Share This Article
The EU AI Act for gambling operators, suppliers and affiliates has entered its enforcement phase. Since 2 August 2026 the transparency rules of Article 50 apply, the ban on manipulative AI has been biting for well over a year, and the high risk obligations have moved to 2027 and 2028. Each of these changes lands differently on operators, on suppliers and on affiliates, and the analysis below explains how.
A recurring pattern is visible in practice. Gambling companies read the headlines about a delay and quietly switch their compliance programmes off. That reading of the Digital Omnibus, published in the Official Journal on 24 July 2026, is inaccurate and it creates real exposure. The Omnibus reshaped the AI Act without touching its logic, as covered in a previous post. Some obligations moved to 2027. Others applied from 2 August 2026.
Below are the five questions that gaming clients have been raising over the past few days.
Which updates of the EU AI Act matter most for the gambling sector?
Three of them carry practical consequences today.
The prohibited practices have applied since February 2025. The ban under Article 5 on manipulative AI came into force at that date, as flagged on this blog at the time, and it is enforceable law right now. The gambling sector is particularly exposed here. Consider an AI engine that adjusts game volatility, odds or bonus triggers when a player begins to show markers of harm. That is precisely the behavioural exploitation that Article 5 was designed to prohibit, and the sanctions reach 35 million euro or 7% of global turnover.
The high risk timeline has moved, but only for high risk systems. The Omnibus postponed standalone high risk systems under Annex III to 2 December 2027, and embedded systems under Annex I to 2 August 2028. This gives genuine room to manoeuvre on AI credit and affordability scoring and on player risk rating tools.
Transparency was not postponed at all. The point is developed below, since it is the element that most companies overlooked.
The practical sequence is the same in every project. Map every AI system in use, classify each of them by risk, and build the controls that follow from the classification. Earlier posts on this blog set out how to structure an AI governance framework and the wider legal obligations for operators. A postponed deadline gives a company time to prepare, and the point that constantly needs explaining to clients is that it does not give permission to stop.
How does the 2 August 2026 transparency requirement affect gambling operators?
This is the obligation that has just become applicable, and it was excluded from the postponement.
Article 50 applies regardless of whether a system qualifies as high risk. If a company places AI in front of a player, the obligation attaches.
Two duties reach gambling operators directly.
Disclosure of chatbots. A player interacting with an AI support agent has to be informed that the interlocutor is artificial. The obligation matters most in sensitive flows such as self exclusion requests and safer gambling conversations, where a bot that misreads the situation creates a regulatory problem in addition to a service failure.
Marking of synthetic content. Marketing copy, promotional artwork and game imagery generated by AI must carry markers, visible and machine readable, identifying the content as artificial.
There is transitional relief on timing. Systems already on the market before 2 August 2026 have until 2 December 2026 to implement the machine readable marking required by Article 50(2). The disclosure duties, however, have applied since 2 August. Sanctions here reach 15 million euro or 3% of global turnover.
One remark deserves emphasis on this point. The argument that a company is only a deployer offers no protection, because the duty follows the system as far as the player, rather than following the licence.
Will these updates change how gambling regulators set requirements for licensees?
They will, although the process will take time and will not take the form that most people anticipate. The AI Act is horizontal legislation and it does not rewrite licence conditions by itself. What it does is establish the baseline on which gaming regulators are now building.
The movement has already started. The Italian gambling authority, ADM, requires licensees to address responsible gambling “also with the use of AI”, a formulation broad enough to leave the detail to operators. The UK Gambling Commission has been explicit about wanting to use AI to sharpen its own supervision, from the detection of breaches to the policing of advertising directed at minors.
The direction of travel is towards continuous compliance and away from static software testing performed at a single point in time. Authorities such as the Maltese MGA and the German GGL are likely to follow. In practice this means licensing workflows organised around audit trails and around explainability, where a licensee has to demonstrate why an algorithm reached a particular decision concerning a particular player.
There is an honest tension in all of this. Regulators themselves acknowledge that their current frameworks were not designed for AI, so guidance and supervisory pressure will arrive well before formal legislation does.
How will gambling suppliers and affiliates be affected?
The impact differs considerably, and the division between provider and deployer determines who carries the heavier burden.
For B2B suppliers the pressure is substantial. A company that builds an AI system is normally its provider, and providers hold the more demanding obligations, namely technical logging, documentation and models that an operator can genuinely audit. Contracts deserve equal attention, since liability is moving firmly towards strict compliance indemnities on the vendor side. The timing has made this worse. On 30 July 2026 the UK Gambling Commission raised the risk rating for gambling software suppliers from low to medium, the only such change in its report, on the basis of AI generated false documents, deepfakes and face swaps used to circumvent KYC controls.
For affiliates the exposure runs through Article 50 and through marketing. Automated SEO output, synthetic copy and deepfake creatives have to be labelled, and the alternative is exposure to consumer deception sanctions in a channel that regulators are now monitoring with AI tools of their own.
The risk that emerges most often in supplier mandates is a subtler one. An operator that substantially customises a vendor’s AI system can be requalified as a provider, and the heavier obligations then follow the operator.
Providers and deployers: the operational consequences
| Impact area | Providers (B2B suppliers) | Deployers (B2C operators and affiliates) |
|---|---|---|
| Primary role | Build and place AI systems on the market | Use AI systems in player facing operations |
| Core burden | Technical logging, documentation, auditability | Transparency, disclosure, human oversight |
| Article 50 | Enable machine readable marking at source | Display disclosures and label synthetic content |
| Contracts | Strict compliance indemnities, audit rights | Pass through liability, vendor due diligence |
| Principal risk | Provider grade duties, higher AML risk rating | Requalification as a provider after customisation |
Is the gambling industry prepared for the changes?
Readiness across the sector is markedly uneven.
Tier one operators are in reasonable condition. They have built legal technology compliance teams, they treated the AI Act as a board level matter, and most of them arrived at 2 August with their transparency obligations already covered.
The middle of the market is in a different position. A considerable number of mid size operators, suppliers and affiliates filed the AI Act away as a distant IT problem, and the postponement of the high risk deadlines made that misconception worse by producing a false sense of security. The reasoning commonly given is that the rules have been delayed and there is therefore time to wait. The rules that were delayed, however, are not the rules that became applicable on 2 August.
The message bears repeating, because it continues to be necessary. The postponement is time to prepare rather than time to rest, and the risk at this stage is less about non compliance in the abstract and more about being unprepared for a framework that is already in motion.
Companies that use this window to classify their systems, to fix their transparency stack and to build integrated AI governance will convert compliance into a commercial advantage. Those that do not will be dealing with the same work under pressure, at a moment of their regulator’s choosing rather than their own.
Giulio Coraggio heads the Italian Intellectual Property & Technology department at DLA Piper and co-chairs the firm’s global Gaming & Gambling group. Feel free to contact Giulio at giulio.coraggio@dlapiper.com and explore the AI Act Guide on GamingTechLaw.com and DLA Piper’s Gambling Laws of the World guide, or get in touch.
