Somewhere in an operator’s back end, a model has already decided that an account is a risk. It read the deposit pattern, the hour of the night, the climbing stake size and the cancelled withdrawal, scored them against thousands of similar histories, and pushed the number past a threshold. No human touched it until the alert reached a compliance queue. Systems like that run at licensed operators right now, which is why ai gambling regulation has become a live argument rather than a formality: industry figures are split on whether gambling needs bespoke AI rules at all, or whether existing consumer protection law, data protection law and the EU AI Act already cover the ground.
The split was set out plainly in a recent special report from Focus Gaming News, which put the question to five industry figures. Read it closely and the headline framing wobbles. Almost nobody argued for a dedicated AI gambling statute. What they disagreed about was narrower and more awkward: whether a law that technically applies but is barely enforced counts as regulation at all.
What artificial intelligence in casinos actually does today
AI in gambling is not a forecast. Machine learning models are already embedded in four operational layers at most mid-size and large operators: player monitoring, fraud and financial crime checks, pricing and risk management, and marketing. Each one makes decisions that affect money leaving or entering a player’s account.
Player monitoring and dynamic risk scoring
Dynamic risk scoring assigns every active account a continuously updated number based on behaviour rather than on fixed triggers. Older systems fired on static rules: deposit over X, session longer than Y. Predictive models instead compare a player’s pattern against historical trajectories and estimate the probability of harm, chargeback or account takeover before any single limit is breached. The score moves within a session, not monthly.
Fraud detection, KYC and AML checks
This is the least contested use and the most mature. Models score identity documents, device fingerprints, payment velocity and network links between accounts to flag bonus abuse, multi-accounting and money laundering patterns. KYC/AML obligations already carry hard legal duties in every regulated market, so the AI here sits inside a compliance regime that existed long before the models did. Nobody in the debate suggests this layer needs new law.
Personalisation, odds-setting and marketing
The same behavioural data that feeds risk scoring also feeds segmentation. Recommendation engines choose which games surface on a player’s lobby, which bonus they are offered and when a re-engagement message lands. On the sportsbook side, models price markets and manage exposure in real time. This is where the discomfort concentrates, because the input set barely differs between “this player may be at risk” and “this player is worth another offer”. The same features, read by a different objective function, produce opposite instructions.
The core disagreement: new AI gambling regulation or the law already on the books?
The disagreement is not really about whether AI should be governed. It is about whether the gap between law and practice is a drafting problem or an enforcement problem. One camp says the statutes exist and regulators simply are not using them. Another says nothing alarming has yet appeared and premature rules would freeze a technology that is also doing useful work. A third says the industry should set its own standards now rather than wait to be told.
The five positions summarised in the Focus Gaming News report map the terrain reasonably well:
| Industry figure | Position as reported |
|---|---|
| Gustaf Hoffstedt | Gambling law should regulate outcomes, not prescribe how AI is used; regulators should prioritise stopping illegal operators from targeting consumers. |
| Catie Di Stefano | Existing arrangements are sufficient for now; she has not seen anything alarming about AI use in gambling. |
| Rasmus Kjaergaard | AI is already used across the industry, which should develop responsible standards rather than wait for mandates. |
| Giulio Coraggio | Existing law is substantively sufficient but poorly enforced; operators, suppliers and affiliates may already be exposed under the EU AI Act. |
| Craig Cornforth | AI should be paired with trained teams and independent lived-experience assurance, not treated solely as a risk to be regulated. |
The case for dedicated rules
The argument for AI-specific gambling rules rests on auditability. General data protection law gives individuals rights over their data and the EU AI Act sets obligations by risk category, but neither tells a gambling regulator what a player-protection model must be able to demonstrate. If an operator claims its early-warning system identifies harm, no standard currently defines what detection rate, what false-positive tolerance, or what evidence a licensing body should demand before accepting that claim as a compliance control. Sector-specific rules would also close the question of who carries liability when a third-party supplier’s model gets it wrong.
The case for enforcing what already exists
The opposing argument is that the obligations are already there and the regulation-by-outcome model works better. An operator that profiles a vulnerable player into a higher-spend segment is breaching consumer protection and licensing duties regardless of whether a neural network or a marketing manager made the call. Writing the technology into statute invites rules that are obsolete within two years and produces regulatory fragmentation, with each jurisdiction defining “high-risk AI” differently. The reported view that existing law is substantively sufficient but poorly enforced is the sharpest version of this: new text does not fix an enforcement vacuum, it adds to it.
I find that position the more persuasive one, with a condition attached. Regulating outcomes only works if the regulator can inspect the process that produced the outcome. Where I would not go along with the “existing law is fine” camp is on self-certification: an operator attesting that its own risk model works, with no external testing and no published methodology, is not a control. It is a claim.
What breaks when nobody audits the model
Unregulated AI player monitoring creates four concrete exposures, and none of them require bad intent to materialise.
- Algorithmic bias. Models trained on historical player data inherit whatever patterns that data contains, which can mean systematically flagging or ignoring particular groups of customers.
- Opacity. If a model cannot explain why an account was restricted, the player cannot challenge it and the regulator cannot test it.
- Data privacy. Behavioural profiling of this depth is personal-data processing on a large scale, and the lawful basis for using it to sell rather than to protect is far from settled.
- Targeting. A model that predicts harm accurately also predicts, by construction, who will keep depositing past the point of control. Pointed at revenue, that is a more effective targeting tool than any human marketer has ever had.
The last one is the real stake. Gambling floors have long accepted audit trails for money: casino management systems that log every slot payout exist precisely so a regulator can reconstruct what happened. No equivalent standard exists for the models that decide which player sees which offer.
Responsible gambling AI tools: genuine upside, honest limits
AI-driven player-protection tools do work better than the fixed-threshold rules they replaced, and the industry should say so. They are also unproven in the way that matters, because almost no operator publishes accuracy figures.
Early-warning systems for problem gambling
Behavioural models can flag markers of harm days or weeks before a static deposit limit would trigger: chasing losses after a big session, erratic bet sizing, night-time play creeping later, repeated cancelled withdrawals. Detection is the easy half. Intervention is the half that decides whether the tool helps, and the evidence on what message, sent by whom, at what moment, actually changes behaviour is thin. A flag that routes to a templated email achieves very little. One that routes to a trained human who has been taught how to open the conversation achieves considerably more, which is the force of the argument for pairing AI with trained teams and independent lived-experience assurance.
Automated limits and self-exclusion
The more useful applications are mechanical: suggesting a deposit limit at the moment a risk score rises, enforcing cooling-off periods without a support ticket, and cross-checking registrations against national exclusion registers so a self-excluded player cannot simply open a new account. These are the places where automation removes friction from the player’s side rather than adding persuasion. If you use these tools yourself, it is worth understanding how self-exclusion rules differ between online casinos, because automation only reaches as far as the operator’s own register unless the jurisdiction mandates a shared one.
What an iGaming compliance technology framework might require
Several approaches are under discussion, none of them decided. Regulatory sandboxes, where operators test models under supervision before full deployment, are the option licensing bodies tend to favour because they cost less than drafting new statute. Mandatory independent audits of any model used as a player-protection control would address the self-certification problem directly. Explainability requirements, meaning the operator must be able to state in plain terms why a decision was made, would give both players and regulators something to test against. Some commentators also point out that operators, suppliers and affiliates may already be exposed under the EU AI Act, which would make classification and documentation the first practical compliance task regardless of what gambling regulators do next.
Whether any of this becomes binding is open. The plausible near-term outcome is uneven: a few licensing bodies adding model-documentation requirements to licence conditions, most saying nothing, and operators setting internal standards in the gap. That is regulatory fragmentation arriving by default rather than by design, and the firms doing it properly will be the ones that are also the easiest to inspect.
The part nobody has settled
The unresolved tension is not innovation versus protection in the abstract. It is that the industry is asking regulators to accept AI as a player-protection control while mostly declining to publish evidence that it works, and regulators are being asked to trust a system they have no agreed method of testing. Enforcement, not drafting, is where that gets resolved, and enforcement is slow. Until then, treat an operator’s claim that “AI protects our players” as a statement about intent rather than about results.
If gambling has stopped being entertainment for you, the deposit limits, cool-off settings and self-exclusion tools in your account work whether or not a model flagged you first, and national gambling support services are free and confidential.
About The Author
