You drop four spins in a row, close the app, and twenty minutes later a free-spins notification arrives. Nothing shady has happened. But something decided that this was the right moment to reach you, and that something was almost certainly a model trained on your betting history. That is AI in online gambling as most players actually meet it, and it is the reason a regulatory argument that sounds like a lawyers’ squabble has a direct bearing on your account.
The headline from an October 2026 industry special report is simple: senior figures across the sector cannot agree on whether artificial intelligence needs its own gambling rules, or whether existing gambling licensing, consumer protection law and the EU AI Act already do the job. Most of the voices quoted lean towards “existing law is enough.” I think they are right, but not for the reason they give, and the gap matters to you more than the rulebook does.
What the AI gambling regulation debate is actually about
The argument is about whether to regulate the technology or the outcome. One camp wants bespoke rules written specifically for AI systems, on the grounds that algorithmic decision-making is opaque and can carry bias at scale. The other camp says gambling law already governs what operators are allowed to do to players, and it should not care whether a human, a spreadsheet or a machine-learning model produced the decision.
The five positions summarised in the report cluster tightly, which is itself interesting. Nobody in it argues that AI is harmless; nobody argues for a ban.
| Industry figure | Position on bespoke AI rules | Core reasoning |
|---|---|---|
| Gustaf Hoffstedt | Not needed | Gambling law should regulate outcomes, not prescribe how AI is used; regulators should focus on stopping illegal operators targeting consumers |
| Catie Di Stefano | Not needed for now | Existing arrangements are sufficient; has not seen anything alarming about AI in gambling |
| Rasmus Kjaergaard | Industry should move first | AI is already used across gambling, so operators should not wait for mandates before developing responsible standards |
| Giulio Coraggio | Law is adequate, enforcement is not | Existing law is substantively sufficient but poorly enforced; operators, suppliers and affiliates may already be exposed under the EU AI Act |
| Craig Cornforth | Reframe the question | AI should be backed by trained teams and independent lived-experience assurance rather than treated only as a risk to regulate |
Read the right-hand column again. Four of the five are describing a governance problem, not a legal vacuum.
Where AI already shapes your casino experience
AI is not arriving in online casinos. It has been embedded in them for years, in three places you touch every session.
Personalised bonuses and offers
Personalisation engines rank which promotion to show you, when to show it, and at what value, based on deposit frequency, session length, game preference and win/loss patterns. Two players on the same site can see entirely different offers on the same day. That is the clearest answer to whether personalised casino offers are powered by AI: on any large platform, yes, and the targeting is far more granular than the marketing copy suggests.
Fairness monitoring and RNG oversight
Game outcomes themselves are not usually generated by AI. Slots and table games run on a certified random number generator, and the RTP and house edge are fixed properties of the maths, not something a model nudges mid-session. Where machine learning does appear is in the monitoring layer: spotting anomalous play patterns, collusion in poker, bonus abuse and payout deviations that suggest a game is not behaving as certified.
Behavioural risk scoring
Responsible-gambling systems score accounts for markers of harm, such as chasing losses, rapidly escalating stakes, deposits at unusual hours or repeated failed payment attempts. A high score can trigger a pop-up, a deposit-limit prompt, a human welfare call, or in some cases a restriction on your account. Yes, AI is used to detect problem gambling, and on licensed sites it is increasingly expected to be.
The case for bespoke gambling industry AI rules
Proponents of AI-specific rules make a structural argument: gambling law was written to police human and institutional conduct, and a black-box algorithm does not fit those categories cleanly. If a personalisation engine learns that a particular pattern of late-night deposits predicts a high-value customer, it may reinvent predatory targeting without anyone ever writing a predatory marketing brief. Nobody intended it; the model simply optimised.
Scale is the second argument. A bad human marketing decision affects one campaign. A bad model affects every account simultaneously, continuously, and is hard to reconstruct after the fact. Explainability duties, bias testing and audit trails are not concepts current gambling licensing was built around, which is why some in the sector want them written in explicitly, with a regulatory sandbox for testing new tools.
The case for leaving it to existing law
The counter-argument is that outcomes are already illegal regardless of the tool. Targeting a self-excluded customer breaches licensing conditions whether a human or a model picked the name. Profiling someone on sensitive behavioural data already engages data-protection law. Misrepresenting a game’s fairness is already fraud. On this reading, a separate AI rulebook duplicates obligations and adds a compliance framework without adding protection.
There is a sharper worry underneath: new restrictions could slow down the tools that genuinely help. Harm-detection systems improve by being trained, tested and retrained on live data. A cautious operator facing uncertain AI liability may simply deploy a weaker model, or none, and the player who needed the intervention never gets it.
The condition almost nobody checks
Which rulebook wins matters far less than whether anyone is enforcing it on the site you are actually using. That is the condition the whole debate keeps brushing past, and the report’s own contributors point straight at it: one argues the substantive law is already sufficient but badly enforced, another says regulators should be spending their energy stopping unlicensed operators from reaching consumers at all.
Both the bespoke-rules camp and the existing-law camp assume a licensed operator inside a supervised market. If you are playing on an offshore site with no meaningful licence, neither framework reaches you. There is no audit of the personalisation engine, no appeal against an automated account restriction, no regulator to complain to when a withdrawal is frozen by a risk model. The answer to “does AI need separate rules” is therefore conditional, and the condition is jurisdiction, not technology.
What this means for fairness and trust
The honest position on algorithmic fairness is that players currently cannot verify it. Game fairness has an established chain of trust: certified RNGs, published RTP, independent testing labs. Personalisation has nothing equivalent. No licensed market, as far as the current debate shows, requires an operator to tell you that an offer was algorithmically selected for you, to explain which behaviour triggered it, or to publish an audit of whether its targeting systematically leans on players showing markers of harm.
That is the real difference between the two regulatory paths. Applying existing law catches the worst outcomes after they happen. AI-specific rules would, in principle, force disclosure and auditability before they happen. Neither path has been settled, and no serious reading of the current debate suggests disclosure duties are imminent.
What this means for responsible gambling technology
Behavioural risk scoring cuts both ways. A false negative means a player in trouble is never flagged. A false positive means an account is restricted or a welfare call is triggered for someone who is playing within their means, with no stated reason and often no route to challenge it. Both errors come from the same model, and tuning one down raises the other.
Audit is the part regulation would decide. Under existing law, an operator can largely grade its own homework on how its risk scoring performs. One view in the report pushes for something stronger: AI backed by trained human teams and independent assurance drawing on people with lived experience of gambling harm, rather than AI treated purely as a compliance risk. That is a governance standard the industry could adopt without waiting for a mandate, and one contributor argues it should.
Whatever the model decides, the tools under your own control are the ones that work on every licensed site today: deposit limits, loss limits, session reminders, cool-off periods and self-exclusion. Set them yourself rather than waiting for an algorithm to notice. If gambling has stopped being entertainment, a national helpline will do more for you than any risk score.
Questions worth asking before you trust a platform’s AI
None of this requires a technical background to check. Before depositing, look for answers to these:
- Who licenses this operator, and does that regulator publish enforcement decisions?
- Does the terms or privacy policy disclose that personal data is used to profile players and target promotions?
- Is there a stated route to have an automated account restriction or risk flag reviewed by a human?
- Are the games tested by a named independent laboratory, with RTP published per title?
- Can you opt out of marketing personalisation while keeping the account open?
- Are deposit limits, cool-off and self-exclusion available without contacting support first?
A platform that answers five of six is not proof of good behaviour, but a platform that answers none has told you what you need to know.
More regulatory statements on AI are coming, and the pressure points are already visible: enforcement of law that already exists, and exposure under the EU AI Act for operators, suppliers and affiliates who may not realise it applies to them. What remains genuinely unsettled is the one thing a player would most want fixed, which is whether anyone will ever be required to tell you that a model made a decision about your account, and what it decided. Until that lands, the checks above are yours to run.
