Malta's gaming regulator has issued a voluntary AI charter that asks licensees to hand player-facing chatbot conversations to a trained human when distress or gambling harm signals appear

What the Charter asks of a player-facing chatbot

The most concrete passage is in section 3.6.1. It is voluntary good practice, not a rule, and it reads: for player-facing conversational or support AI, licensees "should define clear human-escalation triggers". The Charter then names five: "repeated low-confidence outputs, unresolved or escalating player queries, detected distress signals, indications of vulnerability or gambling harm, or requests for human support".

When a trigger arises, the Charter's voluntary expectation is that "the conversation should be transferred to a suitably trained human agent in a timely manner". It does not define timely. It sets no response time and no staffing ratio.

Section 3.6.6 adds a training limb, again framed as good practice: people who oversee or interact with AI systems should have the training and expertise to monitor and intervene. The same section points to what the EU AI Act says about human oversight of high-risk systems. That is the Charter signposting the Act rather than adding to it, and this piece does not assess when those provisions of the Act apply.

Voluntary, and the document says so in terms

Section 1.2 is explicit: "For the avoidance of doubt, this Charter is voluntary in nature and does not create new legal or regulatory obligations for Gaming Licensees, nor does it modify, expand or replace any obligations that already apply under existing national or EU law".

It also tells readers how to parse its verbs. Where a duty already exists in law, the Charter uses phrases such as "in accordance with applicable law". Where it sets sector good practice, it uses "should", "are encouraged to" or "may". The legal signposts, it says, "do not create new obligations under the Charter". Every "should" quoted in this piece falls in the good-practice category.

Nothing in it is to be read as imposing additional contractual, reporting or operational obligations, including for contracts entered into before publication.

Adoption is optional. The introduction says all licensees are "strongly encouraged to adopt the AI Gaming Charter", and suggests that adopters designate one or more people, for example from compliance, data or technology functions, as internal points of contact.

Two tiers, and why a human reviewer does not automatically lower the tier

Section 3.1 proposes that licensees sort AI use into two broad tiers for applying the Charter proportionately. Lower-impact systems are internal or administrative and unlikely to affect players. Higher-impact systems are used in, or materially influence, "player-facing, responsible gambling, fraud, AML, KYC, account restriction, eligibility, intervention, or other compliance-sensitive decision-making contexts". The Charter states that this device does not replace or determine any classification under the EU AI Act, and like the rest of the document it is voluntary.

One sentence in that section, which is voluntary good practice and not a rule, deserves attention from anyone designing a review workflow: "Human oversight may help manage risk, but it should not automatically reduce the applicable level of scrutiny where the AI System materially influences the outcome." The test the Charter proposes is the system's proximity to the player and its effect on regulated outcomes.

Our reading: that sentence runs against a familiar design argument, that a human sign-off moves a model into a lighter category. On the Charter's approach it does not do so automatically where the system materially influences the outcome.

For the Charter's voluntary purposes, scope is set by the EU AI Act definition of an AI system. Internal and back-office AI uses are inside. Rules-based automation and robotic process automation without AI functionality generally fall outside.

Bias controls, with a named list of proxy variables

Section 3.3.3 recommends proportionate bias detection and mitigation, and asks licensees to consider whether variables work as proxies for protected or sensitive characteristics even where those characteristics are not used directly. It gives a gaming-specific list: "geolocation, language, deposit patterns, device type, time-of-day activity, payment behaviour, play patterns, account history and customer interaction data".

For higher-impact systems, the good-practice position is that licensees should maintain and periodically review a sector-relevant list of potential proxy variables. No template for that list is provided.

Two related recommendations sit nearby. Section 3.2.1 says players should be informed they are engaging with AI "at latest from the point of first interaction or exposure", and that AI washing, overstating the role or capability of AI, should be avoided. Section 3.3.7 recommends channels for players to raise concerns and seek review or redress where AI-supported outcomes may affect them.

What the MGA may see, and what already binds

Section 3.10.1 says licensees should notify the MGA of significant changes to AI systems that affect gaming operations, including deployment in new contexts such as responsible gambling interventions or fraud detection. In a voluntary document this is an expectation, not a notification duty, and the Charter does not say what follows from not notifying.

Incident reporting is different, because it points to existing law. Section 3.10.2 states that "Gaming Licensees must continue to comply with existing incident-reporting obligations, in accordance with applicable law and regulatory requirements." It also says that serious incident reports under the EU AI Act go from the provider to Malta's designated market surveillance authorities, which it names as the MDIA and the IDPC.

Under section 3.10.3, adopting licensees are encouraged to keep internal records of their AI use and how they apply the Charter, and that information "may be made available to the MGA upon request". Our inference, three steps removed from any obligation: a licensee that adopts the Charter builds a paper trail the supervisor could later ask to see in ordinary supervisory engagement. The Charter itself attaches no consequence to adopting or declining.

The Charter rests partly on an MGA survey sent to all licensees, with voluntary participation, plus interviews. The MGA gives no response count and no percentages; it says the responses "represented a limited subset of the sector" and offered "useful indicative insights". Its own words on the results are that "Only a small number of organisations said they disclose AI usage to customers and secure explicit consent for automated processing" and that "only a small number of respondents reported having a fully established AI risk assessment process or incident response plan". Those are the MGA's descriptions of a sample of unstated size; we cannot turn them into a share of the sector.

What we did not verify

What we opened: the full 48 page Charter PDF, retrieved from the MGA URL above and read as extracted text, including the definitions, sections 1 and 2, sections 3.1, 3.3, 3.6, 3.10 and 3.11, the closing statement and the opening of Annex A. We also read the MGA launch notice dated 18 September 2026.

What we did not open: the consultation material the launch notice refers to, the MDIA compliance tools and EU AI Office guidelines the Charter cites, the Gaming Act, and the full Annex A mapping table row by row. Sections 3.4, 3.5 and 3.7 to 3.9 were read only in outline and are not summarised here.

What we refuse to claim: we do not say the Charter is binding, enforceable or a condition of any licence, because it says the opposite. We do not say any licensee has adopted it. We do not repeat the Charter's description of itself as one of the first initiatives of its kind in Europe as our own finding, and we give no survey response count, because the MGA gives none. We do not say whether or when EU AI Act high-risk obligations referenced in the Charter apply.

Quotations are reproduced with ASCII punctuation in place of the typographic apostrophes in the PDF, and with ligature characters written as plain letters, which is a house typesetting convention and not a change to any word.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Malta's MDIA and EU AI Act market surveillance
• Ukraine order 855-r on AI and gambling risk tiering
• EU AI Act Article 73 serious incident reporting
• Europe AI regulation tracker
• AI Regulation News hub