MGA AI Gaming Charter: Malta Regulator Sets Out Voluntary AI Principles for iGaming Operators
MGA and MDIA launch a voluntary AI Gaming Charter for iGaming licensees, covering transparency, governance and player protection — without creating new legal obligations.
The Malta Gaming Authority (MGA), working alongside the Malta Digital Innovation Authority (MDIA), launched the AI Gaming Charter on 18 September 2026, introducing a voluntary, principles-based framework for the ethical and responsible use of artificial intelligence across the gaming sector. The MGA AI Gaming Charter applies to all entities holding an MGA licence and is intended to guide, not mandate, how operators and suppliers govern AI systems used in both back-office and player-facing functions. Crucially, the Authority has been explicit that the Charter creates no new legal obligations and does not replace or alter existing duties under the EU AI Act or GDPR.
What the MGA Launched
The AI Gaming Charter, published under reference G-SPG-025-01, was developed jointly by the MGA and MDIA following what the regulator describes as extensive industry collaboration, including sector-wide surveys, targeted discussions with licensees and a dedicated consultation process. It applies to "Gaming Licensees" — B2C and B2B operators regulated by the MGA, including group entities under a Corporate Group Licence.
The Charter's scope is tied to the EU AI Act's definition of an "AI System" under Article 3(1), covering both internal and back-office tools and customer-facing, player-impacting applications. Rules-based automation or robotic process automation that does not meet that legal definition falls outside the Charter's scope. Adoption itself remains a voluntary act: licensees are "strongly encouraged" rather than required to sign on, and those that do are encouraged to appoint an internal point of contact for AI governance matters.
Speaking at the launch event, MGA chief executive Charles Mizzi framed the initiative as a balance between oversight and innovation. "Our role as a regulator is not to stand in the way of innovation, but to help create the certainty and confidence needed for innovation to flourish responsibly," he said. MDIA chief executive Kenneth Brincat added that "trust is fundamental to the responsible adoption of AI," and that the Charter "translates these principles into practical, sector-specific guidance" by combining MDIA's AI governance expertise with the MGA's understanding of the gaming sector.
Why Now: The MGA's Study on AI Use and Adoption
A central section of the Charter document, titled "Study on AI Use and Adoption in Gaming," sets out the regulator's rationale for acting. The study combined a survey distributed to MGA licensees with a series of in-depth interviews. The MGA has not published a numerical breakdown of respondents and states that the results represent a limited subset of the sector rather than a statistically representative measurement of all MGA licensees; the findings below should be read as indicative rather than as market-wide adoption rates.
The headline conclusion is that AI adoption across Malta's licensed gaming sector is "uneven and generally selective rather than widespread." Operational optimisation, data analytics and customer-support chatbots emerged as the most mature use cases, while recommendation engines, player profiling, fraud and anti-money-laundering detection, and responsible-gambling behavioural modelling were reported as less developed. Adoption was described as still limited in areas including dynamic odds setting and risk management, regulatory reporting, player acquisition, HR functions, onboarding and KYC, payments, and AI-assisted live casino products. The study also noted that some licensees use general-purpose coding assistants — the Charter cites Claude Code and GitHub Copilot as examples — alongside generative tools for image and video production and compliance monitoring.
On governance, the MGA found that only a minority of licensees currently have a formal AI strategy or roadmap in place, with a larger group describing one as still in development. Awareness of EU AI Act risk-classification requirements was mixed, and while most respondents said human oversight is "always applied" to AI-based decisions, mechanisms for contestability and human review of AI-generated outcomes were described as inconsistent. Few licensees reported disclosing AI use to customers or obtaining explicit consent for automated processing, and B2B respondents in particular reported limited transparency to clients about how their AI systems function.
The Charter's Core Principles
The Charter organises its guidance around seven main areas.
Transparency, accountability and explainability. Licensees are encouraged to disclose AI use to players "at latest from the point of first interaction," avoid overstating AI capabilities — what the Charter terms "AI washing" — and maintain documentation and human-readable explanations for individuals affected by automated decisions.
Fairness and non-discrimination. The Charter flags that bias can originate in training data, design choices or domain-specific factors, and recommends bias testing, diverse datasets and review of proxy variables such as geolocation or deposit patterns that could produce discriminatory outcomes.
Environmental sustainability. The document acknowledges the energy and carbon footprint associated with AI systems and encourages sustainable procurement and energy-efficient model use.
Data protection, security and governance. The Charter reiterates that personal data processed by AI must meet GDPR requirements, pointing licensees toward data minimisation, data protection impact assessments and retention policies — obligations that already exist independently of the Charter.
Human oversight and responsibility. Described as a "cornerstone" of the framework, this principle encourages defined escalation triggers for AI-driven tools such as chatbots and ongoing staff training on AI literacy.
Reliability, safety and robustness. The Charter recommends adversarial testing for higher-impact systems, drift monitoring and rollback or kill-switch mechanisms.
Compliance, monitoring and AI governance. Licensees are encouraged to maintain an inventory of AI systems in use, assign a senior accountable individual — the Charter suggests a role akin to a Chief AI Officer — and consider AI System Impact Assessments proportionate to risk.
Throughout, these are recommendations the Charter encourages licensees to adopt, not requirements it imposes; the document distinguishes its own guidance from the legally binding requirements that already exist under separate EU legislation.
Voluntary, Not Law
The MGA has been unusually direct on this point. The Charter states it "is voluntary in nature and does not create new legal or regulatory obligations for Gaming Licensees, nor does it modify, expand or replace any obligations that already apply under existing national or EU law, including the EU Artificial Intelligence Act... the EU Cyber Resilience Act, the General Data Protection Regulation (GDPR), the Data Act, and where applicable, international instruments such as the Council of Europe Framework Convention on Artificial Intelligence." It further clarifies that nothing in the document should be read as imposing new contractual, reporting or operational obligations.
In practical terms, the Charter does not create a new gambling law, does not implement, modify or replace the EU AI Act or GDPR, does not automatically become a licence condition, does not require every licensee to adopt it, and does not prohibit AI systems or AI-powered player profiling. The Charter itself states that it does not create new legal or regulatory obligations. Existing legal and regulatory requirements — including sanctions available under GDPR and the EU AI Act — remain applicable independently of the Charter, exactly as they were before its publication.
Relationship to the EU AI Act and GDPR
The Charter references the EU AI Act extensively, citing specific provisions including Article 3(1) definitions, Article 5 prohibited practices, Article 6 high-risk classification, Article 10 data quality requirements, Article 50 transparency rules for AI-generated content, and Article 53 obligations for general-purpose AI providers. An annex maps Charter principles against the AI Act and GDPR, distinguishing which provisions are already legally binding from which reflect voluntary good practice under the Charter alone.
The MGA is explicit that the Charter does not implement the AI Act and is not a substitute for AI Act compliance. Whether a gambling-sector AI system is legally "high risk" remains governed exclusively by the AI Act itself and related guidance from the EU AI Office. The Charter's own practical distinction between "lower-impact" and "higher-impact" systems is an internal operational tool for licensees and does not replace, or feed into, that legal classification.
On GDPR, the Charter treats existing data protection law as the binding backbone for any AI system processing personal data, referencing the MGA's 2018 Industry Guidelines on the GDPR as the relevant compliance reference point. It does not create new GDPR obligations, and it does not alter automated-decision-making rules such as those under GDPR Article 22, which continue to apply on their own terms.
AI, Player Protection and Profiling
The Charter acknowledges AI's growing role in identifying potentially risky play, detecting behavioural change and supporting responsible-gambling interventions, while flagging the risks of false positives, false negatives, biased models and over-reliance on automated decisions without adequate human review. It does not mandate the use of AI-driven responsible-gambling tools.
Nor does the Charter generally prohibit AI-powered player profiling, a practice that can draw on signals such as location, deposit and payment behaviour, device data, time of play and account history. It does not, however, affirmatively endorse any particular profiling practice. The document's focus is on how such profiling is governed — fairness, transparency, data protection, human oversight and a player's ability to challenge a consequential automated decision — rather than on approving or prohibiting the underlying activity.
Generative AI and AI Governance in Practice
The Charter also touches on generative AI uses, including chatbots, AI-generated text, image and video content, and the risk of deepfakes, connecting these to EU AI Act transparency requirements for AI-generated content under Article 50 and cautioning against "open-washing" of AI systems marketed as open source.
For operators considering how to respond, the Charter's practical recommendations amount to a governance checklist rather than a compliance mandate: identifying which AI systems are in use, determining which affect players directly, assigning internal accountability, documenting systems and decisions, and maintaining meaningful human oversight, particularly for higher-impact use cases.
Why It Matters for iGaming
The Charter is notable less for its legal weight than for what it signals: a Malta-based regulator building gambling-specific AI governance guidance on top of existing EU law, at a moment when AI adoption in gaming is expanding faster than formal oversight structures in many licensed operations. The MGA describes the initiative as "one of the first" of its kind in Europe tailored to the gambling sector specifically — a more measured claim than "world first," and a characterisation attributed to the regulator rather than an independently verified fact.
Conclusion
Malta has not introduced a new AI gambling law. What the MGA and MDIA have published is a voluntary, sector-specific framework designed to help licensees apply responsible AI governance practices alongside — not instead of — their existing obligations under the EU AI Act, GDPR and other applicable law. Its significance lies in formalising a gambling-specific framework for AI governance in Malta, even as the underlying legal requirements remain exactly as they were before 18 September 2026.
Sources
- Malta Gaming Authority, "MGA launches AI Gaming Charter following extensive industry collaboration," 18 September 2026
- Malta Gaming Authority, AI Gaming Charter (G-SPG-025-01, PUBLIC, 18/09/2026)
