Malta Gaming Authority Publishes Voluntary AI Gaming Charter

The Malta Gaming Authority, in collaboration with the Malta Digital Innovation Authority, officially launched the AI Gaming Charter on September 18, 2026, a voluntary, principles-based framework promoting the ethical and responsible use of artificial intelligence across gaming operations and complementing the EU AI Act.

The two authorities marked the launch with an event attended by representatives of the gaming industry, the public sector and the technology community. Discussion at the event covered the opportunities and challenges AI presents for the sector, as well as responsible governance. Developed jointly by the MGA and the MDIA, the charter provides sector-specific guidance alongside existing legal and regulatory frameworks.

The MGA said artificial intelligence is already being used across a range of gaming-related functions, including player protection, fraud detection, customer interaction and operational decision-making, and that the charter is intended to help organisations build governance, human oversight and ethical checks into how AI systems are designed, deployed and used.

Speaking at the launch event, MGA chief executive Charles Mizzi said: “Our role as a regulator is not to stand in the way of innovation, but to help create the certainty and confidence needed for innovation to flourish responsibly.”

Scope and Legal Status

The charter document, published under the reference G-SPG-025-01 with its first issue dated September 18, 2026, states that it is voluntary in nature, creates no new legal or regulatory obligations for gaming licensees, and does not modify obligations already applying under the EU AI Act, the General Data Protection Regulation, the Data Act or the Cyber Resilience Act. The document describes the charter as one of the first initiatives in Europe to set out AI principles specific to the gambling sector.

The charter applies to AI systems used across gaming operations irrespective of risk classification, covering internal and back-office uses as well as customer-facing and player-impacting uses. Its definition of an AI system mirrors the definition in the EU AI Act, while rules-based automation and robotic process automation without AI functionality generally fall outside its scope.

Licensees are encouraged to distinguish between lower-impact systems, used for internal, operational or administrative purposes, and higher-impact systems, used in or materially influencing player-facing, responsible gambling, fraud, anti-money laundering, know-your-customer, account restriction, eligibility or intervention decision-making. Higher-impact systems should be subject to stronger safeguards, such as clearer documentation, testing and validation, defined human oversight, ongoing monitoring, escalation procedures and appropriate records.

While voluntary, the charter strongly encourages all MGA licensees to adopt it. Adopting licensees are encouraged to designate one or more responsible individuals from compliance, data, technology or AI-related functions as internal points of contact for applying its principles.

Study Finds Uneven Adoption Across Licensees

To inform the charter, the authority carried out a study on the use and adoption of AI within Malta-licensed gaming operations, through a survey distributed to all MGA licensees on a voluntary basis and in-depth interviews with selected licensees. The document notes that responses represented a limited subset of the sector.

The study found that AI adoption across the sector remains uneven and selective rather than widespread. Respondents most often reported fully deployed systems, or activity beyond the proof-of-concept stage, in operational optimisation and data analytics and in customer support chatbots, with recommendation engines, player profiling, fraud detection and anti-money laundering, and responsible gambling behavioural modelling deployed to a lesser extent. By contrast, most responses indicated AI was not in use, or not applicable, in dynamic odds setting and risk management, regulatory reporting and AI-powered live casino applications.

On governance, the study found formal AI strategies remain uncommon. A minority of organisations reported having a formal AI strategy or roadmap, while a larger group said one was still being developed. A small number of organisations said they disclose AI usage to customers, while most respondents stated that human oversight is always applied to AI-based decisions. Among business-to-business licence holders, only one respondent said it provides clients with documentation on how its AI systems function.

Principles, Oversight and Reporting Duties

On transparency, the charter says players and users should be told clearly when they are engaging with an AI system, at the latest from the point of first interaction or exposure. It says AI washing, the practice of overstating how AI is actually used or what it can do, should be avoided, such as presenting conventional software as AI or marketing it as a guarantee of fairness, accuracy or safety. The document also addresses the EU AI Act’s transparency obligations for AI-generated content, under which providers of systems that generate synthetic audio, image, video or text must mark outputs in a machine-readable format, while deployers must clearly disclose deep fakes.

On fairness, the charter lists variables that may operate as proxies for protected or sensitive characteristics in the gaming context, among them geolocation, language, deposit patterns, device type, time-of-day activity, payment behaviour, play patterns, account history and customer interaction data. Licensees should maintain and periodically review a sector-relevant list of potential proxy variables for higher-impact systems. A separate environmental sustainability section covers sustainable procurement, energy efficiency, carbon footprint reduction and responsible decommissioning of hardware.

For player-facing conversational or support AI, licensees should define human-escalation triggers, including repeated low-confidence outputs, detected distress signals, indications of vulnerability or gambling harm, and requests for human support, with conversations transferred to a suitably trained human agent. For higher-impact systems, testing and validation should include proportionate adversarial robustness testing, red-teaming or equivalent challenge exercises, supported by machine-learning operations practices such as model version control and rollback procedures.

Any licensee using AI systems should designate a senior accountable person for AI governance, such as a chief AI officer or equivalent role, and establish a multidisciplinary AI oversight or ethics committee or an equivalent documented governance forum. Licensees should notify the MGA of significant changes or updates to AI systems that affect gaming operations. Serious incidents involving high-risk AI systems must be reported under the EU AI Act to the Malta Digital Innovation Authority or the Information and Data Protection Commissioner, depending on the domain.

The charter resulted from sector-wide surveys, targeted discussions with gaming licensees and a dedicated consultation process. On May 8, 2026, the MGA launched a targeted consultation on the proposed charter, developed with the MDIA as voluntary, principles-based guidance designed to complement existing legal and regulatory frameworks, including the EU AI Act.

MDIA chief executive Kenneth Brincat said organisations need practical ways to understand where AI is being used, manage the associated risks and keep accountability and human oversight in place. The charter, he said, “translates these principles into practical, sector-specific guidance, bringing together MDIA’s expertise in AI governance and the MGA’s deep understanding of the gaming sector.”

The document states the MDIA is designated as Malta’s lead market surveillance authority, notifying authority and single point of contact under the EU AI Act, with responsibility for supervising, investigating and enforcing compliance with the act for AI systems placed on or used in the EU market within Malta.

The MGA may facilitate structured engagement on the charter on a yearly basis, including discussions, surveys, workshops or consultations. The document states the charter may be reviewed and updated periodically to reflect changes in the law, ethical standards and technology.