant or undocumented features now has its own number, and covers hiding them in the binary through obfuscation |
Guideline 5.1.2(i) is not in this list because its only change was editorial ("e.g." became "such as"). The sentence about third-party AI was already in the February 2026 text.
Apple rules that reach an AI app
| Guideline | What it asks for | What to build |
|---|---|---|
| 1.2 | Filtering of objectionable material, a reporting mechanism with timely responses, the ability to block abusive users, published contact information | A moderation layer on input and output, a report button on AI replies, a block control for apps with shared spaces, and a support address |
| 4.7 | Apps may offer chatbots, mini apps and plug-ins that are not embedded in the binary, if that software follows the privacy rules in 5.1, has filtering, reporting and blocking, follows guideline 3.1 for digital goods, shares no data or permissions with it without explicit consent in each instance, and is listed in an index with universal links | Read this one if your app hosts chatbots from other parties. Apple does not define "chatbot" on the page, so we read it as covering bot directories, not a single assistant of your own |
| 5.1.1(i) | A privacy policy linked in App Store Connect and in the app that states what data is collected, every use of it, that third parties give equal protection, and the retention and deletion policy with how to revoke consent | A policy that names your model vendors and says how long chats are kept (see the OpenAI, Anthropic and Gemini data terms) |
| 5.1.1(iii) | Ask only for data relevant to the core functionality | Do not request contacts or photos for a text assistant |
| 5.1.1(v) | If the app supports account creation, offer account deletion inside the app | A delete-account flow that also deletes chat history held by you |
| 5.1.2(i) | Disclose where personal data is shared with third parties, including third-party AI, and get explicit permission first | A consent screen before the first request to a model API, with the provider named |
| 1.4.1 | Medical apps that could give inaccurate information get more scrutiny; disclose data and methodology behind accuracy claims; remind users to check with a doctor | A visible reminder in health and symptom assistants, and no diagnosis claims |
| 2.1(a) | Final versions, working URLs, demo account details with your back end on, or an approved demo mode that shows full functionality | A reviewer account with every AI feature enabled |
| 2.3.1(a) | New features and product changes described with specificity in the Notes for Review; misleading marketing is grounds for removal | Notes that say what the AI does, what model it calls and what it cannot do |
| 2.3.6, 2.3.8 | Honest age rating answers; "For Kids" and similar terms reserved for the Kids Category | Rate the app for what a user can make it say, not what you hope it says |
| 3.1.1 | In-app purchase for features and subscriptions; credits bought this way may not expire and need a restore mechanism where restorable | Pricing for AI credits that does not expire them |
Google Play rules
Google's AI-Generated Content policy page covers content generated from text, voice and image prompts, and names three kinds of app: text-to-text chatbots where the AI interaction is a central feature, text-to-image, voice-to-image and image-to-image apps, and apps that create voice or video recordings of real people with AI. Developers are responsible for making sure their generative AI apps do not generate offensive content, including content prohibited under Play's Inappropriate Content policies, content that may exploit or abuse children, and content that can deceive users or enable dishonest behavior. Generative AI apps should also comply with all other policies in Google's Developer Policy Center.
The page says the policy is not intended, at this time, to cover apps that only host AI-generated content, apps that only summarize non-AI content, or productivity apps that use AI to improve an existing feature. Its examples of violating content include non-consensual deepfake sexual material, voice or video of real people that facilitates scams, content that encourages self-harm or dangerous activities, demonstrably deceptive election content, content that facilitates bullying and harassment, generative apps primarily intended to be sexually gratifying, and AI-generated official documentation that enables dishonest behavior.
Two Android Developers Blog posts fill in what reviewers expect:
- June 2024: apps that generate content using AI must prohibit and prevent the generation of restricted content and give users a way to report or flag offensive content. The post says Google announced the in-app reporting requirement the previous October, and asks developers to document their testing because Google may ask to see it.
- August 2026: Google restates its enhanced requirements for generative AI apps, aimed at non-consensual intimate imagery and "nudify" media. It asks for test accounts with full access to all AI features, not blocked by a paywall or geo-fence, and documentation of safety prompts and edge cases tested. It also says not to rely only on the underlying model's own safety filters: add your own input and output moderation, test against adversarial prompts, and use failed attempts and user reports as signals. You remain responsible for ads for your app even when a third party creates them.
Side by side
| Topic | Apple | Google Play |
|---|---|---|
| Content safety | 1.2: filtering, reporting, blocking, contact information; removal duty | AI-Generated Content policy: prevent restricted and offensive output |
| User reporting | Mechanism to report offensive content with timely responses | Report or flag inside the app, per the 2024 guidance |
| Personal data sent to a model vendor | 5.1.2(i): disclose and get explicit permission first | Not addressed on the AI-Generated Content page; we did not read Play's user data policy |
| Reviewer access | Demo account or approved demo mode with full features, back end on | Test accounts with every AI feature, no paywall or geo-fence |
| Evidence of testing | Notes for Review describing features | Documentation of safety prompts and edge cases; Google may ask |
| Children | 5.1.4, Kids Category rules, 2.3.8 metadata rule | The AI page bars content that may exploit or abuse children; we did not read Play's families policies |
A pre-submission checklist for an AI app
This is our recommendation, built from the pages above.
- Add a report button to every AI reply and route reports to a person who can act on them quickly. Both stores ask for it in some form.
- Moderate input and output yourself. Do not rely only on the model vendor's filters, which is Google's own advice.
- Log adversarial tests. Keep a dated record of the prompts you tried and what the app did. Google says it may ask, and the same record answers an Apple reviewer. Our OWASP LLM Top 10 pre-launch tests give you the test list.
- Show a consent screen before the first call to a model API and name the provider. Match it to the privacy policy.
- Write the privacy policy around retention and deletion. Say how long chats are kept and how a user deletes them, and offer account deletion in the app.
- Give reviewers everything. A demo account with all AI features enabled, paywalls lifted for that account, the back end live, and Notes for Review that say what the AI does.
- Answer the age rating honestly. Think about what a determined user can get the model to say.
- Label health assistants with a reminder to check with a doctor and avoid accuracy claims you cannot document.
- Price credits to match 3.1.1. Credits bought with in-app purchase should not expire.
- Check your marketing against the app. Both stores treat misleading descriptions and ads as violations.
For the wider launch gate, use our AI MVP checklist and see how we handle app store publishing. If the app will be used in the EU, add the accessibility rules and the EU AI Act duties.
Limits of this page
We read Apple's App Review Guidelines on 22 October 2026; the page showed "Last Updated: October 16, 2026" and matched a copy that the Internet Archive captured on 20 October 2026. The earlier version we compared it with, last updated on 6 February 2026, comes from an Internet Archive capture of 1 June 2026. Check Apple's page for anything newer. We read Google's pages on 22 October 2026. The Play Console policy page we read is the AI-Generated Content help article; we did not read every Play policy that could apply, such as payments, families and data safety. We did not test any app against a reviewer, and review outcomes depend on the reviewer and the app. The comparison of two Apple versions, the table of guidelines and the checklist are our reading and are not legal advice.
Sources
- App Review Guidelines, Apple, last updated 16 October 2026, read 22 October 2026 (the February 2026 version comes from an Internet Archive capture of 1 June 2026)
- Understanding Google Play's AI-Generated Content policy, Play Console Help, read 22 October 2026
- Enabling safe AI experiences on Google Play, Android Developers Blog, June 2024
- Ensuring Safety in the Generative AI Ecosystem: Protecting Users from Non-Consensual Intimate Content, Android Developers Blog, August 2026