Malta's Regulator Publishes a Voluntary AI Charter for Gaming Operators

The MGA and the Malta Digital Innovation Authority launched a principles-based framework on Thursday for operators using AI in player protection, fraud detection and customer contact. It sits under the EU AI Act, binds nobody, and is a rare instance of a gambling regulator writing down what it expects of a licensee's models. Charles Mizzi: "Our role is not to stand in the way of innovation."

• The Malta Gaming Authority and the Malta Digital Innovation Authority launched the AI Gaming Charter on 18 September at an event for licensees, public bodies and technology firms, the MGA said in a release
• It is "a voluntary, principles-based framework" for the "responsible, transparent and accountable use" of artificial intelligence in gaming operations, complementing existing law "including the EU AI Act" with "practical guidance tailored to the realities of the gaming sector"
• The authority says AI is already used across "player protection, fraud detection, customer interaction and operational decision-making", and the charter is meant to embed "governance, human oversight and ethical considerations" into how licensees design, deploy and use those systems
• It was developed through sector-wide surveys, targeted discussions with licensees and a formal consultation, which the MGA says keeps it "practical, proportionate and responsive"
• MGA CEO Charles Mizzi: "Our role as a regulator is not to stand in the way of innovation, but to help create the certainty and confidence needed for innovation to flourish responsibly"
• MDIA CEO Kenneth Brincat: organisations "need practical ways to understand where AI is being used, manage the associated risks and ensure that accountability and human oversight remain firmly in place"; the charter document is published on the MGA site

What a Charter Is and Is Not

The document does not create obligations. It is a statement of principles that a licensee can adopt, and the MGA's description makes clear that adoption is voluntary and that the charter sits alongside, not on top of, the law that already applies: Malta's gaming framework, the GDPR and the EU AI Act, whose obligations for high-risk systems begin to bite in 2026 and 2027. The value of a charter is in the gap between those laws and an operator's Tuesday morning. The AI Act tells a company what a high-risk system is; it does not tell a gambling compliance officer whether the model that flags a customer for a responsible gambling interaction is one, or what "human oversight" means when the model produces four hundred flags a day.

That is the space the MGA has chosen to fill, and the three use cases it names are the ones every serious operator is already running: models that score player risk from behavioural data, models that score transactions and accounts for fraud, and models that answer customers. Each has a known failure mode. Risk models can be tuned to the operator's commercial interest as easily as to the player's; fraud models produce false positives that decline legitimate customers and nobody owns that number; customer-facing models say things the operator did not authorise. A framework that requires a licensee to be able to say where AI is used, who is accountable for each system and what a human can override is a modest ask, and a useful one.

Why Malta, and Why Now

Malta licenses several hundred B2C and B2B operators and is the jurisdiction from which much of Europe's online gambling is run, so a principle adopted by the MGA becomes a working standard across the industry faster than one adopted anywhere else. The MDIA is the authority Malta created in 2018 to certify technology arrangements, and the joint authorship is the point: the gaming regulator supplies the use cases, the innovation authority supplies the AI governance, and neither has to become expert in the other's field.

The timing follows the EU AI Act's phased application and the MGA's own recent enforcement themes. Its mystery-shopping report earlier this year found self-exclusion gaps across brands, and the systems that are supposed to catch a self-excluded customer re-registering under a variant of their name are, increasingly, the systems the charter is about.

A Regulator Saying What It Wants From a Model

Britain's Gambling Commission requires operators to identify customers at risk and has said algorithms may be used; it has not said how. The Dutch KSA requires a "risk analysis" and has called operators' systems ineffective and outdated without publishing a standard for a good one. The MGA has now put a framework in writing, and however voluntary it is, an operator that ignores it will find that hard to explain the first time its model gets a customer wrong in a licence review.

Voluntary Is How Standards Start

A charter with no sanction is easy to dismiss and has a habit of becoming a licence condition within a few years, once enough licensees have adopted it that the holdouts are conspicuous. The MGA's consultation process, surveys, targeted discussions and a formal comment period, is the process a regulator runs when it intends the outcome to be adopted, and the reference to the EU AI Act gives it a legal anchor the moment the Act's own obligations arrive.

The Test Is the Responsible Gambling Model

Of the three named uses, one is where the charter will matter. An AI system that decides which customers get a harm intervention, and when, is the most consequential model an operator runs, and it is the one whose tuning is invisible to the regulator, the customer and often the operator's own board. A framework that requires that system to be documented, overseen and explicable is a regulatory instrument aimed squarely at the part of the business that decides whether player protection is real.

Malta has told its licensees what a well-governed model looks like. It has not yet told them they must have one. The distance between those two sentences is usually about three years.