EU AI Act for the Gambling Sector – Transparency Obligations Now Applicable

The EU AI Act for gambling operators, suppliers and affiliates has entered its enforcement phase: since 2 August 2026, the Article 50 transparency rules are applicable, the ban on manipulative AI is already biting, and the high-risk obligations have shifted to 2027 and 2028. Below, we unpack what each change means for operators, suppliers and affiliates.

For gambling operators, suppliers and affiliates, this is decisive. The grace period is now officially ticking. And the compliance clock is running fast.

Misleading headlines in the press discussing a “delay” mustn’t cause gambling companies to neglect or pause their compliance programmes. The Digital Omnibus, published on the Official Gazette on 24 July 2026, reshaped the Act without softening its logic. Whilst part of it moved to 2027, another landed on 2 August 2026.

We look at the five questions gaming clients should be asking:

 

The EU AI Act for the gambling sector: which updates matter most, and what must change?

Three things matter. The rest is background.

1. The prohibited practices are already live. The Article 5 ban on manipulative AI has been in force since February 2025. This is not future law, it applies today. And here is where the gambling sector is uniquely exposed. Imagine an AI engine that dynamically adjusts game volatility, odds or bonus triggers when a player shows markers of harm. That is exactly the behavioural exploitation Article 5 was built to stop. The exposure is severe: fines reach €35 million or 7% of global turnover.
2. The high-risk clock moved – but only for high-risk. The Omnibus pushed standalone high-risk systems under Annex III to 2 December 2027, and embedded systems under Annex I to 2 August 2028. That gives genuine breathing room for AI credit and affordability scoring, and for player risk-rating tools.
3. Transparency was not delayed. More on that in a moment, because it is the part most people missed.

What should you actually do? Map every AI system you run. Classify each by risk. Build the controls that follow. Companies often overlook the fact that a delayed deadline is runway to prepare, not a licence to wait.

 

How does the 2 August 2026 transparency requirement impact gambling operators?

This is the one that just went live. As of 2 August 2026, Article 50 is active, and it was carved out of the postponement entirely.

It reaches almost everyone. It does not care whether your system is “high-risk.” If you put AI in front of a player, it applies to you.

Two duties hit gambling operators directly:

• Chatbot disclosure. When a player interacts with your AI support agent, they must be told it is AI. This matters most in sensitive flows, such as self-exclusion, safer-gambling conversations, where a bot misfiring is not just a service failure but a regulatory one.
• Synthetic content marking. AI-generated marketing copy, promo artwork and game imagery must now carry visible and machine-readable markers flagging them as artificial.

There is transitional relief on timing. Systems already on the market before 2 August 2026 have until 2 December 2026 to implement the machine-readable marking under Article 50(2). The core disclosure duties have just started, and penalties for getting this wrong can run up to EUR15 million or 3% of global turnover.

It's imperative that companies don’t try to use “we are only a deployer” as a shield. The duty follows the system to the player, not the licence.

 

Will these updates change how gambling regulators set requirements for licensees?

Yes, although not overnight, and not in the way people expect. The AI Act is horizontal law, and it does not rewrite your licence conditions by itself. What it does instead is set the baseline that gaming regulators are now building on.

We are already seeing the shift. The Italian gambling authority (ADM) tells licensees to tackle responsible gambling “also with the use of AI”, a broad phrase that leaves the detail to operators. Meanwhile, the UKGC has been open that it wants to use AI to sharpen its own monitoring, from spotting breaches to policing advertising aimed at under-18s.

The trajectory is clear. National authorities are drifting from static, point-in-time software testing toward continuous compliance, and we expect to see bodies such as Malta’s MGA and Germany’s GGL move this way. In practice, that means licence workflows built around audit trails and “explainable AI” pathways, where a licensee must show why an algorithm made a given decision about a player.

One honest tension. Regulators themselves admit their current frameworks are not equipped for AI. So expect guidance and supervisory pressure to arrive faster than formal legislation does.

 

How will gambling suppliers and affiliates be impacted?

Differently – and this is where the provider/deployer split decides who carries the weight.

For B2B suppliers, the pressure is real. If you build the AI system, you are typically the provider, and providers hold the heavier duties: technical logging, documentation, and models that operators can genuinely audit. Watch the contracts, too. Liability is shifting hard toward strict compliance indemnifications on the vendor side. And the timing stings: on 30 July 2026 the UKGC raised the risk rating for gambling software suppliers from low to medium – the only such change in its report   – driven by AI-generated fake documents, deepfakes and face swaps used to bypass KYC.

For affiliates, the exposure runs through Article 50 and marketing. Automated SEO output, synthetic copy and deepfake creatives must be labelled, or you face consumer-deception fines, in a channel regulators now watch with AI tools of their own.

The real risk when advising suppliers is subtler. If an operator substantially customises a vendor’s AI system, that operator can be requalified as a provider. The heavier obligations then follow it.

Providers vs. Deployers: core operational impacts

 

Is the gambling industry well prepared for the changes?

Honestly? Readiness is fragmented. Sharply so.

Tier-1 operators are in reasonable shape. They have stood up legal-tech compliance teams, treated the AI Act as a board-level issue, and most walked into 2 August 2026’s transparency rollout ready.

The mid-tier has faced a different challenge. Many mid-sized operators, suppliers, and affiliates viewed the AI Act primarily as an issue for IT teams or something that would become relevant later. That perception was reinforced when the timelines for certain high-risk AI obligations were extended, creating the impression that there was more time to prepare. For many organisations, the assumption became: if the deadlines have moved, implementation can wait. But the provisions that took effect on 2 August were not the ones that were postponed. The key take away now should be that postponement is runway, not rest. Now that the Act is switching on in stages, the real risk is not non-compliance, it's being unprepared for a system already in motion.

The operators who use this window to classify their systems, fix their transparency stack and build integrated AI governance will turn compliance into an edge, but preparation needs to start now.

To know more on gambling law matters, read DLA Piper’s Gambling Laws of the World guide.