The MGA AI Gaming Charter was launched on 18 September 2026 by the Malta Gaming Authority (MGA), in collaboration with the Malta Digital Innovation Authority (MDIA). The Charter gives Malta-licensed gaming businesses a sector-specific framework for using artificial intelligence responsibly across gaming operations.
The Charter is voluntary. It does not create, modify, expand or replace legal or regulatory obligations. That does not, however, make every matter addressed by the Charter optional: existing obligations under applicable law continue to apply independently.
For operators already using AI in iGaming, whether in player-facing systems, responsible gambling, fraud, AML, KYC, customer support, marketing, analytics or internal operations, the Charter provides a practical structure for identifying, assessing, overseeing and monitoring AI use.
What the MGA AI Gaming Charter Asks Licensees to Do
The Charter takes a proportionate, risk-based approach. It recognises that not every AI use case requires the same level of control.
For Charter governance purposes, it distinguishes between lower-impact and higher-impact AI.
Lower-impact systems are generally those used for internal, administrative, operational or other purposes that are unlikely to materially affect players, player rights, gaming integrity or regulated outcomes.
Higher-impact systems include AI used in, or materially influencing, player-facing activities, responsible gambling, fraud, AML, KYC, account restrictions, eligibility, intervention and other compliance-sensitive decisions. These systems should receive stronger documentation, testing, validation, human oversight, monitoring, escalation and record-keeping.
This lower-/higher-impact distinction is one of the Charter’s most practical features because it allows governance to be scaled to the potential impact of the system. Importantly, lower-impact systems remain within the Charter’s scope – the distinction affects the level of governance applied.
1. Build and Maintain an AI Inventory
The Charter identifies the AI inventory as the foundational system of record for AI governance.
A licensee should know where AI is being used, what each system does, who owns it and how important it is to the business or to player outcomes. The inventory should capture information such as the system’s purpose, owner, risk tier, deployment context, key dependencies, lifecycle status and the organisation’s role in relation to the system.
This is particularly important because AI may be embedded inside wider platforms rather than purchased as a standalone “AI tool”. CRM systems, fraud engines, KYC products, customer-support platforms and marketing technology may all include AI functionality.
Without an inventory, it is difficult to apply consistent governance, accountability or monitoring.
2. Assess the Impact of AI Systems
The purpose is to identify and manage reasonably foreseeable impacts on individuals, groups and society throughout the AI lifecycle. The depth of the assessment should reflect the nature of the use case and its potential impact.
The Charter recommends proportionate AI System Impact Assessments (AISIAs).
An internal productivity tool does not require the same level of scrutiny as a system influencing responsible-gambling interventions, player eligibility, KYC, fraud decisions or customer-facing communications.
Existing processes such as DPIAs, operational risk assessments, security reviews or compliance assessments may provide useful inputs, but the AI assessment should still consider how the system itself is being used, what can go wrong and what controls are needed.
The assessment should also consider how AI outputs are reused across functions. A behavioural model used to identify possible gambling-related harm may support player protection, but using the same indicators to tailor an inducement, retention measure or marketing communication raises a very different risk profile. Licensees should therefore assess not only what a model detects, but who can access its outputs, what downstream systems use them and what action follows from the detection.
3. Establish Clear Ownership and Accountability
The Charter recommends clear responsibility for AI systems and appropriate senior accountability.
It points to the designation of a senior accountable person for AI governance, such as a Chief AI Officer or equivalent, together with an AI oversight or ethics committee, or another documented multidisciplinary governance forum, proportionate to the organisation’s size, complexity and AI risk profile.
The practical objective is to make sure there is a clear answer to questions such as:
- Who owns this system?
- Who approves its use?
- Who challenges its performance?
- Who approves material changes?
- Who is accountable if the system does not operate as intended?
Depending on the system, relevant functions may include compliance, legal, data protection, responsible gambling, AML/fraud, technology, information security, product and operations.
4. Put Meaningful Human Oversight in Place
The Charter places significant emphasis on human oversight, particularly for AI that can affect players or regulated outcomes.
For player-facing conversational and support AI, it recommends defined escalation triggers. These may include repeated low-confidence outputs, unresolved queries, player distress, signs of vulnerability or gambling-related harm, and requests for human support.
When such triggers arise, the process should enable escalation to an appropriately trained human.
The important point is not simply to have a person “in the loop”, but to decide in advance when human intervention is required and what that intervention should achieve.
5. Govern Third-Party AI
Many gaming businesses will obtain AI capabilities from external providers rather than build them internally.
The Charter makes clear that third-party AI should still be subject to appropriate internal oversight, validation and accountability. Responsibilities should also be clearly delineated between the AI provider and the gaming licensee.
Supplier due diligence should therefore go beyond asking whether a vendor says its solution is “AI compliant”.
A licensee should understand, proportionately to the risk of the use case, what the system does, its intended purpose, its limitations, the data it uses, relevant dependencies, how changes are communicated and what information is available for monitoring and regulatory review.
Vendor assurances can support governance, but they do not replace the licensee’s own understanding of how the system is being used within its operation.
6. Monitor AI Throughout Its Lifecycle
The Charter does not treat AI governance as a one-off approval exercise.
It calls for ongoing monitoring, testing, change management and incident handling. For higher-impact systems, stronger practices may include validation, defined human oversight, performance monitoring, escalation arrangements, version control, change logs, staged deployment, retraining governance and rollback processes.
The Charter also addresses broader responsible-AI principles including transparency and explainability, fairness and non-discrimination, data protection and governance, safety and robustness, environmental sustainability, reporting and continuous improvement.
It also warns against “AI washing”: overstating the use, role or capabilities of AI, presenting conventional software as AI, or making claims about AI that cannot be evidenced.
The Charter also recommends notifying the MGA of significant changes or updates to AI systems affecting gaming operations. AI-related incidents should also be assessed against existing MGA and other applicable reporting requirements.
What MGA Licensees Should Do Now
A practical implementation sequence is:
- Identify AI systems and maintain an inventory.
- Classify them by lower-/higher-impact tiering under the Charter.
- Carry out proportionate AI System Impact Assessments.
- Assign clear ownership and senior accountability.
- Define human-oversight and escalation arrangements.
- Review third-party AI and supplier responsibilities.
- Document testing, monitoring, changes and incidents.
- Assess material AI-system changes and incidents for applicable notification or reporting requirements.
- Review governance periodically as systems, use cases and risks change.
For many organisations, the first challenge comes before drafting an AI policy. It will be identifying how much AI is already embedded across the business and understanding what each system is actually being used for.
How the MGA AI Gaming Charter Fits With the EU AI Act
The MGA AI Gaming Charter and the EU AI Act should be treated as related, but separate, frameworks.
The Charter is a voluntary, sector-specific governance framework for gaming licensees. The EU AI Act is a legal framework that imposes obligations where its provisions apply, including where relevant to AI used by gambling and iGaming businesses.
Importantly, the Charter’s lower-/higher-impact categorisation is not the same as the EU AI Act’s legal classification of high-risk AI systems. A system may warrant stronger governance under the Charter without being legally classified as high-risk under the AI Act.
For each AI system, gaming businesses should therefore carry out two separate exercises:
First: determine what governance is appropriate under the MGA AI Gaming Charter.
Second: determine what legal obligations apply under the EU AI Act, based on the system’s functionality, intended purpose and the organisation’s role.
Keeping these assessments distinct helps avoid confusion while allowing the two frameworks to support each other in practice.
How A2CO Helps MGA Licensees Implement the AI Gaming Charter
A2CO supports gaming and technology businesses with both sides of this work.
We help organisations understand and implement EU AI Act requirements, including role and risk classification, governance and applicable compliance obligations.
We also help MGA licensees implement the principles of the AI Gaming Charter by establishing the right foundations around AI: from inventories, risk assessments and governance frameworks to AI-specific controls, third-party risk management, monitoring and implementation advisory.
If your organisation is already using AI, or expects its use to grow, the right starting point is to understand where AI is being used, what impact it can have and what governance and legal requirements follow.
Find out where AI sits in your gaming operation and what the Charter and the EU AI Act expect of it.
