#
Companies Act 2014 (Act No. 2014-19) (In force since 2014-11-01): Primary Gibraltar corporate-law statute (in force 1 November 2014) framing directors' fiduciary duties, corporate governance statements and strategic/business-review reporting (ss.249-252A) for Gibraltar companies developing or deploying AI systems.
In force: under the Gibraltar General Data Protection Regulation (Retained Regulation (EU) 2016/679, in force from 1 January 2021 and amended 15 July 2026 by the Data Protection Regulations 2026, LN.2026/096), Article 22(1) and (3), read with Data Protection Act 2004 section 17, data subjects have the right not to be subject to solely automated decisions producing legal or similarly significant effects; where the decision rests on contract (Article 22(2)(a)) or explicit consent (Article 22(2)(c)), controllers must implement human-intervention, point-of-view and contestation safeguards. Gibraltar regulates automated decision-making through this data-protection regime in the absence of AI-specific legislation. The Data Protection Regulations 2026 (LN.2026/096), in force from 15 July 2026, inserted Article 22(3A), confirming the Article 22(2)(b) exception for significant solely automated decisions authorised under Gibraltar law and triggering a Data Protection Act 2004 section 17(4) written-notification duty to the affected data subject within the statutory period.
The UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562), signed 14 July 2026 and provisionally applied from 15 July 2026, binds Gibraltar under Part Three, Title I, Articles 256 and 268 (subject to Article 256(4)-(6) derogations) to maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with relevant Union goods law. As an autonomous British Overseas Territory outside Northern Ireland and outside the EU single market in services, Gibraltar is not reached by UK domestic Data (Use and Access) Act 2025 section 80 or by Windsor Framework Annex 2 Decision No 3/2026; its relationship to EU rules runs instead through the UK–EU Gibraltar Agreement itself. Formal conclusion of the Agreement, following the European Parliament consent procedure, is targeted for a window closing 14 December 2026, a step distinct from the provisional application already in force since 15 July 2026.
Beyond binding law, HM Government of Gibraltar held an AI Futures & Foresight Conference on 21 January 2026, signalling policy ambition rather than creating any obligation. An AI regulatory taskforce was announced for Gibraltar but had not been formally launched as of February 2026. No AI-specific bill is pending in this module.
Instruments (5)
- Companies Act 2014 (Act No. 2014-19) In force since 2014-11-01
Primary Gibraltar corporate-law statute (in force 1 November 2014) framing directors' fiduciary duties, corporate governance statements and strategic/business-review reporting (ss.249-252A) for Gibraltar companies developing or deploying AI systems.
- Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) In force since 2006-04-01
Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026). Section 17 applies exclusively to qualifying significant solely automated decisions required or authorised by Gibraltar law under Gibraltar GDPR Article 22(2)(b), requiring written notice as soon as reasonably practicable and giving data subjects a 1-month right to request reconsideration or a new decision not based solely on automated processing.
- Data Protection Regulations 2026 (LN.2026/096) In force since 2026-07-15
Gibraltar subsidiary legislation effective 15 July 2026 amending Gibraltar GDPR Article 22(3) and inserting Article 22(3A) to demarcate Article 22(2)(a)/(c) controller safeguards from statutory-authorisation safeguards under DPA 2004 s.17.
- Gibraltar General Data Protection Regulation (Retained Regulation (EU) 2016/679, as amended 15 July 2026) In force since 2021-01-01
Core horizontal data-protection regulation in Gibraltar since 1 January 2021; Article 22(1) restricts solely automated decisions with legal or similarly significant effects, Article 22(3) governs contract and explicit-consent exceptions ((2)(a) and (c)), and Article 22(3A) (inserted 15 July 2026 by LN.2026/096) routes statutory-authorisation cases ((2)(b)) to Data Protection Act 2004 s.17.
- UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562) In force since 2026-07-15
Signed on 14 July 2026 and provisionally applied from 15 July 2026 pending European Parliament consent. While financial, gambling and digital services remain outside the EU single market, Part Three Title I (Articles 256 & 268) requires Gibraltar to maintain and apply legislation ensuring that physical goods produced or placed on the Gibraltar market comply with relevant Union goods law (creating a dynamic goods-alignment bridge relevant to Annex I AI safety components in physical products, subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices labelled 'UK only').
Obligations
- Gibraltar GDPR Article 22(1), (3) & (3A) and Data Protection Act 2004 s.17 (as amended by LN.2026/096)
Under Gibraltar GDPR Article 22(1), data subjects have the right not to be subject to a decision based solely on automated processing (including profiling) producing legal or similarly significant effects unless an exception in Article 22(2)(a) (contract), (b) (authorised by Gibraltar law) or (c) (explicit consent) applies. For contract and explicit-consent cases ((2)(a) and (c)), Article 22(3) requires suitable safeguards including human intervention, expressing a point of view and contesting the decision. Exclusively for qualifying significant decisions authorised by Gibraltar law under Article 22(2)(b) (per Article 22(3A), inserted 15 July 2026 by LN.2026/096), DPA 2004 s.17(4) requires the controller to notify the data subject in writing as soon as reasonably practicable and entitles the data subject within 1 month of receipt to request reconsideration or a new decision not based solely on automated processing.
- Part Three, Title I, Articles 256 & 268 (subject to Article 256(4)-(6) derogation)
From 15 July 2026 (provisional application), goods produced or placed on the market in Gibraltar must comply with relevant Union law governing the production or placing on the market of goods (excluding UK-authorised human medicinal products and related medical devices labelled 'UK only' under Article 256(4)-(6)), creating a dynamic goods-compliance bridge for physical products with AI safety components as Union product harmonisation dates take effect.
Milestones
- UK–EU Gibraltar Agreement signed (14 July 2026) and provisionally applied (15 July 2026), aligning Gibraltar goods market rules under Arts 256 & 268 Met
- Data Protection Regulations 2026 (LN.2026/096) commenced, inserting Gibraltar GDPR Article 22(3A) Met
- Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement Upcoming
Claims and evidence (8)
As at the research date, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework; AI-related risk is governed indirectly through existing company, financial-services and data-protection law.
Evidence and sources
- Chambers and Partners
Gibraltar does not currently have AI-specific legislation or a dedicated regulatory regime equivalent to the EU AI Act.
- company.gi
As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence
- Chambers and Partners
An AI regulatory taskforce was announced for Gibraltar but has not been formally launched as of February 2026.
Evidence and sources
- company.gi
As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence
- company.gi
Gibraltar regulates automated decision-making through data-protection law (GDPR Art 22 / DPA 2004 s.17) in the absence of AI-specific legislation.
Evidence and sources
- Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)
17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).
- Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)
HM Government of Gibraltar held an AI Futures & Foresight Conference on 21 January 2026.
Evidence and sources
- HM Government of Gibraltar
Gibraltar today reinforced its ambition to take a responsible lead in the adoption of artificial intelligence
- HM Government of Gibraltar
Exclusively for qualifying significant solely automated decisions authorised under Gibraltar law within Gibraltar GDPR Article 22(2)(b) (as confirmed by Article 22(3A), inserted 15 July 2026 by LN.2026/096), Data Protection Act 2004 s.17(4) requires controllers to notify the data subject in writing as soon as reasonably practicable and grants 1 month from receipt to request reconsideration or a new decision not based solely on automated processing.
Evidence and sources
- Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)
17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).
- Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)
(b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to- (i) reconsider the decision, or (ii) take a new decision that is not based solely on automated processing.
- Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)
3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).
- Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)
Under Gibraltar GDPR Article 22(1) and (3) (in force in Gibraltar from 1 January 2021 and amended 15 July 2026 by LN.2026/096), data subjects have the right not to be subject to solely automated decisions with legal or similarly significant effects; where contract ((2)(a)) or explicit consent ((2)(c)) applies, controllers must implement human intervention, point-of-view and contestation safeguards.
Evidence and sources
- Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)
3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).
- Gibraltar Regulatory Authority
Automated individual decision-making is a decision made by automated means without any human involvement, and is regulated by Article 22 of the Gibraltar GDPR.
- Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)
As an autonomous British Overseas Territory outside Northern Ireland and outside the EU single market in services, neither UK domestic Data (Use and Access) Act 2025 s.80 nor Windsor Framework Annex 2 Decision No 3/2026 applies in Gibraltar; however, under the UK–EU Gibraltar Agreement (OJ L 2026/1562, provisionally applied from 15 July 2026), Articles 256 & 268 dynamically align Gibraltar's physical goods rules with EU goods law (subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices), and EU AI Act Article 2(1)(a) & (c) applies extraterritorially to Gibraltar operators placing AI systems/GPAI models on the EU market or whose AI output is used in the Union.
Evidence and sources
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar
- Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)
providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
Under Part Three, Title I (Articles 256 & 268) of the UK–EU Agreement in respect of Gibraltar (signed 14 July 2026, provisionally applied from 15 July 2026), Gibraltar must maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with Union goods law — creating a goods-alignment bridge for physical products containing AI safety components while carving out UK-authorised human medicines and medical devices labelled 'UK only' under Article 256(4)-(6) and leaving services outside the EU single market.
Evidence and sources
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar
- Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)