Share This Article
The EU AI Act for gambling operators, suppliers and affiliates has entered its enforcement phase: since 2 August 2026, the Article 50 transparency rules are applicable, the ban on manipulative AI is already biting, and the high-risk obligations have shifted to 2027 and 2028 — and below I unpack what each change means for operators, suppliers and affiliates.
For gambling operators, suppliers and affiliates, this is decisive. The grace period is now officially ticking. And the compliance clock is running fast.
In my daily practice, I keep meeting companies of the gambling sector who read the headlines about a “delay” and quietly switched their compliance programmes off. That reading is wrong — and it is dangerous. The Digital Omnibus, published on the Official Gazette on 24 July 2026, reshaped the Act without softening its logic — as I covered here. Part of it moved to 2027. Part of it landed yesterday.
So let me answer the five questions gaming clients are asking me this week.
The EU AI Act for the gambling sector: which updates matter most, and what must change?
Three things matter. The rest is background.
- The prohibited practices are already live. The Article 5 ban on manipulative AI has applied since February 2025 — a point I flagged when the prohibited practices came into force. This is not future law — it bites today. And here is where the gambling sector is uniquely exposed. Imagine an AI engine that dynamically adjusts game volatility, odds or bonus triggers when a player shows markers of harm. That is exactly the behavioural exploitation Article 5 was built to stop. The exposure is severe: fines reach €35 million or 7% of global turnover.
- The high-risk clock moved — but only for high-risk. The Omnibus pushed standalone high-risk systems under Annex III to 2 December 2027, and embedded systems under Annex I to 2 August 2028. That gives genuine breathing room for AI credit and affordability scoring, and for player risk-rating tools.
- Transparency was not delayed. More on that in a moment, because it is the part most people missed.
What should you actually do? Map every AI system you run. Classify each by risk. Build the controls that follow — I set out how to structure an AI governance framework and the wider legal obligations for operators in earlier posts. Companies often overlook the fact that a delayed deadline is runway to prepare, not a licence to wait.
How does the 2 August 2026 transparency requirement impact gambling operators?
This is the one that just went live. As of yesterday, Article 50 is active — and it was carved out of the postponement entirely.
It reaches almost everyone. It does not care whether your system is “high-risk.” If you put AI in front of a player, it applies to you.
Two duties hit gambling operators directly:
- Chatbot disclosure. When a player interacts with your AI support agent, they must be told it is AI. This matters most in sensitive flows — self-exclusion, safer-gambling conversations — where a bot misfiring is not just a service failure but a regulatory one.
- Synthetic content marking. AI-generated marketing copy, promo artwork and game imagery must now carry visible and machine-readable markers flagging them as artificial.
There is transitional relief on timing. Systems already on the market before 2 August 2026 have until 2 December 2026 to implement the machine-readable marking under Article 50(2). But the core disclosure duties started yesterday. And the penalty for getting this wrong runs up to €15 million or 3% of global turnover.
My view on this is simple. Do not treat “we are only a deployer” as a shield. The duty follows the system to the player, not the licence.
Will these updates change how gambling regulators set requirements for licensees?
Yes — though not overnight, and not in the way people expect. The AI Act is horizontal law. It does not rewrite your licence conditions by itself. What it does is set the baseline that gaming regulators are now building on.
We are already seeing the shift. The Italian gambling authority (ADM) tells licensees to tackle responsible gambling “also with the use of AI” — a broad phrase that leaves the detail to operators. Meanwhile, the UKGC has been open that it wants to use AI to sharpen its own monitoring, from spotting breaches to policing advertising aimed at under-18s.
The trajectory is clear. National authorities — I expect bodies such as Malta’s MGA and Germany’s GGL to move this way — are drifting from static, point-in-time software testing toward continuous compliance. In practice, that means licence workflows built around audit trails and “explainable AI” pathways, where a licensee must show why an algorithm made a given decision about a player.
One honest tension. Regulators themselves admit their current frameworks are not equipped for AI. So expect guidance and supervisory pressure to arrive faster than formal legislation does.
How will gambling suppliers and affiliates be impacted?
Differently — and this is where the provider/deployer split decides who carries the weight.
For B2B suppliers, the pressure is real. If you build the AI system, you are typically the provider, and providers hold the heavier duties: technical logging, documentation, and models that operators can genuinely audit. Watch the contracts, too. Liability is shifting hard toward strict compliance indemnifications on the vendor side. And the timing stings: on 30 July 2026 the UKGC raised the risk rating for gambling software suppliers from low to medium — the only such change in its report — driven by AI-generated fake documents, deepfakes and face swaps used to bypass KYC.
For affiliates, the exposure runs through Article 50 and marketing. Automated SEO output, synthetic copy and deepfake creatives must be labelled — or you face consumer-deception fines, in a channel regulators now watch with AI tools of their own.
The real risk I see when advising suppliers is subtler. If an operator substantially customises a vendor’s AI system, that operator can be requalified as a provider. The heavier obligations then follow it.
Providers vs. Deployers: core operational impacts
| Impact area | Providers (B2B Suppliers) | Deployers (B2C Operators / Affiliates) |
|---|---|---|
| Primary role | Build and place AI systems on the market | Use AI systems in player-facing operations |
| Core burden | Technical logging, documentation, auditability | Transparency, disclosure, human oversight |
| Article 50 | Enable machine-readable marking at source | Display disclosures; label synthetic content |
| Contracts | Strict compliance indemnities, audit rights | Pass-through liability; vendor due diligence |
| Key risk | Provider-grade duties; higher AML risk rating | Requalification as a provider after customisation |
Is the gambling industry well prepared for the changes?
Honestly? Readiness is fragmented. Sharply so.
Tier-1 operators are in decent shape. They have stood up legal-tech compliance teams, they treated the AI Act as a board-level issue, and most walked into yesterday’s transparency rollout ready. It shows.
The mid-tier is another story. Many mid-size operators, suppliers and affiliates parked the AI Act as a distant IT problem. And that misconception got worse when the high-risk deadlines slipped — because it handed everyone a false sense of security. The reasoning went: it’s delayed, so we can wait. But the part that was delayed is not the part that landed on 2 August.
So my message is the one I keep repeating, because it keeps being needed. The postponement is runway, not rest. Now that the Act is switching on in stages, the real risk is not non-compliance — it is being unprepared for a system already in motion.
The operators who use this window to classify their systems, fix their transparency stack and build integrated AI governance will turn compliance into an edge. The rest will scramble. Preparation starts now.
Giulio Coraggio heads the Italian Intellectual Property & Technology department at DLA Piper and co-chairs the firm’s global Gaming & Gambling group. Feel free to contact Giulio at giulio.coraggio@dlapiper.com and explore the AI Act hub on GamingTechLaw.com and DLA Piper’s Gambling Laws of the World guide — or get in touch.
