14 Free IARC PEGI and ESRB Age-Rating Packet Tools for Indie Steam Submissions - 2026

Q3–Q4 2026 is when Steam partners, publishers, and console cert lanes ask for age-rating evidence packets earlier—often before October Next Fest depot lock—while micro-studios still “prove” ratings with a Slack thread screenshot and a half-finished IARC form. That habit fails the same week localization freeze and dual-SKU dress rehearsal harden: store age markers must match questionnaire answers, content descriptors, and what the fest demo actually shows in hour one.

This listicle is the bookmark stack for age-rating packets, not legal advice and not a rewrite of content-descriptor hour-one parity. Pair it with privacy/data-safety templates for PII lanes, Steam content descriptors demo parity for mature-content flags, and this cluster’s localization freeze evening plus dual-depot dress rehearsal so soft-launch calendars (forward blog #6) do not ship with an invented PEGI number.

Direct answer: gather questionnaire PDFs or export hashes, map Steam store rating fields to answers, capture hour-one proof when violence or language flags apply, file age_rating_packet_receipt_v1.json with gates A1–A6, and set BUILD_RECEIPT.age_rating_packet_ok only when the store URL and questionnaire hash agree.

Why this matters now

1. Partners ask earlier in 2026. Soft-launch and Next Fest upload packets now expect rating questionnaire evidence beside BUILD_RECEIPT—not “we’ll fill IARC during submit week.”
2. IARC is a workflow, not a vibe. The IARC questionnaire produces ratings that Steam and other stores consume; answers must stay attributable to a reviewable file.
3. Regional boards still matter for console / physical. PEGI and ESRB vocabularies appear in press kits even when Steam auto-fills IARC—teams that only memorize one acronym fail partner checklists.
4. Descriptors ≠ ratings. Content descriptors are install-time promises; age ratings are board or IARC outcomes. Confusing them produces refund-shaped store pages.
5. One evening of tooling beats upload-week panic. These fourteen picks cover questionnaires, evidence folders, hashing, storefield maps, and a tiny verifier—without buying enterprise compliance suites.

Outbound authorities to keep open: Steamworks store documentation, PEGI, ESRB, and IARC.

Who this is for

Time: 45–90 minutes to scaffold the packet folder; revisit when content descriptors or gameplay violence change.

Prerequisites: Steamworks partner access (or planned access), ability to capture screenshots for contested descriptors, and a release-evidence/ habit from BUILD_RECEIPT beginner pipeline.

Format ladder

Non-repetition: privacy listicle owns data-safety templates; descriptors article owns hour-one mature flags; this URL owns IARC/PEGI/ESRB packet tooling and A1–A6 age-rating receipt.

Gates A1–A6 (age rating packet)

Beginner path - ninety-minute first packet

1. Create release-evidence/age-rating/2026-09/
2. Download or complete IARC / Steam questionnaire (tools #1–#2)
3. Hash the export (tool #8)
4. Fill storefield map (tools #7, #10)
5. If violence/language flags exist, open descriptors parity and attach captures
6. Write age_rating_packet_receipt_v1.json (tools #13–#14)
7. Link path into BUILD_RECEIPT.json

The 14 free tools

1. IARC official rating questionnaire portal

What it is: The IARC questionnaire surface used by many digital storefronts, including Steam’s common path for digital age ratings.

Why now: Q3–Q4 2026 partner packets expect the questionnaire outcome tied to a dated export—not a remembered “we got 12.”

Indie fit: Free to use through partner/store channels; no studio license fee for the questionnaire itself.

Packet use: Export answers PDF or HTML; record iarc_export_sha256 in A2.

Caveat: Answers must match shipping content. Fest demos with softer content need honest demo-vs-full notes in receipt notes.

2. Steamworks age rating / store configuration docs

What it is: Official Steamworks store docs covering how ratings and related store fields surface on the page your players see.

Why now: October upload peak is when mismatched store age markers trigger last-minute Steamworks edits.

Indie fit: Free partner documentation; maps questionnaire outcomes into storefields.

Packet use: Capture Steamworks rating fields for A3; store URL for A5.

Caveat: UI labels change—always re-capture screenshot the week you freeze the packet.

3. PEGI official age rating reference

What it is: PEGI age categories and content descriptors used across Europe and related markets.

Why now: Press kits and EU partners still speak PEGI even when IARC filled Steam automatically.

Indie fit: Free public reference for vocabulary honesty.

Packet use: Glossary column in storefield map (tool #10); A1 board list includes PEGI when press claims it.

Caveat: Physical / console PEGI submissions may require separate paid board processes—this list is packet evidence, not a guarantee of console certification.

4. ESRB rating categories & search

What it is: ESRB category definitions (E, E10+, T, M, …) and public guidance pages.

Why now: US press and wishlist audiences still filter by ESRB vocabulary; Slack guesses create false T vs M claims.

Indie fit: Free reference; pair with IARC answers for North American marketing language.

Packet use: Map IARC/Steam outcome → ESRB-speaking summary for FAQ without inventing board issuance if you only have IARC.

Caveat: Do not claim an official ESRB certificate number you do not hold for console/SKU submissions that require it.

5. Classification Board (Australia) public references

What it is: Public guidance and rating category language used in AU/NZ contexts (Classification Board references).

Why now: Soft-launch and publisher packets increasingly ask for regional awareness beyond “Steam will handle it.”

Indie fit: Free reading + vocabulary table for A1 multi-board notes.

Packet use: Optional boards[] row when targeting AU partners.

Caveat: Local submission processes may differ; record links, not invented ratings.

6. Steam content descriptors hour-one parity checklist (cousin tool)

What it is: The GamineAI content descriptors demo hour-one parity workflow and descriptor-proof.md pattern.

Why now: Age packets that list blood while hour-one is cute platforming fail partner spot checks.

Indie fit: Free checklist already published on-site.

Packet use: Satisfy A4 by linking descriptor proof paths rather than rewriting that article.

Caveat: Descriptors are not the age number—keep files adjacent, separate schema.

7. Markdown storefield ↔ questionnaire map template

What it is: A one-page storefield_map.md mapping Steam age / rating fields to questionnaire question IDs.

| Store field | Questionnaire item | Answer | Evidence file |
|---|---|---|---|
| Steam age rating / IARC outcome | Q-violence-intensity | Mild cartoon | iarc-export.pdf#p3 |
| Content descriptors: Language | Q-language | Mild | descriptors/lang-001.png |

Why now: Upload week fails when nobody remembers which checkboxes drove which store glyph.

Indie fit: Free, Git-friendly, zero SaaS.

Packet use: Core A3 artifact.

8. SHA-256 hashing (PowerShell / sha256sum)

What it is: Local hashing of questionnaire exports and evidence zips.

Get-FileHash .\iarc-export-2026-09-12.pdf -Algorithm SHA256

sha256sum iarc-export-2026-09-12.pdf

Why now: Partners challenge “same form” claims when re-exports drift.

Indie fit: Built into OS toolchains; no fee.

Packet use: Populate questionnaire_sha256 for A2 and verifier (tool #14).

9. Questionnaire answer workbook (spreadsheet or CSV)

What it is: Offline workbook listing each questionnaire prompt, yes/no/intensity answer, gameplay justification, owner, last reviewed UTC.

Why now: Soft-lock weeks change answers; workbooks show who signed the change.

Indie fit: Free Google Sheets / LibreOffice / CSV in repo.

Packet use: Human review layer before re-exporting IARC PDF.

Tip: Keep one row for “demo softer than full game?” with stop rules pointing at festive scope honesty.

10. Press-kit age vocabulary cheat sheet

What it is: One-pager translating IARC/Steam outcomes into PEGI/ESRB marketing language without inventing certificates.

Why now: Creators and journalists still ask “is this PEGI 12?” during October outreach.

Indie fit: Free markdown in press/; links T-90 outreach siblings without duplicating rating law.

Packet use: Cite from receipt press_vocab_path.

Caveat: Mark clearly when language is equivalent summary vs official board certificate.

11. Evidence folder taxonomy slot

What it is: Dedicated release-evidence/age-rating/ using the release-evidence folder taxonomy pattern.

release-evidence/
  age-rating/
    2026-09-12/
      iarc-export.pdf
      storefield_map.md
      steamworks-rating.png
      age_rating_packet_receipt_v1.json
      descriptors/   # optional A4 links

Why now: Age docs buried in #general Slack die during publisher diligence.

Indie fit: Free filesystem discipline.

Packet use: A6 path stability.

12. Store page capture (browser + UTC stamp)

What it is: Dated full-page screenshot or Steam partner preview capture of the live/upcoming store URL showing age markers.

Why now: A5 fails when the packet cites a wishlisted beta URL that never showed the rating.

Indie fit: Free browser tools; store UTC in filename steam-store-age-2026-09-12T18Z.png.

Packet use: Bind capture to store_url in receipt.

13. age_rating_packet_receipt_v1.json template

What it is: Machine-readable freeze for the packet decision.

{
  "schema": "age_rating_packet_receipt_v1",
  "created_utc": "2026-09-12T19:00:00Z",
  "boards": ["IARC", "PEGI_vocab", "ESRB_vocab"],
  "questionnaire_export": "release-evidence/age-rating/2026-09-12/iarc-export.pdf",
  "questionnaire_sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "store_url": "https://store.steampowered.com/app/1234560/",
  "storefield_map": "release-evidence/age-rating/2026-09-12/storefield_map.md",
  "descriptor_proof_index": "release-evidence/descriptors/descriptor-proof.md",
  "gates": {
    "A1": "PASS",
    "A2": "PASS",
    "A3": "PASS",
    "A4": "PASS",
    "A5": "PASS",
    "A6": "PASS"
  },
  "age_rating_packet_ok": true,
  "notes": "Fest demo softer on language - FAQ disclosure attached."
}

Why now: Soft-launch trend playbook (forward #6) needs a latch name, not a mood.

Indie fit: Free JSON beside BUILD_RECEIPT.

Crosswalk:

{
  "age_rating_packet_ok": true,
  "age_rating_packet_receipt": "release-evidence/age-rating/2026-09-12/age_rating_packet_receipt_v1.json"
}

14. verify_age_rating_packet.sh sketch

What it is: Tiny verifier ensuring hashes and gates stay honest.

#!/usr/bin/env bash
set -euo pipefail
R="${1:-release-evidence/age-rating/latest/age_rating_packet_receipt_v1.json}"
test "$(jq -r .age_rating_packet_ok "$R")" = "true"
for g in A1 A2 A3 A4 A5 A6; do
  test "$(jq -r ".gates.$g" "$R")" = "PASS"
done
file=$(jq -r .questionnaire_export "$R")
want=$(jq -r .questionnaire_sha256 "$R")
got=$(sha256sum "$file" | awk '{print $1}')
test "$got" = "$want"
echo "age_rating_packet_ok"

PowerShell cousin:

param([string]$Receipt = "release-evidence/age-rating/latest/age_rating_packet_receipt_v1.json")
$r = Get-Content $Receipt -Raw | ConvertFrom-Json
if (-not $r.age_rating_packet_ok) { throw "age_rating_packet_ok false" }
$h = (Get-FileHash $r.questionnaire_export -Algorithm SHA256).Hash.ToLower()
if ($h -ne $r.questionnaire_sha256.ToLower()) { throw "questionnaire hash mismatch" }
Write-Host "age_rating_packet_ok"

Why now: CI can refuse partner zip assembly when someone edits the PDF without updating the receipt.

Indie fit: Free shell; pairs with dual-SKU and freeze verifiers in the same CI job family.

Minimum six-tool stack (if you only have one Saturday)

Add #3/#4 vocabulary sheets before press outreach; add #14 before automated packaging.

Proof table - packet vs cousins

Scenarios A–G

A - Slack screenshot only

Fail A2. Export the real questionnaire PDF and hash it.

B - Steam shows Teen equivalent; press kit says E

Fail A3 / kit honesty. Update kit or reopen questionnaire after content cut.

C - Full game rated higher than fest demo

Pass only with notes. Document demo scope; disable store claims that demos violate (descriptors).

D - Re-exported IARC without updating hash

Fail verifier #14. Re-run A2–A6.

E - Privacy policy exists, age packet missing

Different lane. Ship privacy templates and age packet as sibling folders in the same partner zip.

F - Soft-launch this month, fest later

Use packet as gate. Forward blog #6 should require age_rating_packet_ok before soft traffic spikes.

G - Console cert asks for ESRB certificate you never obtained

Do not fake it. Record IARC/Steam path honesty; consult console process separately—this listicle is packet tooling for Steam-first indies.

Common mistakes

• Treating IARC as optional until submit week.
• Claiming PEGI/ESRB certificate numbers you do not have.
• Mixing privacy, AI disclosure, and age rating into one fuzzy PDF.
• Ignoring fest demo scope softening.
• Forgetting to re-hash after “one more blood splash.”
• Storing the only export on a contractor laptop.
• Updating Steamworks fields without updating storefield_map.md.
• Setting age_rating_packet_ok while A4 is NOT_RUN on titles with violence flags.

Schedule pairing - August–October 2026

Key takeaways

1. Age-rating packets are now an early Q3–Q4 2026 evidence ask—not a submit-week afterthought.
2. Pin questionnaire exports with SHA-256 (A2)—Slack screenshots fail audits.
3. Map Steam storefields to answers (A3) with a written table.
4. Keep descriptors hour-one proof adjacent (A4)—ratings and descriptors are different jobs.
5. Document the exact store URL and capture UTC (A5).
6. Latch BUILD_RECEIPT.age_rating_packet_ok only after A1–A6 PASS (A6).
7. Use PEGI/ESRB pages as vocabulary, not invented certificates.
8. Minimum Saturday stack: IARC + Steamworks + hash + map + receipt + descriptors cousin.
9. Re-verify after gameplay violence/language patches.
10. Pair privacy and AI disclosure siblings without merging schemas.
11. Soft-launch calendars should treat age packet as a hard gate.
12. Forward Resource #54 / Help #56 for list elevation and symptom fixes.

FAQ

What is an age-rating packet for Steam indies?

A dated evidence folder that pins questionnaire exports, storefield maps, optional descriptor captures, store URL proof, and a machine-readable receipt that partners can review without digging Slack.

Do I need PEGI and ESRB certificates if Steam uses IARC?

Often Steam-first PC releases rely on IARC/Steam pathways. Do not invent board certificates. Use PEGI/ESRB references for honest marketing vocabulary and note when you only hold IARC-derived store outcomes.

Is this the same as Steam content descriptors?

No. Descriptors are content warning flags with hour-one proof. Age ratings are board/IARC outcomes. Link them; do not collapse them.

How does this relate to privacy templates?

Privacy covers data handling URLs and Data Safety language. Age packets cover rating questionnaires and store age markers. Same release-evidence tree, different receipts.

When should we refresh the packet?

Any time violence, language, drugs, gambling, or similar content intensity changes—or when Steamworks rating fields are edited.

Can a fest demo keep a softer rating claim?

Only if store copy, descriptors, and questionnaire notes honestly reflect demo scope. Prefer disabling overstated claims for the fest period.

What belongs in BUILD_RECEIPT?

age_rating_packet_ok boolean plus path to age_rating_packet_receipt_v1.json—same pattern as localization_freeze_ok and dual_sku_rehearsal_ok.

Is this legal advice?

No. It is operational tooling for indie evidence hygiene. Console physical SKUs and contested edge cases need competent regional counsel or board processes.

How big should the evidence zip be?

Keep the age-rating folder lean: questionnaire export, storefield map, one store capture, receipt JSON, and only the descriptor captures that justify contested flags. Partners hate 400 MB “compliance dumps” of unrelated trailers. Link dual-SKU and localization receipts by path instead of nesting full copies.

What if Steam regenerates IARC after a content patch?

Treat it like a new freeze: re-export, re-hash, re-run A3–A5, bump receipt created_utc, and refuse to keep the old age_rating_packet_ok green until verifier #14 passes again.

Related reads

• 14 Free Privacy-Policy and Data-Safety Templates for Indie Submissions 2026
• Steam Content Descriptors Demo Hour-One Parity - Next Fest 2026
• Steam / Play / App Store AI Content Disclosure Intake Checklist
• itch + Steam Dual-Depot Dress Rehearsal Before October Upload Peak
• August 2026 Soft-Launch Windows Before October Next Fest — G4 requires age_rating_packet_ok before soft ads
• Localization String Freeze Receipt Before October PO Import
• Your First BUILD_RECEIPT JSON and Upload Log
• Release Evidence Folder Taxonomy for Solo Indies
• Q3 2026 Indie Publisher Diligence Demo Evidence Packets

Closing

October Next Fest upload peak is a terrible week to invent an age rating from memory. Bookmark the IARC and Steamworks paths, hash the export, map storefields, attach descriptor captures when needed, and latch age_rating_packet_ok only when A1–A6 are honest green.

When a partner asks “send the rating packet,” you send a folder—not a Slack collage. That is the whole job of these fourteen free tools before Q3–Q4 2026 submission season peaks.