---
title: "Gibraltar — Global AI Monitor"
canonical: https://artificial-intelligence.gi/jurisdictions/gibraltar/
source_html: /jurisdictions/gibraltar/index.html
description: "Gibraltar AI governance record: 13 instruments, 6 obligations and 19 evidenced claims across 12 modules. Research as of 12 Nov 2026."
generated_at: 2026-11-12T17:20:02Z
content_sha256: f98ea8cfdff5db9e6b42e8c6891eede0b7ff9c798d67961e23ccf4ec21c11b18
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar AI Regulation & Governance

12 active modules 0 quiet

Last updated 11 Nov 2026 · 12 modules · 13 instruments · 19 claims · 23 sources in the cumulative register

Download report (PDF) Collapse all

Framework status Companies Act 2014 (Act No. 2014-19) (In force since 2014-11-01): Primary Gibraltar corporate-law statute (in force 1 November 2014) framing directors' fiduciary duties, corporate governance statements and strategic/business-review reporting (ss.249-252A) for Gibraltar companies developing or deploying AI systems.

Main regulator Regulator No designated AI authority as at September 2026; Gibraltar has no dedicated AI Act, and the Government has only signalled intent to develop a framework

Next milestone 2 Dec 2026 : EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users ([02 Prohibited Practices](#sec-mod-prohibited_practices))

Record status Live · Periodic active record · 23 sources (20 retrieved) · 0 under review · Not yet expert-reviewed

✦ AI-assembled from cited sources

Evidence-gated · [How we verify](/methodology/#ai-content-disclosure) · Disclosure Not yet expert-reviewed · Not legal, compliance or investment advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See [methodology](/methodology/).

Source tiers: T1 enacted statute, regulation, or binding supervisory order · T2 official regulator guidance, consultation, or registry · T3 international standard-setter or peer-reviewed analysis · T4 practitioner commentary or secondary reporting. Confidence: high = corroborated by retrieved T1/T2 text · medium = single official source or secondary corroboration · low = preliminary or unverified. [Full definitions →](/methodology/#source-tiers)

Research checked 12 Nov 2026 · Updated 11 Nov 2026 Record history Research as of 12 Nov 2026 · Record last changed 11 Nov 2026 · Published 11 Nov 2026 · Page built 12 Nov 2026

13 Instruments

13 Current instruments

8 Binding, in force

6 Obligations

19 Claims

2 Upcoming milestones

23 Sources

## Next milestones in this record

- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users Scheduled · [02 Prohibited Practices](#sec-mod-prohibited_practices)
- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users Scheduled · [03 High-Risk Systems](#sec-mod-high_risk_systems)
- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users Scheduled · [05 Transparency & Synthetic Content](#sec-mod-transparency_and_synthetic_content)
- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users Scheduled · [11 Sandboxes & Transitional Relief](#sec-mod-sandboxes_and_transitional_relief)
- 14 Dec 2026Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement Scheduled · [01 AI Framework Law](#sec-mod-ai_framework_law)

Jump to module (12)

### 01AI Framework LawActive▾#

Companies Act 2014 (Act No. 2014-19) (In force since 2014-11-01): Primary Gibraltar corporate-law statute (in force 1 November 2014) framing directors' fiduciary duties, corporate governance statements and strategic/business-review reporting (ss.249-252A) for Gibraltar companies developing or deploying AI systems.

5 instruments (5 current) · 2 obligations · 8 claims · 3 milestones · Next: 14 Dec 2026 (Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement)

Gibraltar has no standalone artificial-intelligence statute. As at the research date, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework; AI-related risk is governed indirectly through existing company, financial-services and data-protection law.

In force: under the Gibraltar General Data Protection Regulation (Retained Regulation (EU) 2016/679, in force from 1 January 2021 and amended 15 July 2026 by the Data Protection Regulations 2026, LN.2026/096), Article 22(1) and (3), read with Data Protection Act 2004 section 17, data subjects have the right not to be subject to solely automated decisions producing legal or similarly significant effects; where the decision rests on contract (Article 22(2)(a)) or explicit consent (Article 22(2)(c)), controllers must implement human-intervention, point-of-view and contestation safeguards. Gibraltar regulates automated decision-making through this data-protection regime in the absence of AI-specific legislation. The Data Protection Regulations 2026 (LN.2026/096), in force from 15 July 2026, inserted Article 22(3A), confirming the Article 22(2)(b) exception for significant solely automated decisions authorised under Gibraltar law and triggering a Data Protection Act 2004 section 17(4) written-notification duty to the affected data subject within the statutory period.

The UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562), signed 14 July 2026 and provisionally applied from 15 July 2026, binds Gibraltar under Part Three, Title I, Articles 256 and 268 (subject to Article 256(4)-(6) derogations) to maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with relevant Union goods law. As an autonomous British Overseas Territory outside Northern Ireland and outside the EU single market in services, Gibraltar is not reached by UK domestic Data (Use and Access) Act 2025 section 80 or by Windsor Framework Annex 2 Decision No 3/2026; its relationship to EU rules runs instead through the UK–EU Gibraltar Agreement itself. Formal conclusion of the Agreement, following the European Parliament consent procedure, is targeted for a window closing 14 December 2026, a step distinct from the provisional application already in force since 15 July 2026.

Beyond binding law, HM Government of Gibraltar held an AI Futures & Foresight Conference on 21 January 2026, signalling policy ambition rather than creating any obligation. An AI regulatory taskforce was announced for Gibraltar but had not been formally launched as of February 2026. No AI-specific bill is pending in this module.

Read full sub-brief · 380 words

Instruments (5)
- Companies Act 2014 (Act No. 2014-19) In force since 2014-11-01Primary Gibraltar corporate-law statute (in force 1 November 2014) framing directors' fiduciary duties, corporate governance statements and strategic/business-review reporting (ss.249-252A) for Gibraltar companies developing or deploying AI systems.Binding · [Official text](https://www.gibraltarlaws.gov.gi/legislations/companies-act-2014-3106/download)
- Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) In force since 2006-04-01Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026). Section 17 applies exclusively to qualifying significant solely automated decisions required or authorised by Gibraltar law under Gibraltar GDPR Article 22(2)(b), requiring written notice as soon as reasonably practicable and giving data subjects a 1-month right to request reconsideration or a new decision not based solely on automated processing.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download)
- Data Protection Regulations 2026 (LN.2026/096) In force since 2026-07-15Gibraltar subsidiary legislation effective 15 July 2026 amending Gibraltar GDPR Article 22(3) and inserting Article 22(3A) to demarcate Article 22(2)(a)/(c) controller safeguards from statutory-authorisation safeguards under DPA 2004 s.17.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/uploads/legislations/data-protection-regulations-2026-7682/2026s096.pdf)
- Gibraltar General Data Protection Regulation (Retained Regulation (EU) 2016/679, as amended 15 July 2026) In force since 2021-01-01Core horizontal data-protection regulation in Gibraltar since 1 January 2021; Article 22(1) restricts solely automated decisions with legal or similarly significant effects, Article 22(3) governs contract and explicit-consent exceptions ((2)(a) and (c)), and Article 22(3A) (inserted 15 July 2026 by LN.2026/096) routes statutory-authorisation cases ((2)(b)) to Data Protection Act 2004 s.17.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download)
- UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562) In force since 2026-07-15Signed on 14 July 2026 and provisionally applied from 15 July 2026 pending European Parliament consent. While financial, gambling and digital services remain outside the EU single market, Part Three Title I (Articles 256 & 268) requires Gibraltar to maintain and apply legislation ensuring that physical goods produced or placed on the Gibraltar market comply with relevant Union goods law (creating a dynamic goods-alignment bridge relevant to Annex I AI safety components in physical products, subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices labelled 'UK only').Binding · [Official text](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng)

Obligations

- Gibraltar GDPR Article 22(1), (3) & (3A) and Data Protection Act 2004 s.17 (as amended by LN.2026/096)Under Gibraltar GDPR Article 22(1), data subjects have the right not to be subject to a decision based solely on automated processing (including profiling) producing legal or similarly significant effects unless an exception in Article 22(2)(a) (contract), (b) (authorised by Gibraltar law) or (c) (explicit consent) applies. For contract and explicit-consent cases ((2)(a) and (c)), Article 22(3) requires suitable safeguards including human intervention, expressing a point of view and contesting the decision. Exclusively for qualifying significant decisions authorised by Gibraltar law under Article 22(2)(b) (per Article 22(3A), inserted 15 July 2026 by LN.2026/096), DPA 2004 s.17(4) requires the controller to notify the data subject in writing as soon as reasonably practicable and entitles the data subject within 1 month of receipt to request reconsideration or a new decision not based solely on automated processing.Human oversight · Applies to: Controller · Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026)
- Part Three, Title I, Articles 256 & 268 (subject to Article 256(4)-(6) derogation)From 15 July 2026 (provisional application), goods produced or placed on the market in Gibraltar must comply with relevant Union law governing the production or placing on the market of goods (excluding UK-authorised human medicinal products and related medical devices labelled 'UK only' under Article 256(4)-(6)), creating a dynamic goods-compliance bridge for physical products with AI safety components as Union product harmonisation dates take effect.Conformity assessment · Applies to: Product manufacturer · UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Milestones

- 15 Jul 2026UK–EU Gibraltar Agreement signed (14 July 2026) and provisionally applied (15 July 2026), aligning Gibraltar goods market rules under Arts 256 & 268 MetUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
- 15 Jul 2026Data Protection Regulations 2026 (LN.2026/096) commenced, inserting Gibraltar GDPR Article 22(3A) MetData Protection Regulations 2026 (LN.2026/096)
- 14 Dec 2026 (Month)Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement UpcomingUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Claims and evidence (8)
- As at the research date, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework; AI-related risk is governed indirectly through existing company, financial-services and data-protection law.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Chambers and Partners](https://practiceguides.chambers.com/practice-guides/corporate-governance-2026/gibraltar) T3 · Retrieved · retrieved 4 Nov 2026Gibraltar does not currently have AI-specific legislation or a dedicated regulatory regime equivalent to the EU AI Act.
- [company.gi](https://company.gi/guide/ai/regulation) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence

- An AI regulatory taskforce was announced for Gibraltar but has not been formally launched as of February 2026.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[company.gi](https://company.gi/guide/ai/regulation) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence

- Gibraltar regulates automated decision-making through data-protection law (GDPR Art 22 / DPA 2004 s.17) in the absence of AI-specific legislation.Confidence: Confirmed · EvidencedEvidence and sources[Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(1)-(3)17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).

- HM Government of Gibraltar held an AI Futures & Foresight Conference on 21 January 2026.Confidence: Probable · As of 21 Jan 2026 · EvidencedEvidence and sources[HM Government of Gibraltar](https://www.gibraltar.gov.gi/press-releases/gibraltar-advances-responsible-ai-leadership-following-ai-futures-foresight-conference-332026-11624) T1 · Retrieved · retrieved 4 Nov 2026Gibraltar today reinforced its ambition to take a responsible lead in the adoption of artificial intelligence

- Exclusively for qualifying significant solely automated decisions authorised under Gibraltar law within Gibraltar GDPR Article 22(2)(b) (as confirmed by Article 22(3A), inserted 15 July 2026 by LN.2026/096), Data Protection Act 2004 s.17(4) requires controllers to notify the data subject in writing as soon as reasonably practicable and grants 1 month from receipt to request reconsideration or a new decision not based solely on automated processing.Confidence: Confirmed · As of 1 Jan 2021 · EvidencedEvidence and sources[Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(1)-(3)17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).
- [Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(4)(b)(b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to- (i) reconsider the decision, or (ii) take a new decision that is not based solely on automated processing.
- [Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download) T1 · Retrieved · retrieved 12 Nov 2026 · Article 22(3A)3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).

- Under Gibraltar GDPR Article 22(1) and (3) (in force in Gibraltar from 1 January 2021 and amended 15 July 2026 by LN.2026/096), data subjects have the right not to be subject to solely automated decisions with legal or similarly significant effects; where contract ((2)(a)) or explicit consent ((2)(c)) applies, controllers must implement human intervention, point-of-view and contestation safeguards.Confidence: Confirmed · EvidencedEvidence and sources[Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download) T1 · Retrieved · retrieved 12 Nov 2026 · Article 22(3A)3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).
- [Gibraltar Regulatory Authority](https://www.gra.gi/uploads/documents/data-protection/Documents/Guidance/GDPR23.pdf) T1 · Retrieved · retrieved 4 Nov 2026Automated individual decision-making is a decision made by automated means without any human involvement, and is regulated by Article 22 of the Gibraltar GDPR.

- As an autonomous British Overseas Territory outside Northern Ireland and outside the EU single market in services, neither UK domestic Data (Use and Access) Act 2025 s.80 nor Windsor Framework Annex 2 Decision No 3/2026 applies in Gibraltar; however, under the UK–EU Gibraltar Agreement (OJ L 2026/1562, provisionally applied from 15 July 2026), Articles 256 & 268 dynamically align Gibraltar's physical goods rules with EU goods law (subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices), and EU AI Act Article 2(1)(a) & (c) applies extraterritorially to Gibraltar operators placing AI systems/GPAI models on the EU market or whose AI output is used in the Union.Confidence: Confirmed · Not recordedEvidence and sources[Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(1)-(3)Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- [Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(4)-(6)4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar
- [Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country

- Under Part Three, Title I (Articles 256 & 268) of the UK–EU Agreement in respect of Gibraltar (signed 14 July 2026, provisionally applied from 15 July 2026), Gibraltar must maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with Union goods law — creating a goods-alignment bridge for physical products containing AI safety components while carving out UK-authorised human medicines and medical devices labelled 'UK only' under Article 256(4)-(6) and leaving services outside the EU single market.Confidence: Confirmed · EvidencedEvidence and sources[Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(1)-(3)Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- [Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(4)-(6)4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar

### 02Prohibited PracticesActive▾#

Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) (In force since 2024-08-01): Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).

2 instruments (2 current) · 1 obligation · 1 claim · 1 milestone · Next: 2 Dec 2026 (EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users)

Gibraltar has no domestic statutory list of prohibited AI practices. Gibraltar financial, distributed-ledger-technology and online-gambling operators that place AI systems on the EU market, or whose AI system output is used in the Union, are nonetheless bound extraterritorially by Article 5 of Regulation (EU) 2024/1689 (EU Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI), which prohibits the practices listed in Article 5(1) read with Article 2(1)(a) and (c). This extraterritorial reach operates independently of Gibraltar's own legislative programme, which contains no equivalent domestic prohibition and no Gibraltar-enacted enforcement mechanism of its own.

Instruments (2)
- Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) In force since 2024-08-01Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)
- Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI) In force since 2026-07-27Amends Regulation (EU) 2024/1689 from 27 July 2026, deferring Annex III high-risk obligations to 2 December 2027 and Annex I product high-risk obligations to 2 August 2028, adding Article 5(1)(ba)-(bb) intimate/CSAM prohibitions, and granting pre-2 August 2026 synthetic-content AI systems until 2 December 2026 for Article 50(2) marking compliance.Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng)

Obligations

- Article 5(1) read with Article 2(1)(a) & (c) (as amended by Reg (EU) 2026/1744)Gibraltar-established financial, DLT and remote-gambling operators placing AI systems on the EU market (Art 2(1)(a)) or whose AI system output is used in the Union (Art 2(1)(c)) are prohibited from deploying or supplying Article 5 prohibited AI practices, including manipulative/subliminal behavioural distortion, vulnerability exploitation, social scoring, untargeted facial-image scraping, and non-consensual intimate or CSAM generation (Art 5(1)(ba)-(bb)).Prohibition · Applies to: Provider · Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act)

Milestones

- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users UpcomingRegulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)

Claims and evidence (1)
- Although Gibraltar has no domestic statutory list of prohibited AI practices, Gibraltar financial, DLT and online-gambling operators placing AI systems on the EU market or whose AI output is used in the Union are bound extraterritorially by Article 5 of Regulation (EU) 2024/1689 (as amended by Regulation (EU) 2026/1744, including Article 5(1)(ba)-(bb) non-consensual intimate and CSAM prohibitions).Confidence: Confirmed · EvidencedEvidence and sources[Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country
- [Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 1(39)(b), inserting Article 111(4)4. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content that have been placed on the market before 2 August 2026 shall comply with the obligations laid down in Article 50(2) by 2 December 2026.

### 03High-Risk SystemsActive▾#

Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) (In force since 2006-04-01): Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026).

7 instruments (7 current) · 3 obligations · 6 claims · 4 milestones · Next: 2 Dec 2026 (EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users)

Binding law: under the Gibraltar GDPR (Retained Regulation (EU) 2016/679, in force from 1 January 2021 and amended 15 July 2026 by the Data Protection Regulations 2026, LN.2026/096) Article 22(1) and (3), read with Data Protection Act 2004 section 17, data subjects have the right not to be subject to solely automated decisions producing legal or similarly significant effects; where the decision rests on contract (Article 22(2)(a)) or explicit consent (Article 22(2)(c)), controllers must implement human-intervention, point-of-view and contestation safeguards. Gibraltar regulates automated decision-making through this data-protection regime rather than AI-specific legislation. For the narrower category of significant solely automated decisions authorised under Gibraltar law within Article 22(2)(b) — confirmed by the newly inserted Article 22(3A) — Data Protection Act 2004 section 17(4) requires controllers to notify the affected data subject in writing within the statutory period.

The UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562), provisionally applied from 15 July 2026, binds Gibraltar under Part Three, Title I, Articles 256 and 268 (subject to Article 256(4)-(6) derogations) to maintain legislation ensuring goods placed on the Gibraltar market, including AI-enabled hardware, comply with relevant Union goods law. Gibraltar sits outside Northern Ireland and outside the EU single market in services, so UK Data (Use and Access) Act 2025 section 80 and Windsor Framework Annex 2 Decision No 3/2026 do not apply; the UK–EU Gibraltar Agreement is the operative instrument for cross-border alignment instead.

Regulatory expectations: the Gibraltar Financial Services Commission's Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes, Chapter 5 paragraph 5.17, require GFSC-supervised financial-services and DLT firms deploying automated or AI-driven remote onboarding, facial-recognition or biometric-verification tools to evaluate error rates and spoofing/deepfake risks, retain full customer-due-diligence accountability, and maintain human escalation routes.

No AI-specific high-risk-systems classification regime or dedicated bill is pending in Gibraltar; the obligations above derive entirely from data-protection, treaty and financial-supervision law.

Read full sub-brief · 310 words

Instruments (7)
- Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) In force since 2006-04-01Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026). Section 17 applies exclusively to qualifying significant solely automated decisions required or authorised by Gibraltar law under Gibraltar GDPR Article 22(2)(b), requiring written notice as soon as reasonably practicable and giving data subjects a 1-month right to request reconsideration or a new decision not based solely on automated processing.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download)
- Data Protection Regulations 2026 (LN.2026/096) In force since 2026-07-15Gibraltar subsidiary legislation effective 15 July 2026 amending Gibraltar GDPR Article 22(3) and inserting Article 22(3A) to demarcate Article 22(2)(a)/(c) controller safeguards from statutory-authorisation safeguards under DPA 2004 s.17.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/uploads/legislations/data-protection-regulations-2026-7682/2026s096.pdf)
- GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence) Published 2026-01-01Sectoral supervisory guidance issued by the GFSC; Chapter 5 (§5.17) sets explicit governance, spoofing/deepfake vulnerability testing, and human-escalation controls where regulated financial and DLT firms deploy AI or automated remote-onboarding and biometric verification tools.Regulatory expectation · Authority: Gibraltar Financial Services Commission · [Official text](https://fsc.gi/uploads/AML%20Guidance%20Notes/5%20-%20Customer%20Due%20Diligence.pdf)
- Gibraltar General Data Protection Regulation (Retained Regulation (EU) 2016/679, as amended 15 July 2026) In force since 2021-01-01Core horizontal data-protection regulation in Gibraltar since 1 January 2021; Article 22(1) restricts solely automated decisions with legal or similarly significant effects, Article 22(3) governs contract and explicit-consent exceptions ((2)(a) and (c)), and Article 22(3A) (inserted 15 July 2026 by LN.2026/096) routes statutory-authorisation cases ((2)(b)) to Data Protection Act 2004 s.17.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download)
- GRA Guidance Note (GDPR) 23 — Automated Individual Decision-Making and Profiling Published 2021-01-01Information Commissioner (GRA) interpretive guidance on solely automated individual decision-making, profiling, meaningful human intervention, DPIA expectations and transparency under Gibraltar GDPR Article 22.Non-binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gra.gi/uploads/documents/data-protection/Documents/Guidance/GDPR23.pdf)
- Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI) In force since 2026-07-27Amends Regulation (EU) 2024/1689 from 27 July 2026, deferring Annex III high-risk obligations to 2 December 2027 and Annex I product high-risk obligations to 2 August 2028, adding Article 5(1)(ba)-(bb) intimate/CSAM prohibitions, and granting pre-2 August 2026 synthetic-content AI systems until 2 December 2026 for Article 50(2) marking compliance.Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng)
- UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562) In force since 2026-07-15Signed on 14 July 2026 and provisionally applied from 15 July 2026 pending European Parliament consent. While financial, gambling and digital services remain outside the EU single market, Part Three Title I (Articles 256 & 268) requires Gibraltar to maintain and apply legislation ensuring that physical goods produced or placed on the Gibraltar market comply with relevant Union goods law (creating a dynamic goods-alignment bridge relevant to Annex I AI safety components in physical products, subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices labelled 'UK only').Binding · [Official text](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng)

Obligations

- Gibraltar GDPR Article 22(1), (3) & (3A) and Data Protection Act 2004 s.17 (as amended by LN.2026/096)Under Gibraltar GDPR Article 22(1), data subjects have the right not to be subject to a decision based solely on automated processing (including profiling) producing legal or similarly significant effects unless an exception in Article 22(2)(a) (contract), (b) (authorised by Gibraltar law) or (c) (explicit consent) applies. For contract and explicit-consent cases ((2)(a) and (c)), Article 22(3) requires suitable safeguards including human intervention, expressing a point of view and contesting the decision. Exclusively for qualifying significant decisions authorised by Gibraltar law under Article 22(2)(b) (per Article 22(3A), inserted 15 July 2026 by LN.2026/096), DPA 2004 s.17(4) requires the controller to notify the data subject in writing as soon as reasonably practicable and entitles the data subject within 1 month of receipt to request reconsideration or a new decision not based solely on automated processing.Human oversight · Applies to: Controller · Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026)
- GFSC AML/CFT/CPF Guidance Notes, Chapter 5, paragraph 5.17GFSC-supervised financial-services and DLT firms deploying automated or AI-driven remote onboarding, facial recognition or biometric verification tools remain fully accountable for customer due diligence compliance and must assess algorithmic error rates, spoofing/deepfake risks, and maintain human review and escalation controls.Risk management · Applies to: Deployer · GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence)
- Part Three, Title I, Articles 256 & 268 (subject to Article 256(4)-(6) derogation)From 15 July 2026 (provisional application), goods produced or placed on the market in Gibraltar must comply with relevant Union law governing the production or placing on the market of goods (excluding UK-authorised human medicinal products and related medical devices labelled 'UK only' under Article 256(4)-(6)), creating a dynamic goods-compliance bridge for physical products with AI safety components as Union product harmonisation dates take effect.Conformity assessment · Applies to: Product manufacturer · UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Milestones

- 15 Jul 2026UK–EU Gibraltar Agreement signed (14 July 2026) and provisionally applied (15 July 2026), aligning Gibraltar goods market rules under Arts 256 & 268 MetUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
- 15 Jul 2026Data Protection Regulations 2026 (LN.2026/096) commenced, inserting Gibraltar GDPR Article 22(3A) MetData Protection Regulations 2026 (LN.2026/096)
- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users UpcomingRegulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)
- 14 Dec 2026 (Month)Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement UpcomingUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Claims and evidence (6)
- Gibraltar regulates automated decision-making through data-protection law (GDPR Art 22 / DPA 2004 s.17) in the absence of AI-specific legislation.Confidence: Confirmed · EvidencedEvidence and sources[Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(1)-(3)17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).

- Exclusively for qualifying significant solely automated decisions authorised under Gibraltar law within Gibraltar GDPR Article 22(2)(b) (as confirmed by Article 22(3A), inserted 15 July 2026 by LN.2026/096), Data Protection Act 2004 s.17(4) requires controllers to notify the data subject in writing as soon as reasonably practicable and grants 1 month from receipt to request reconsideration or a new decision not based solely on automated processing.Confidence: Confirmed · As of 1 Jan 2021 · EvidencedEvidence and sources[Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(1)-(3)17.(1) This section makes provision for the purposes of Article 22(2)(b) of the Gibraltar GDPR (exception from Article 22(1) of the Gibraltar GDPR for significant decisions based solely on automated processing that are required or authorised under Gibraltar law).
- [Data Protection Act 2004 (Act No. 2004-01, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 17(4)(b)(b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to- (i) reconsider the decision, or (ii) take a new decision that is not based solely on automated processing.
- [Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download) T1 · Retrieved · retrieved 12 Nov 2026 · Article 22(3A)3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).

- Under Gibraltar GDPR Article 22(1) and (3) (in force in Gibraltar from 1 January 2021 and amended 15 July 2026 by LN.2026/096), data subjects have the right not to be subject to solely automated decisions with legal or similarly significant effects; where contract ((2)(a)) or explicit consent ((2)(c)) applies, controllers must implement human intervention, point-of-view and contestation safeguards.Confidence: Confirmed · EvidencedEvidence and sources[Gibraltar GDPR (Retained Regulation (EU) 2016/679, current consolidated version as amended 15 July 2026)](https://www.gibraltarlaws.gov.gi/legislations/regulation-eu-2016679-5582/download) T1 · Retrieved · retrieved 12 Nov 2026 · Article 22(3A)3A. Section 17 of the 2004 Act, and regulations under that section, make provision to safeguard data subjects’ rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).
- [Gibraltar Regulatory Authority](https://www.gra.gi/uploads/documents/data-protection/Documents/Guidance/GDPR23.pdf) T1 · Retrieved · retrieved 4 Nov 2026Automated individual decision-making is a decision made by automated means without any human involvement, and is regulated by Article 22 of the Gibraltar GDPR.

- As an autonomous British Overseas Territory outside Northern Ireland and outside the EU single market in services, neither UK domestic Data (Use and Access) Act 2025 s.80 nor Windsor Framework Annex 2 Decision No 3/2026 applies in Gibraltar; however, under the UK–EU Gibraltar Agreement (OJ L 2026/1562, provisionally applied from 15 July 2026), Articles 256 & 268 dynamically align Gibraltar's physical goods rules with EU goods law (subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices), and EU AI Act Article 2(1)(a) & (c) applies extraterritorially to Gibraltar operators placing AI systems/GPAI models on the EU market or whose AI output is used in the Union.Confidence: Confirmed · Not recordedEvidence and sources[Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(1)-(3)Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- [Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(4)-(6)4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar
- [Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country

- Under Part Three, Title I (Articles 256 & 268) of the UK–EU Agreement in respect of Gibraltar (signed 14 July 2026, provisionally applied from 15 July 2026), Gibraltar must maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with Union goods law — creating a goods-alignment bridge for physical products containing AI safety components while carving out UK-authorised human medicines and medical devices labelled 'UK only' under Article 256(4)-(6) and leaving services outside the EU single market.Confidence: Confirmed · EvidencedEvidence and sources[Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(1)-(3)Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- [Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(4)-(6)4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar

- GFSC AML/CFT/CPF Guidance Notes Chapter 5 (§5.17) requires regulated financial-services and DLT firms in Gibraltar using automated or AI-driven remote onboarding and biometric verification tools to evaluate error rates and spoofing/deepfake risks, retain full CDD accountability, and maintain human escalation controls.Confidence: Confirmed · EvidencedEvidence and sources[GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence)](https://fsc.gi/uploads/AML%20Guidance%20Notes/5%20-%20Customer%20Due%20Diligence.pdf) T1 · Retrieved · retrieved 12 Nov 2026 · Chapter 5, paragraph 5.175.17 Artificial Intelligence .................................................................................................................. 340 Gibraltar Financial Services Commission AML/CFT/CPF Guidance Notes 3 5.1 Knowing Your Customer AML /CFT/CPF Requirements R12 A regulated entity must take appropriate measures to identify and verify the subject of a business relationship or occasional transaction. The application of these measures must be in line wi

### 04General-Purpose AIActive▾#

Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) (In force since 2024-08-01): Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).

1 instrument (1 current) · 1 obligation · 1 claim · 0 milestones

Gibraltar has enacted no domestic foundation-model statute. Any Gibraltar-incorporated provider placing a general-purpose AI model on the Union market must comply with Chapter V (Articles 53-55) of Regulation (EU) 2024/1689 (EU Artificial Intelligence Act), covering technical documentation, copyright and text-and-data-mining policy disclosure, training-data summaries, and appointment of an EU authorised representative, where the Gibraltar entity falls within Article 2(1)(a). This obligation is extraterritorial in nature, reaching Gibraltar-based providers through their EU market activity rather than through any Gibraltar-enacted general-purpose-AI law.

Instruments (1)
- Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) In force since 2024-08-01Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)

Obligations

- Articles 53-55 read with Article 2(1)(a)Gibraltar entities placing general-purpose AI models on the Union market must comply with Chapter V (Articles 53-55) technical documentation, copyright/TDM policy, training-data summary, EU authorised-representative (Art 54), and (where systemic-risk thresholds apply) adversarial evaluation and AI Office incident-reporting obligations.Documentation · Applies to: Provider · Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act)

Claims and evidence (1)
- Gibraltar has enacted no domestic foundation-model statute, but any Gibraltar-incorporated provider placing a general-purpose AI model on the Union market must comply with Chapter V (Articles 53-55) of Regulation (EU) 2024/1689, including technical documentation, EU authorised-representative appointment (Art 54), copyright compliance and systemic-risk incident reporting to the AI Office.Confidence: Confirmed · EvidencedEvidence and sources[Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country

### 05Transparency & Synthetic ContentActive▾#

Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) (In force since 2024-08-01): Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).

2 instruments (2 current) · 1 obligation · 1 claim · 1 milestone · Next: 2 Dec 2026 (EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users)

Gibraltar has no standalone domestic deepfake-labelling or synthetic-content-transparency legislation. Gibraltar operators deploying chatbots or synthetic-content AI systems into the EU market are nonetheless subject to Article 50 transparency duties under Regulation (EU) 2024/1689 (EU AI Act) from 2 August 2026, covering human-interaction and deepfake-disclosure obligations, with Article 111(4) granting pre-2 August 2026 synthetic-content AI systems serving EU users a transitional period running to 2 December 2026. This duty applies to Gibraltar operators under Article 2(1)(a) and (c) in respect of their EU-user-facing activity, operating extraterritorially rather than through domestic Gibraltar statute, and is now read together with the amendments made by Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI).

Instruments (2)
- Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) In force since 2024-08-01Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)
- Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI) In force since 2026-07-27Amends Regulation (EU) 2024/1689 from 27 July 2026, deferring Annex III high-risk obligations to 2 December 2027 and Annex I product high-risk obligations to 2 August 2028, adding Article 5(1)(ba)-(bb) intimate/CSAM prohibitions, and granting pre-2 August 2026 synthetic-content AI systems until 2 December 2026 for Article 50(2) marking compliance.Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng)

Obligations

- Article 50(1)-(4) & Article 111(4) read with Article 2(1)(a) & (c)Gibraltar operators offering customer-facing AI chatbots, emotion/biometric categorisation or synthetic media to EU users under Article 2(1)(a)/(c) must comply with Article 50 human-interaction and deepfake disclosures (applicable from 2 August 2026, with pre-2 August 2026 synthetic-content AI systems granted until 2 December 2026 under Article 111(4) for machine-readable Article 50(2) marking).Transparency disclosure · Applies to: Provider · Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) · Deadline 2 Dec 2026

Milestones

- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users UpcomingRegulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)

Claims and evidence (1)
- Gibraltar lacks standalone domestic deepfake-labelling legislation, but Gibraltar operators deploying chatbots or synthetic-content AI systems into the EU market are subject to EU AI Act Article 50 transparency duties from 2 August 2026 (with pre-2 August 2026 synthetic-content AI systems granted until 2 December 2026 under Article 111(4) of Regulation (EU) 2026/1744 for machine-readable marking).Confidence: Confirmed · EvidencedEvidence and sources[Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country
- [Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 1(39)(b), inserting Article 111(4)4. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content that have been placed on the market before 2 August 2026 shall comply with the obligations laid down in Article 50(2) by 2 December 2026.

### 06AI & Intellectual PropertyActive▾#

Intellectual Property (Copyright and Related Rights) Act 2005 (Act No. 2005-22) (In force since 2005-04-28): Primary Gibraltar copyright and database-right statute (commenced 28 April 2005; consolidated 13 August 2026).

1 instrument (1 current) · 0 obligations · 2 claims · 0 milestones

Gibraltar's Intellectual Property (Copyright and Related Rights) Act 2005 (Act No. 2005-22, consolidated 13 August 2026) contains no AI-specific commercial text-and-data-mining exception; reproduction of copyright works for AI training in Gibraltar is therefore governed by ordinary statutory subsistence and infringement rules under that Act rather than by any AI-tailored carve-out. Consistent with the jurisdiction's broader position, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework as at the research date; AI-related risk, including in the intellectual-property context, continues to be governed indirectly through existing company, financial-services and data-protection law rather than through a bespoke AI-and-IP regime.

Instruments (1)
- Intellectual Property (Copyright and Related Rights) Act 2005 (Act No. 2005-22) In force since 2005-04-28Primary Gibraltar copyright and database-right statute (commenced 28 April 2005; consolidated 13 August 2026). Contains no AI-specific text-and-data-mining (TDM) exception analogous to EU CDSM Directive Art 4, leaving unauthorised reproduction of protected works in Gibraltar AI training corpora subject to ordinary subsistence and infringement rules.Binding · [Official text](https://www.gibraltarlaws.gov.gi/legislations/intellectual-property-copyright-and-related-rights-act-2005-1025/download)

Claims and evidence (2)
- As at the research date, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework; AI-related risk is governed indirectly through existing company, financial-services and data-protection law.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Chambers and Partners](https://practiceguides.chambers.com/practice-guides/corporate-governance-2026/gibraltar) T3 · Retrieved · retrieved 4 Nov 2026Gibraltar does not currently have AI-specific legislation or a dedicated regulatory regime equivalent to the EU AI Act.
- [company.gi](https://company.gi/guide/ai/regulation) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence

- Gibraltar's Intellectual Property (Copyright and Related Rights) Act 2005 (Act No. 2005-22, consolidated 13 August 2026) contains no AI-specific commercial text-and-data-mining exception, meaning reproduction of copyright works for AI training in Gibraltar is governed by ordinary statutory subsistence, licensing and infringement rules.Confidence: Confirmed · EvidencedEvidence and sources[Intellectual Property (Copyright and Related Rights) Act 2005 (Act No. 2005-22, consolidated 13 August 2026)](https://www.gibraltarlaws.gov.gi/legislations/intellectual-property-copyright-and-related-rights-act-2005-1025/download) T1 · Retrieved · retrieved 12 Nov 2026 · Section 2(1)2.(1) Copyright is a property right which subsists in accordance with this Part in the following descriptions of work– (a) original literary, dramatic, musical or artistic works; (b) sound recordings, films or broadcasts; and (c) the typographical arrangement of published editions.

### 07Sectoral & Public-Sector AIActive▾#

Financial Services Act 2019 (Act No. 2019-26) (In force since 2020-01-15): Primary financial-services and DLT regulatory statute in Gibraltar (commenced 15 January 2020), empowering the GFSC to authorise and supervise banks, e-money/payment institutions, insurers, investment firms and DLT providers deploying algorithmic, model-driven or AI systems under technology-neutral governance, outsourcing and operational-resilience rules.

3 instruments (3 current) · 1 obligation · 4 claims · 1 milestone

In force: the Gambling Act 2025 (Act No. 2026-04), assented 23 March 2026 and commenced 1 April 2026 via LN.2026/064 (save for sections 55-77), repealed the Gambling Act 2005 and governs B2C and B2B remote-gambling licensees in Gibraltar under the supervision of the Gambling Commissioner, framing internal-control and player-protection requirements applicable to licensee use of automated systems. The Financial Services Act 2019 (Act No. 2019-26) remains the governing statute for financial-services licensing against which AI-enabled tools are assessed, though it imposes no AI-specific duty of its own.

Regulatory expectations: GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes, Chapter 5 paragraph 5.17, require regulated financial-services and DLT firms using automated or AI-driven remote onboarding and biometric-verification tools to evaluate error rates and spoofing/deepfake risks, retain full customer-due-diligence accountability, and maintain human escalation routes. Separately, Article 22 of the Gibraltar GDPR restricts solely automated individual decisions carrying legal or similarly significant effects across sectors, subject to limited lawful bases and safeguards, as explained in Gibraltar Regulatory Authority Guidance Note 23.

Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework as at the research date; sectoral AI risk continues to be governed indirectly through gambling, financial-services and data-protection law.

Read full sub-brief · 203 words

Instruments (3)
- Financial Services Act 2019 (Act No. 2019-26) In force since 2020-01-15Primary financial-services and DLT regulatory statute in Gibraltar (commenced 15 January 2020), empowering the GFSC to authorise and supervise banks, e-money/payment institutions, insurers, investment firms and DLT providers deploying algorithmic, model-driven or AI systems under technology-neutral governance, outsourcing and operational-resilience rules.Binding · Authority: Gibraltar Financial Services Commission · [Official text](https://www.gibraltarlaws.gov.gi/legislations/financial-services-act-2019-4690/download)
- Gambling Act 2025 (Act No. 2026-04) In force since 2026-04-01Assented on 23 March 2026 and commenced on 1 April 2026 via LN.2026/064 (all provisions except ss.55-77; amended by Gambling (Amendment) Act 2026, Act No. 2026-12), repealing and replacing the Gambling Act 2005 (s.178). Governs B2C and B2B remote gambling operators in Gibraltar — one of the territory's largest regulated sectors deploying algorithmic player-protection, responsible-gambling behavioural scoring, game-integrity and AML tools.Binding · Authority: Gibraltar Gambling Commissioner (Licensing & Regulatory Authority under the Gambling Act 2025) · [Official text](https://www.gibraltarlaws.gov.gi/legislations/gambling-act-2025-8374/download)
- GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence) Published 2026-01-01Sectoral supervisory guidance issued by the GFSC; Chapter 5 (§5.17) sets explicit governance, spoofing/deepfake vulnerability testing, and human-escalation controls where regulated financial and DLT firms deploy AI or automated remote-onboarding and biometric verification tools.Regulatory expectation · Authority: Gibraltar Financial Services Commission · [Official text](https://fsc.gi/uploads/AML%20Guidance%20Notes/5%20-%20Customer%20Due%20Diligence.pdf)

Obligations

- GFSC AML/CFT/CPF Guidance Notes, Chapter 5, paragraph 5.17GFSC-supervised financial-services and DLT firms deploying automated or AI-driven remote onboarding, facial recognition or biometric verification tools remain fully accountable for customer due diligence compliance and must assess algorithmic error rates, spoofing/deepfake risks, and maintain human review and escalation controls.Risk management · Applies to: Deployer · GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence)

Milestones

- 1 Apr 2026Gambling Act 2025 (Act No. 2026-04) commenced via LN.2026/064 (repealing Gambling Act 2005) MetGambling Act 2025 (Act No. 2026-04)

Claims and evidence (4)
- As at the research date, Gibraltar has no AI-specific legislation, dedicated AI regulator or published AI regulatory framework; AI-related risk is governed indirectly through existing company, financial-services and data-protection law.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Chambers and Partners](https://practiceguides.chambers.com/practice-guides/corporate-governance-2026/gibraltar) T3 · Retrieved · retrieved 4 Nov 2026Gibraltar does not currently have AI-specific legislation or a dedicated regulatory regime equivalent to the EU AI Act.
- [company.gi](https://company.gi/guide/ai/regulation) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence

- Article 22 of the Gibraltar GDPR restricts solely automated individual decisions with legal or similarly significant effects, subject to limited lawful bases and safeguards, per GRA Guidance Note 23.Confidence: Probable · EvidencedEvidence and sources[Gibraltar Regulatory Authority](https://www.gra.gi/uploads/documents/data-protection/Documents/Guidance/GDPR23.pdf) T1 · Retrieved · retrieved 4 Nov 2026Article 22 of the Gibraltar GDPR restricts organisations from making solely automated

- GFSC AML/CFT/CPF Guidance Notes Chapter 5 (§5.17) requires regulated financial-services and DLT firms in Gibraltar using automated or AI-driven remote onboarding and biometric verification tools to evaluate error rates and spoofing/deepfake risks, retain full CDD accountability, and maintain human escalation controls.Confidence: Confirmed · EvidencedEvidence and sources[GFSC Anti-Money Laundering, Counter-Financing of Terrorism and Counter-Proliferation Financing Guidance Notes — Chapter 5 (Customer Due Diligence)](https://fsc.gi/uploads/AML%20Guidance%20Notes/5%20-%20Customer%20Due%20Diligence.pdf) T1 · Retrieved · retrieved 12 Nov 2026 · Chapter 5, paragraph 5.175.17 Artificial Intelligence .................................................................................................................. 340 Gibraltar Financial Services Commission AML/CFT/CPF Guidance Notes 3 5.1 Knowing Your Customer AML /CFT/CPF Requirements R12 A regulated entity must take appropriate measures to identify and verify the subject of a business relationship or occasional transaction. The application of these measures must be in line wi

- The Gambling Act 2025 (Act No. 2026-04, assented 23 March 2026 and commenced 1 April 2026 via LN.2026/064 save for ss.55-77) repealed the Gambling Act 2005 and governs B2C and B2B remote gambling licensees in Gibraltar under the supervision of the Gambling Commissioner, framing internal-control, player-protection and AML duties where operators deploy algorithmic behavioural monitoring and scoring systems.Confidence: Confirmed · EvidencedEvidence and sources[Gambling Act 2025 (Act No. 2026-04, commenced 1 April 2026 via LN.2026/064, repealing Gambling Act 2005)](https://www.gibraltarlaws.gov.gi/legislations/gambling-act-2025-8374/download) T1 · Retrieved · retrieved 12 Nov 2026 · Long title, section 1 and section 178AN ACT TO REPEAL THE GAMBLING ACT 2005 AND TO MAKE NEW PROVISION FOR THE LICENSING, REGULATION AND SUPERVISION OF GAMBLING, AND FOR CONNECTED PURPOSES.

### 08Safety & Incident ReportingActive▾#

Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) (In force since 2024-08-01): Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).

1 instrument (1 current) · 1 obligation · 1 claim · 0 milestones

Gibraltar has enacted no domestic AI-safety or incident-reporting statute. Where a Gibraltar-incorporated provider places a general-purpose AI model on the Union market, it must comply with Chapter V (Articles 53-55) of Regulation (EU) 2024/1689 (EU AI Act), including technical-documentation, training-data-summary, copyright/text-and-data-mining-policy and EU-authorised-representative duties attaching to such model-level obligations under Article 2(1)(a). No separate Gibraltar incident-reporting channel or dedicated safety authority is recorded; the extraterritorial Chapter V regime is, at present, the only documented safety-adjacent obligation reaching Gibraltar-based general-purpose-AI providers.

Instruments (1)
- Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act) In force since 2024-08-01Does not apply domestically to services in Gibraltar, but binds Gibraltar financial, DLT, e-money and online-gambling operators extraterritorially under Article 2(1)(a) when placing AI systems or GPAI models on the EU market and under Article 2(1)(c) when AI system output is used in the Union (and intersects physical goods placed on the Gibraltar market via UK-EU Gibraltar Agreement Articles 256 & 268).Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)

Obligations

- Articles 53-55 read with Article 2(1)(a)Gibraltar entities placing general-purpose AI models on the Union market must comply with Chapter V (Articles 53-55) technical documentation, copyright/TDM policy, training-data summary, EU authorised-representative (Art 54), and (where systemic-risk thresholds apply) adversarial evaluation and AI Office incident-reporting obligations.Documentation · Applies to: Provider · Regulation (EU) 2024/1689 of 13 June 2024 (EU Artificial Intelligence Act)

Claims and evidence (1)
- Gibraltar has enacted no domestic foundation-model statute, but any Gibraltar-incorporated provider placing a general-purpose AI model on the Union market must comply with Chapter V (Articles 53-55) of Regulation (EU) 2024/1689, including technical documentation, EU authorised-representative appointment (Art 54), copyright compliance and systemic-risk incident reporting to the AI Office.Confidence: Confirmed · EvidencedEvidence and sources[Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Article 2(1)(a) and (c)providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country

### 09Standards & ConformityActive▾#

UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562) (In force since 2026-07-15): Signed on 14 July 2026 and provisionally applied from 15 July 2026 pending European Parliament consent.

1 instrument (1 current) · 1 obligation · 1 claim · 2 milestones · Next: 14 Dec 2026 (Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement)

Gibraltar's standards and conformity position for goods, including AI-enabled hardware, is governed by the UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562), signed 14 July 2026 and provisionally applied from 15 July 2026. Under Part Three, Title I, Articles 256 and 268 (subject to Article 256(4)-(6) derogations), Gibraltar must maintain and effectively apply legislation ensuring that physical goods placed on the Gibraltar market comply with relevant Union law governing the production or placing on the market of goods, excluding UK-authorised categories carved out by the derogation. Formal conclusion of the Agreement remains subject to the European Parliament consent procedure, targeted for a window closing 14 December 2026, distinct from the provisional application already binding since 15 July 2026. No separate Gibraltar AI-specific standards body, harmonised standard or conformity-assessment scheme is recorded.

Instruments (1)
- UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562) In force since 2026-07-15Signed on 14 July 2026 and provisionally applied from 15 July 2026 pending European Parliament consent. While financial, gambling and digital services remain outside the EU single market, Part Three Title I (Articles 256 & 268) requires Gibraltar to maintain and apply legislation ensuring that physical goods produced or placed on the Gibraltar market comply with relevant Union goods law (creating a dynamic goods-alignment bridge relevant to Annex I AI safety components in physical products, subject to the Article 256(4)-(6) derogation for UK-authorised human medicines and medical devices labelled 'UK only').Binding · [Official text](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng)

Obligations

- Part Three, Title I, Articles 256 & 268 (subject to Article 256(4)-(6) derogation)From 15 July 2026 (provisional application), goods produced or placed on the market in Gibraltar must comply with relevant Union law governing the production or placing on the market of goods (excluding UK-authorised human medicinal products and related medical devices labelled 'UK only' under Article 256(4)-(6)), creating a dynamic goods-compliance bridge for physical products with AI safety components as Union product harmonisation dates take effect.Conformity assessment · Applies to: Product manufacturer · UK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Milestones

- 15 Jul 2026UK–EU Gibraltar Agreement signed (14 July 2026) and provisionally applied (15 July 2026), aligning Gibraltar goods market rules under Arts 256 & 268 MetUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)
- 14 Dec 2026 (Month)Target window for European Parliament consent procedure on formal conclusion of the UK–EU Gibraltar Agreement UpcomingUK–EU Agreement in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)

Claims and evidence (1)
- Under Part Three, Title I (Articles 256 & 268) of the UK–EU Agreement in respect of Gibraltar (signed 14 July 2026, provisionally applied from 15 July 2026), Gibraltar must maintain and effectively apply legislation ensuring physical goods placed on the Gibraltar market comply with Union goods law — creating a goods-alignment bridge for physical products containing AI safety components while carving out UK-authorised human medicines and medical devices labelled 'UK only' under Article 256(4)-(6) and leaving services outside the EU single market.Confidence: Confirmed · EvidencedEvidence and sources[Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(1)-(3)Article 256 General requirements 1. The United Kingdom, in respect of Gibraltar, shall have in place and effectively apply legislation ensuring that goods may be produced or placed on the market in Gibraltar only if they comply with the relevant rules of Union law governing the production or placing on the market of those goods.
- [Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, in respect of Gibraltar (OJ L 2026/1562, CELEX:22026A01562)](https://eur-lex.europa.eu/eli/agree_internation/2026/1562/oj/eng) T1 · Retrieved · retrieved 12 Nov 2026 · Part Three, Title I, Article 256(4)-(6)4. Notwithstanding paragraph 1 of this Article, the United Kingdom, in respect of Gibraltar, may allow medicinal products for human use as defined in point 2 of Article 1 of Directive 2001/83/EC of the European Parliament and of the Council ( 29 ) to be placed on the market in Gibraltar

### 10Authorities & EnforcementActive▾#

Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) (In force since 2006-04-01): Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026).

3 instruments (3 current) · 0 obligations · 2 claims · 1 milestone

Gibraltar's AI-adjacent supervisory landscape runs through existing sectoral authorities rather than a dedicated AI regulator. The Gibraltar Regulatory Authority supervises data-protection compliance, the Gibraltar Financial Services Commission supervises financial-services and DLT firms, and the Gibraltar Gambling Commissioner supervises remote-gambling licensees under statutory authority; HM Government of Gibraltar's Ministry for Justice, Trade and Industry holds non-statutory executive responsibility for policy. The Gambling Act 2025 (Act No. 2026-04), assented 23 March 2026 and commenced 1 April 2026 via LN.2026/064 (save for sections 55-77), repealed the Gambling Act 2005 and placed B2C and B2B remote-gambling licensees under the Gambling Commissioner's supervision.

An AI regulatory taskforce was announced for Gibraltar but had not been formally launched as of February 2026; no dedicated AI enforcement authority or AI-specific enforcement action is recorded against this standing institutional structure.

Instruments (3)
- Data Protection Act 2004 (Act No. 2004-01, consolidated 15 July 2026) In force since 2006-04-01Autonomous Gibraltar primary data-protection statute (commenced 2006; modernised for the Gibraltar GDPR from 2018/2021 and amended 15 July 2026). Section 17 applies exclusively to qualifying significant solely automated decisions required or authorised by Gibraltar law under Gibraltar GDPR Article 22(2)(b), requiring written notice as soon as reasonably practicable and giving data subjects a 1-month right to request reconsideration or a new decision not based solely on automated processing.Binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/download)
- Financial Services Act 2019 (Act No. 2019-26) In force since 2020-01-15Primary financial-services and DLT regulatory statute in Gibraltar (commenced 15 January 2020), empowering the GFSC to authorise and supervise banks, e-money/payment institutions, insurers, investment firms and DLT providers deploying algorithmic, model-driven or AI systems under technology-neutral governance, outsourcing and operational-resilience rules.Binding · Authority: Gibraltar Financial Services Commission · [Official text](https://www.gibraltarlaws.gov.gi/legislations/financial-services-act-2019-4690/download)
- Gambling Act 2025 (Act No. 2026-04) In force since 2026-04-01Assented on 23 March 2026 and commenced on 1 April 2026 via LN.2026/064 (all provisions except ss.55-77; amended by Gambling (Amendment) Act 2026, Act No. 2026-12), repealing and replacing the Gambling Act 2005 (s.178). Governs B2C and B2B remote gambling operators in Gibraltar — one of the territory's largest regulated sectors deploying algorithmic player-protection, responsible-gambling behavioural scoring, game-integrity and AML tools.Binding · Authority: Gibraltar Gambling Commissioner (Licensing & Regulatory Authority under the Gambling Act 2025) · [Official text](https://www.gibraltarlaws.gov.gi/legislations/gambling-act-2025-8374/download)

Milestones

- 1 Apr 2026Gambling Act 2025 (Act No. 2026-04) commenced via LN.2026/064 (repealing Gambling Act 2005) MetGambling Act 2025 (Act No. 2026-04)

Claims and evidence (2)
- An AI regulatory taskforce was announced for Gibraltar but has not been formally launched as of February 2026.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[company.gi](https://company.gi/guide/ai/regulation) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, there is no Gibraltar AI Act, no formal AI strategy document, and no published regulatory framework for artificial intelligence

- The Gambling Act 2025 (Act No. 2026-04, assented 23 March 2026 and commenced 1 April 2026 via LN.2026/064 save for ss.55-77) repealed the Gambling Act 2005 and governs B2C and B2B remote gambling licensees in Gibraltar under the supervision of the Gambling Commissioner, framing internal-control, player-protection and AML duties where operators deploy algorithmic behavioural monitoring and scoring systems.Confidence: Confirmed · EvidencedEvidence and sources[Gambling Act 2025 (Act No. 2026-04, commenced 1 April 2026 via LN.2026/064, repealing Gambling Act 2005)](https://www.gibraltarlaws.gov.gi/legislations/gambling-act-2025-8374/download) T1 · Retrieved · retrieved 12 Nov 2026 · Long title, section 1 and section 178AN ACT TO REPEAL THE GAMBLING ACT 2005 AND TO MAKE NEW PROVISION FOR THE LICENSING, REGULATION AND SUPERVISION OF GAMBLING, AND FOR CONNECTED PURPOSES.

### 11Sandboxes & Transitional ReliefActive▾#

GRA Regulatory Sandbox Guidance Note (23 June 2026) (Published 2026-06-23): Framework governing the Gibraltar Regulatory Authority's cross-sector Regulatory Sandbox (beta launched 23 June 2026), enabling organisations developing AI and data-driven products to test data-protection compliance in a supervised environment and receive a formal exit report (without statutory safe-harbour immunity).

2 instruments (2 current) · 0 obligations · 2 claims · 2 milestones · Next: 2 Dec 2026 (EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users)

The Gibraltar Regulatory Authority launched the beta phase of its cross-sector Regulatory Sandbox on 23 June 2026, under its Regulatory Sandbox Guidance Note of that date. Participation is voluntary rather than a statutory relief scheme. On completion, Sandbox participants receive an exit report summarising their engagement and whether the Gibraltar Regulatory Authority identified indications of non-compliance with data-protection law. Separately, Regulation (EU) 2026/1744's Article 111(4) grace period for pre-2 August 2026 synthetic-content AI systems serving EU users runs to 2 December 2026, operating as an EU-level transitional provision rather than a Gibraltar sandbox mechanism.

Instruments (2)
- GRA Regulatory Sandbox Guidance Note (23 June 2026) Published 2026-06-23Framework governing the Gibraltar Regulatory Authority's cross-sector Regulatory Sandbox (beta launched 23 June 2026), enabling organisations developing AI and data-driven products to test data-protection compliance in a supervised environment and receive a formal exit report (without statutory safe-harbour immunity).Non-binding · Authority: Gibraltar Regulatory Authority · [Official text](https://www.gra.gi/uploads/documents/data-protection/Sandbox/26%2006%2023%20Regulatory%20Sandbox%20Guidance%20Note.pdf)
- Regulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI) In force since 2026-07-27Amends Regulation (EU) 2024/1689 from 27 July 2026, deferring Annex III high-risk obligations to 2 December 2027 and Annex I product high-risk obligations to 2 August 2028, adding Article 5(1)(ba)-(bb) intimate/CSAM prohibitions, and granting pre-2 August 2026 synthetic-content AI systems until 2 December 2026 for Article 50(2) marking compliance.Conditionally binding · [Official text](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng)

Milestones

- 23 Jun 2026GRA cross-sector Regulatory Sandbox beta phase launched MetGRA Regulatory Sandbox Guidance Note (23 June 2026)
- 2 Dec 2026EU AI Act Article 111(4) transitional deadline for pre-2 August 2026 synthetic-content AI systems serving EU users UpcomingRegulation (EU) 2026/1744 of 16 July 2026 (Digital Omnibus on AI)

Claims and evidence (2)
- The GRA launched the beta phase of its cross-sector Regulatory Sandbox on 23 June 2026.Confidence: Probable · As of 23 Jun 2026 · EvidencedEvidence and sources[Gibraltar Regulatory Authority](https://www.gra.gi/data-protection/regulatory-sandbox) T1 · Retrieved · retrieved 4 Nov 2026The Sandbox offers organisations a controlled environment to test innovative products, services, or data uses, while receiving regulatory guidance to ensure compliance with Gibraltar's privacy and data protection laws before full-scale deployment.

- GRA Sandbox participants receive an exit report at completion, summarising their engagement and whether GRA identified indications of non-compliance with data protection law.Confidence: Probable · EvidencedEvidence and sources[Your Gibraltar TV](https://www.yourgibraltartv.com/daily/gra-launch-regulatory-sandbox) T2 · Retrieved · retrieved 10 Nov 2026At the conclusion of the Sandbox process, participants will receive an “exit report” summarising their engagement, key data protection considerations and generalisable insights.

### 12Commercial ActivityActive▾#

Gibraltar's AI commercial activity is tracked at 17 documented use cases as of February 2026, alongside a GBP 1.8bn data-centre investment announcement.

0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones

Pelagos Data Centres announced a GBP 1.8bn, 250MW AI/cloud data-centre project for Gibraltar in September 2025. Separately, and with lower confidence, Gibraltar's AI commercial activity is reported at 17 documented use cases as of February 2026, alongside the data-centre investment announcement; this use-case figure rests on weaker sourcing than the investment announcement itself and should be read accordingly.

Claims and evidence (2)
- Gibraltar's AI commercial activity is tracked at 17 documented use cases as of February 2026, alongside a GBP 1.8bn data-centre investment announcement.Confidence: Uncertain (capped: best source is T3) · EvidencedEvidence and sources[company.gi](https://company.gi/guide/ai) T3 · Retrieved · retrieved 4 Nov 2026As of February 2026, I've tracked 17 companies and projects with real, documented AI use cases in Gibraltar.

- Pelagos Data Centres announced a GBP 1.8bn, 250MW AI/cloud data-centre project for Gibraltar in September 2025.Confidence: Probable · As of 10 Sep 2025 · EvidencedEvidence and sources[DataCentreNews UK](https://datacentrenews.uk/story/pelagos-reveals-gbp-1-8-billion-ai-data-centre-plan-for-gibraltar) T2 · Retrieved · retrieved 4 Nov 2026Pelagos Data Centres has announced plans to develop a 250MW data centre in Gibraltar, a project expected to attract investment of approximately GBP £1.8 billion.

No modules match. Filters combine as OR inside a group and AND across groups.

Reset all filters

## Authorities

Authority Type

[Gibraltar Regulatory Authority](https://www.gra.gi) Data protection authority

[Gibraltar Financial Services Commission](https://www.fsc.gi) Regulator

[HM Government of Gibraltar (Ministry for Justice, Trade and Industry)](https://www.gibraltar.gov.gi) Ministry

[Gibraltar Gambling Commissioner (Licensing & Regulatory Authority under the Gambling Act 2025)](https://www.gibraltar.gov.gi/finance-gaming-and-regulations/remote-gambling) Regulator

## Enforcement actions

No enforcement actions recorded in this research.

## Cases

No cases recorded in this research.

## Consultations

No consultations recorded in this research.

What this record does not yet establish is set out on the [transparency register](/gaps/#gap-gi); its dated events are on the [regulatory calendar](/calendar/?jid=GI).

Think something on this page is wrong? [Report an error](/legal/#contact).

Technical provenance (record schema, run ID & build metadata) Schema version artificial-intelligence-record-v2.12 Research run ID aic-union-GI-2026-11-04 Page model module-card-page-v1 Renderer render_jid_aic_v13 Build date 12 Nov 2026