- Regulation (EU) 2026/1744 postponed the high-risk regime to 2 December 2027 (2 August 2028 for AI in regulated products); it did not postpone AI disclosure or the prohibitions.
- Disclosing AI to players in chat, email and voice has applied since 2 August 2026 — at first contact, with an honest answer to “am I talking to a bot?” and no fake human personas.
- The Article 5 bans on manipulation and exploiting vulnerabilities, including a person's economic situation, have applied since February 2025 and matter most for marketing and retention models.
- Fraud detection and KYC face matching are expressly outside the high-risk list; emotion recognition, hiring AI and possibly affordability models are the operator systems to look at.
- Your gambling licence sits on top: audit trails, responsible-gambling handoffs to a person and human decisions on restrictions remain the regulator's questions.
For licensed gambling operators in the EU, the July 2026 amendment to the AI Act made headlines as "the delay". For most operators, it isn't one. The obligations that touch an iGaming business most directly — telling players when they are talking to an AI, and not using AI to exploit vulnerable people — were not postponed at all. What moved is the high-risk regime, and most of the AI an operator actually runs was never in it.
This article maps the AI Act onto the systems a licensed operator typically runs — support, marketing, responsible gambling, fraud, KYC, voice, hiring — and says what applies now, what applies later, and what your gambling licence adds on top. It is not legal advice. Classification depends on how a specific system is built and used; confirm it with counsel against the Official Journal text.
What the July 2026 amendment changed — and what it didn't
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force days later, just before the AI Act's 2 August 2026 milestone. Its headline effect was to give providers of high-risk systems more time. Everything else on the original timetable stayed where it was.
| Obligation | Applies from | Changed by the amendment? |
|---|---|---|
| Prohibited practices (Article 5) — manipulation, exploiting vulnerabilities, emotion recognition at work | 2 February 2025 | No; two new prohibitions added (below) |
| Disclosing AI interaction (Article 50(1)) — chatbots, voice agents | 2 August 2026 | No |
| Disclosing deep fakes and informing people exposed to emotion recognition (Article 50(3)–(4)) | 2 August 2026 | No |
| Machine-readable marking of generated content (Article 50(2)), for systems already on the market | 2 December 2026 | Short grace period for existing systems |
| New prohibitions: non-consensual intimate imagery, child sexual abuse material | 2 December 2026 | New |
| High-risk systems listed in Annex III (biometrics, employment, creditworthiness and others) | 2 December 2027 | Postponed from 2 August 2026 |
| High-risk AI in regulated products (Annex I) | 2 August 2028 | Postponed from 2 August 2027 |
The two new prohibitions target tools that generate intimate imagery without consent and child sexual abuse material. They matter to image-generation vendors, not to a casino. The rest of this article is about the rows that do matter.
Applies now: telling players they are talking to an AI
Article 50(1) requires AI systems that interact directly with people to be designed so that people are informed they are dealing with an AI — unless that is obvious to a reasonably well-informed person from the context. Article 50(5) adds that the information must be clear and given at the latest at the first interaction.
Legally, this duty sits with the provider — whoever builds the system. In practice, it lands on the operator, for two reasons: it is your player who sees the chat, and if you built or substantially configured the agent in-house, you may be the provider yourself. Either way, a support channel that went live with AI and no disclosure has been out of line since 2 August 2026.
What compliant disclosure looks like in a casino support desk:
- At the start of every conversation, in chat, email and voice: a short line such as "I'm an automated assistant, supervised by our support team." On a call, it is spoken before anything else.
- An honest answer when asked. "Am I talking to a bot?" gets a yes, every time, in every language.
- No invented human personas. A friendly assistant name is fine; a fake agent with a surname and a photo is exactly what the rule is designed to stop.
- A clear route to a human, and a handoff message that says a person is taking over.
Don't lean on the "obvious from context" exception. A chat widget that looks the same whether a person or a model is answering is not obvious to anyone. Breaches of Article 50 carry fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, with lower caps for SMEs.
Operators sometimes ask for a bot that passes as human, out of fear that players will type "agent" as soon as they see the word "automated". In our experience, what drives players to demand a human is an assistant that can't answer; one that reads the account and resolves the withdrawal question gets used. Disclosure plus competence beats disguise.
Applies now: the prohibitions that matter in gambling
Article 5 has applied since February 2025 and carries the Act's highest fines: up to €35 million or 7% of worldwide annual turnover. Two of its prohibitions deserve an operator's attention.
Exploiting vulnerabilities
Article 5(1)(b) prohibits AI systems that exploit the vulnerabilities of a person or group due to their age, disability or a specific social or economic situation, with the objective or effect of materially distorting their behaviour in a way that causes, or is reasonably likely to cause, significant harm. Article 5(1)(a) does the same for manipulative or deceptive techniques.
In gambling, the risk is not in support — it is in marketing and retention. A personalisation model that learns to send the richest offers to players showing signs of chasing losses, or to time pushes for the moments they are most likely to deposit after a loss, is the kind of system these provisions were written for. Nobody has to intend it; a model optimised purely for deposits can learn it on its own.
The defensible pattern is the same one licensing regimes already push for: exclude players with active responsible-gambling markers from automated incentive targeting, cap incentive intensity by rule rather than by model, review what the model actually learned, and document all of it.
Emotion recognition at work
Article 5(1)(f) prohibits emotion recognition in the workplace, except for medical or safety reasons. For an operator that means one specific thing to check: analytics that infer the emotions of your own support agents from their voice or video are not just risky — they are banned. Emotion recognition here means inference from biometric data, so text sentiment scoring of chats is a different matter, but voice-based "agent mood" dashboards should be switched off.
What is high-risk in an operator's stack — and what isn't
The high-risk list in Annex III is where the amendment bought time, so it is worth knowing whether any of your systems are on it. For a typical licensed operator, most are not:
| System | Category | Why |
|---|---|---|
| AI player support (chat, email, voice) | Transparency only | Article 50(1) disclosure; not listed in Annex III |
| Fraud and bonus-abuse detection | Not high-risk | Annex III expressly excludes systems used to detect financial fraud from the creditworthiness category |
| KYC face match against an ID document | Not high-risk | Biometric verification whose sole purpose is confirming a person is who they claim to be is excluded |
| Responsible-gambling risk models | Not listed as such | No Annex III category names them; check the specific design with counsel |
| Affordability checks | Grey zone | They resemble an assessment of financial standing; whether that amounts to "creditworthiness" is a legal question, not a technical one |
| Emotion recognition on player calls | High-risk + disclosure | Emotion recognition is listed in Annex III; Article 50(3) also requires informing the people exposed |
| AI in hiring and managing staff | High-risk | Employment is an Annex III area; now due 2 December 2027 |
| Marketing personalisation | Check against Article 5 | Not high-risk, but the prohibitions above apply |
So for most operators, the postponement matters only for HR tooling and, possibly, affordability models. It does not change anything about support automation, which was a transparency question all along.
The voice channel: one feature to look at twice
Voice is where operators most easily wander into a higher category without noticing. A voice agent that answers deposit and withdrawal questions is an Article 50(1) system like a chatbot: disclose at the start of the call and you're done. A voice agent that also infers the caller's emotional state from their voice — to prioritise angry callers, or to flag distress — is running emotion recognition, which is high-risk and requires informing the caller under Article 50(3).
There is a better design for the legitimate goal behind it. Detecting a player in distress is a responsible-gambling job, and it can be done from what the player says — the transcript — using the same layered detection as in chat, without inferring emotions from biometric signals. We describe that approach in responsible gambling signals in support chats.
AI-generated marketing content
If you publish AI-generated or manipulated images, audio or video that look real — a synthetic presenter, a cloned voice in an ad — Article 50(4) requires disclosing that the content is artificial, from 2 August 2026. Evidently creative or fictional content gets a lighter-touch disclosure, but it still gets one. The machine-readable marking duty and its grace period to December 2026 sit with the providers of the generation tools, not with you.
AI-written marketing copy is generally not covered: the text rule in Article 50(4) applies to text published to inform the public on matters of public interest, and even then not when a person with editorial responsibility has reviewed it. Advertising codes and your licence conditions on marketing still apply regardless of who wrote the words.
Where player data goes in AI support — precisely.
The full data path, the redaction detail and the audit trail, written for the people who have to sign off.
What your gambling licence adds on top
The AI Act is horizontal: it sits on top of, not instead of, your gambling licence conditions and data-protection law. For a licensed operator, the gambling regulator is usually the more likely reviewer of an AI support deployment, and it will ask different questions:
- Can you reconstruct any conversation? What the AI said, which account data it read, what it did or declined to do, and why it handed over. An action-level audit trail — with no personal data in the audit tables themselves — answers this.
- Did a responsible-gambling signal reach a person? Duty-of-care obligations don't distinguish between a missed signal by a human agent and one missed by a model. The safe rule is that the AI detects and hands off; it never handles an RG case alone.
- Who decided? Under GDPR Article 22, decisions with significant effects on a player — restricting an account, imposing a limit, refusing a withdrawal — should not rest solely on automated processing. Keep the AI on the side of explaining and routing, and a human on the side of deciding.
- Are complaints handled the licensed way? Complaint and dispute routes, timelines and records required by your licence apply whether the first response came from a person or a model.
The broader data-protection side — processor agreements, tokenisation before an external model call, EU endpoints with zero retention — is covered in EU AI Act and GDPR for AI player support.
An operator's checklist by deadline
| When | Action |
|---|---|
| Now | Confirm AI disclosure at first contact in every AI-served channel, including voice and email; remove human personas; make "am I talking to a bot?" answer truthfully in every language. |
| Now | Review marketing and retention models against Article 5: exclude players with RG markers from automated incentive targeting and document the controls. |
| Now | Switch off any emotion inference on your own agents' voice or video. |
| Now | Inventory every AI system and record its category, its provider and who is responsible for which obligation; put that split into vendor contracts. |
| By 2 December 2026 | If you publish synthetic media in marketing, check your tools' marking and keep your own disclosure in place. |
| By 2 December 2027 | Bring HR and recruitment AI, any emotion recognition you decide to keep, and affordability models classed as high-risk up to the high-risk requirements. |
None of this needs to wait for the high-risk deadline, and most of it is cheaper to build in than to retrofit. If you are evaluating vendors, the questions in our buyer's guide cover the same ground.
The short version
For a licensed EU gambling operator, the 2026 amendment postponed very little that matters. Disclosing AI in support has applied since 2 August 2026; the prohibitions on manipulation and exploiting vulnerabilities have applied since February 2025 and bite hardest in marketing, not support. The high-risk delay to December 2027 mostly affects hiring tools and grey-zone affordability models — fraud detection and KYC face matching are expressly outside it. On top of all of it sit your licence conditions, which care about audit trails, responsible-gambling handoffs and human decisions. Build those in once, and AI player support stays on the right side of both regimes.
Frequently asked questions
Did the 2026 AI Act amendment delay the chatbot disclosure rule?
No. Regulation (EU) 2026/1744 postponed the high-risk obligations, but the Article 50 duty to inform people they are interacting with an AI system has applied on its original date, 2 August 2026. Only the machine-readable marking of generated content got a short grace period for systems already on the market, to 2 December 2026.
Is an AI support chatbot for a casino a high-risk AI system?
Generally not. A support assistant that answers questions and looks up account information is not listed in Annex III; its main AI Act obligation is transparency under Article 50. It can move into a higher category if it adds features such as emotion recognition from a caller's voice, so check each feature, not just the product label.
Are fraud detection and KYC verification high-risk under the AI Act?
Annex III expressly excludes AI systems used to detect financial fraud from the creditworthiness category, and excludes biometric verification whose sole purpose is to confirm that a person is who they claim to be. A standard fraud model and a KYC face match against an ID document are therefore generally outside the high-risk list. Classification still depends on the specific system.
How does the AI Act affect gambling marketing?
Through the Article 5 prohibitions, which have applied since February 2025. AI systems that exploit vulnerabilities linked to age, disability or a specific social or economic situation, or that use manipulative techniques, in ways that materially distort behaviour and cause or are likely to cause significant harm, are banned. Personalisation and retention models should exclude players with responsible-gambling markers from automated incentive targeting and document those controls.
What are the fines under the AI Act?
Up to 35 million euros or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and up to 15 million euros or 3% for most other breaches, including the Article 50 transparency obligations. For SMEs, the lower of the two amounts applies. This article is not legal advice; confirm your position with counsel.
Last reviewed 9 October 2026. Figures marked as industry ranges are ranges, not Arctura claims; operator-specific numbers are only quoted after validation on the operator's own baseline.
