Ask people across the industry what they are talking about this autumn and artificial intelligence will come up in almost every conversation. It is in player support, marketing, product design, fraud checks and now, increasingly, in the way regulators themselves work. The question has shifted. Operators are no longer asking whether AI belongs in their business. They are asking how regulators will expect them to use it, and how to show that they are using it responsibly.
Regulators are using AI too
One of the clearest signals came from Malta. The Malta Gaming Authority (MGA) set out in its 2025 annual report, published on 7 July 2026, that it has started using AI in two specific areas. The first is a tool inside its criminal probity checks, which scans the seed data submitted with licence applications and flags anything that needs a closer look. The second is in reviewing the regular performance returns operators file, where AI helps spot patterns and anomalies that might otherwise take longer to surface.
The important detail is that people still make the decisions. Staff review each flag against the jurisdiction involved and the authority’s own risk criteria before acting. The MGA’s chief executive has been direct about the limits of the technology, saying that AI tools are not infallible and that human oversight and verification sit at the centre of every use. In practice, the regulator is using AI to decide where to look, not what to conclude.
The same report shows how selective the MGA remains. It received 38 new gaming licence applications during the year and issued 19 of them. It also reviewed 109 web addresses suspected of unauthorised gaming activity and confirmed that 42 were carrying fraudulent references to the MGA or its licensees, which were added to its public warning list.
Malta is writing the rulebook
Regulation is following the technology. The MGA has confirmed that it is drafting what it expects to become the first dedicated AI governance framework designed specifically for gaming operators. The timing is linked to the EU AI Act, which is moving steadily towards implementation. The MGA’s chief executive has argued that AI is acceptable where it makes players safer and strengthens oversight, but becomes unacceptable when it nudges vulnerable players or obscures who is accountable.
That framework has now taken a concrete form. Malta’s AI Gaming Charter, developed by the MGA together with the Malta Digital Innovation Authority, gives licence holders a voluntary code of conduct for adopting AI in a transparent, accountable and fair way. Its central requirement is clear: licensees remain fully accountable for outcomes produced by the AI they use, and human supervision must run through every embedded decision.
Malta’s position matters beyond its borders. Gaming supports around 19,150 jobs in the country, and the MGA’s 2025 accounts show that B2B suppliers are a growing part of the picture even as the number of B2C licences has declined to 131. Regulatory direction set in Malta is likely to influence how other jurisdictions and suppliers approach AI, which is why operators elsewhere should pay attention.
The UK has already named the risks
The UK Gambling Commission has been more explicit about the threats than the benefits. In an update to its anti-money laundering guidance in April 2025, it warned that criminals are using AI to create fake documents, deepfake videos and face-swapped images in order to get past identity checks. Operators were told to train staff to recognise AI-generated material during verification.
The same update raised concerns about crypto, which the regulator said should be treated as a high-risk channel for money laundering. It also flagged the popularity of crash games on illegal crypto casinos, noting that their quick cash-outs and short rounds can make suspicious activity harder to spot. Operators were urged to strengthen their monitoring of wagering patterns in these games.
For operators, the message is that AI is now part of both sides of the compliance equation. The same tools that help a business verify customers can be used by criminals to fool verification. A compliance team that treats AI as a simple productivity gain without assessing the risks it introduces is exposed.
Where AI is showing up in the business
Regulation is only one part of the story. Across the industry, AI is being used to personalise offers, to group players by behaviour, and to power customer support. One analysis of 2026 trends describes AI being used to group users and show offers at the right time, while another points to AI-driven hyper-personalisation as a central theme for the year. Operators are also using AI in fraud detection, risk management and responsible gambling tools.
Product development is moving in parallel. Short-round formats such as crash and instant games have become a category in their own right, rather than a novelty, and studios are applying the same fast mechanics to coin pushers and ball-drop games. Crypto payments are increasingly a standard cashier option. Each of these changes creates new compliance questions, which is why AI and regulation are so closely connected.
What operators should do now
The sensible response is not to wait for a final rulebook. Several practical steps stand out, although these are our analysis rather than requirements set out by any regulator.
- Map every place AI is used in the business, including player support, marketing, verification and reporting. Many firms are surprised by how wide the list is.
- Keep a named human owner for each AI-driven decision, particularly those that affect whether a player is accepted, restricted or flagged.
- Test identity verification against AI-generated documents and deepfake images, and train staff to spot them.
- Review how AI-driven offers and personalisation could affect vulnerable players, and document the safeguards in place.
- Track the Malta charter and the EU AI Act, and prepare for the possibility that voluntary guidance becomes an expectation at licensing or audit.
The real test is accountability
The most useful way to think about AI in iGaming right now is through accountability. Regulators in Malta and the UK are not hostile to the technology. Both are using it, and both are asking the same question: who answers for the outcome? Operators that can show a clear chain of human responsibility, documented safeguards and tested controls will be in a far stronger position than those that treat AI as a black box.
The industry will keep debating how far AI can go. The more pressing task is to get the basics right now, while the frameworks are still taking shape. Operators that do this early will find that compliance becomes a source of confidence, not a brake on growth.
If you want to follow how these rules develop, sign up for the BoiG newsletter, which covers the latest news, offers and announcements. The AI and Compliance sections of the site are the place to watch for further coverage as the MGA framework and the EU AI Act move forward.
