Paul Micallef Grimaud, Christina Scicluna and Andrea Grima
Across the digital economy, service personalisation is expected. Research shows that personalised bets and offers are now perceived as “valuable” by most players, with 80% of bettors rating tailored experiences positively.
Artificial intelligence (AI) is shaping consumer experience and supporting operators, from customer onboarding, to providing personalised player engagement and detecting early indicators of problem gambling.
As operators increasingly rely on AI to optimise player experience, they must navigate the evolving regulatory framework to ensure they do not cross ethical lines and comply with obligations arising from the EU’s Artificial Intelligence Act (AI Act), the General Data Protection Regulation (GDPR) and their licence frameworks.
The red line between legitimate personalisation and harmful manipulation is thin and calls for constant vigilance.
The AI Act’s risk based framework
The AI Act introduces a structured, ex ante approach to governing AI systems, classifying them into four categories: unacceptable risk (prohibited), high risk, limited risk and minimal risk – with the most onerous obligations reserved for high risk systems.
In practical terms, iGaming operators must firstly determine whether a tool qualifies as an AI system under the AI Act; secondly, classify each use case within the risk framework; and finally, identify their role and obligations in the AI value chain.
Prohibited manipulation and vulnerable players
Article 5 of the AI Act prohibits AI systems that materially distort a person’s behaviour in a way that causes, or is likely to cause, significant harm or exploit vulnerabilities linked to age, disability or a specific social or economic situation. An example of a prohibited practice may include AI-driven dynamic targeting of financially vulnerable players with higher risk offers or bonus structures.
High risk AI in the iGaming ecosystem
Limited Risk AI: Transparency in Player Interactions
Most AI systems in iGaming are likely to fall within the limited or minimal risk categories, the former of which may trigger transparency obligations. This typically occurs where players interact with AI-powered chatbots or virtual assistants, and the AI Act requires operators to inform players that they are communicating with an AI system, not a human, at the latest at the time of the first interaction.
Beyond the AI Act: GDPR and data driven iGaming
Much of AI’s value derives from behavioural and transactional data, regulated by the GDPR.
Operators must identify a lawful basis for processing this data and reflect it in their privacy notices; process only data that is adequate, relevant and limited to specified purposes; and observe Article 22 of the GDPR, under which players have the right not to be subject to solely automated decisions producing legal or similarly significant effects.
In iGaming, this is particularly relevant where AI systems automatically close player accounts or refuse withdrawals – necessitating human in the loop mechanisms.
Personalisation versus manipulation: Drawing the line
The core challenge lies in enhancing player safety and engagement without crossing the line into manipulation. A loyalty bonus aligned with a player’s declared preferences can be a legitimate marketing tool.
The same algorithm, configured to intensify offers to players showing signs of financial distress may lean towards a prohibited manipulation practice under the AI Act.
The forthcoming Digital Fairness Act is expected to target dark patterns and addictive design, indicating that EU policymakers are also increasingly intolerant towards interfaces that unduly pressure users.
Ultimately, iGaming operators who integrate strong governance, ethical data use and player centric design will be best positioned to leverage AI’s potential while remaining on the right side of an increasingly demanding regulatory landscape.
Paul, Christina and Andrea are a partner, senior associate and advocate within Ganado Advocates’ AI practice group.
