AI Rules for Licensed iGaming Operators, Explained in Plain English

Key takeaways

• No gambling regulator has issued a binding AI rulebook yet. The UK and Malta have published AI-specific material, and neither adds a new legal duty on its own.
• Your existing license obligations still apply to AI. A regulator will judge the outcome, whether a person or a model produced it.
• The EU AI Act is the binding layer. Its high-risk rules now apply from December 2, 2027, after the Digital Omnibus delay.
• Transparency is the common thread. Tell players when they are dealing with AI, and be able to show how decisions were made.

Three layers of rules now touch AI at a licensed iGaming operator: your license conditions, AI-specific guidance from gambling regulators, and horizontal law such as the EU AI Act and GDPR. This guide covers the UK, Malta, and the EU in plain English, with links to the primary sources. Last updated October 13, 2026.

At a glance

What does the UK Gambling Commission expect from operators using AI?

Today it expects what it always has: that your operation meets your license conditions and the licensing objectives. The Commission has published its approach to AI, and that page sets no direct requirements for licensees. It does say the Commission will seek to understand how operators use AI and check that the use is consistent with the licensing objectives. The same page says the Commission’s own AI use must include appropriate human intervention, governance, and assurance. Operators are wise to hold themselves to the same standard.

In practice, assume any AI that touches player protection, affordability, or marketing can be asked about in a compliance review. Keep a record of what the AI does, who approved it, and how a person can step in. Source: UK Gambling Commission, The Commission’s approach to artificial intelligence.

What is the Malta Gaming Authority’s AI Gaming Charter?

It is a voluntary framework published in September 2026 by the Malta Gaming Authority, developed with the Malta Digital Innovation Authority. It adds no new legal obligations and sits alongside the EU AI Act and GDPR. The charter centers on four ideas: transparency about how AI is designed and used, data governance, non-discrimination, and human control. It also warns against “AI washing,” which means overstating what a system can do.

Two practical asks stand out. Tell players they are interacting with an AI system no later than their first interaction, and name an internal point of contact for the charter’s principles. Even for operators outside Malta, the charter is a useful template for what a regulator may come to expect. Sources: MGA launch announcement and the AI Gaming Charter (PDF).

When do the EU AI Act rules apply to iGaming operators?

The EU AI Act is binding, and its timeline moved in 2026. The Digital Omnibus, now in force as Regulation (EU) 2026/1744, pushed the high-risk obligations for the Annex III categories from August 2, 2026 to December 2, 2027. High-risk systems tied to existing product law move to August 2, 2028. Some transparency duties for synthetic content, and new prohibitions, apply from December 2, 2026.

Whether your AI is high-risk depends on what it does. Annex III lists areas such as employment and creditworthiness, so a tool that screens job candidates or scores customers for credit deserves a close look, while a service desk assistant is unlikely to qualify. Classify each use case and write down the reasoning. For systems that are high-risk, Article 14 requires human oversight that lets a person understand, monitor, and override the system. Sources: Orrick summary of the Digital Omnibus final text and Article 14, EU AI Act.

Does GDPR limit automated decisions about players?

Yes. Article 22 of GDPR gives people a right not to be subject to a decision based solely on automated processing when it has legal or similarly significant effects, with limited exceptions and required safeguards. For an operator, think of account restrictions, payment holds, or exclusions made without a person involved. Build a review step and a way for the player to contest the outcome. Source: GDPR Article 22.

A five-step plan that works in every jurisdiction

• List every AI use. Include vendor tools and features switched on inside other software.
• Classify each one. Note whether it touches players, money, safety, or staff, and which rules could apply.
• Assign an owner and an approver for each use, by name.
• Keep a decision record. Log the action, the policy applied, who approved it, and when.
• Tell players the truth. Say when they are dealing with AI, and claim only what the system does.

For what regulators are asking operators today, read What Regulators Are Asking Operators About AI. For the idea behind the decision record, read What Accountable AI Means in Practice.

Sources and further reading

• UK Gambling Commission: The Commission’s approach to artificial intelligence
• Malta Gaming Authority: AI Gaming Charter launch announcement
• Malta Gaming Authority: AI Gaming Charter (PDF)
• Orrick: EU AI Act Update, Digital Omnibus Finalizes 8 Compliance Changes
• European Commission: AI Omnibus enters into force
• EU AI Act Service Desk: Article 14, human oversight
• GDPR Article 22 (official text): automated individual decision-making

This guide is general information, not legal advice. Regulatory expectations reflect published material at the time of writing. Verify against the relevant authority and your counsel before relying on any summary.

Talk to us about your own AI inventory

Future8 helps licensed operators put AI to work with a decision record behind every action. Book a demo and bring your compliance lead.