Artificial Intelligence · Gibraltar
AI regulation in Gibraltar: laws & policy (2026)
Gibraltar shaded by its artificial intelligence status
AI in Gibraltar: guidelines only.
FrameworkNo dedicated AI legislation; a principles-based, patchwork approach anchored by the Gibraltar Financial Services Commission (GFSC) 'Policy Statement on the Use of Artificial Intelligence' (29 January 2026), existing Gibraltar GDPR / Data Protection Act 2004 (enforced by the Gibraltar Regulatory Authority / Information Commissioner), and a proposed AI regulatory taskforce announced by HM Government of Gibraltar (Ministry of Justice, Trade and Industry).
As of September 2026, Gibraltar has no comprehensive AI Act and no formal, published national AI strategy. Regulation of AI runs through existing horizontal laws — most importantly the Gibraltar GDPR and Data Protection Act 2004 — plus principles-based sectoral guidance from the GFSC, and ministerial commitments to build a DLT-style, principles-based framework via an as-yet-unformed AI taskforce.
Key points
Gibraltar has not enacted a standalone AI law. The use of AI is assessed through existing legal frameworks (data protection, financial-services regulation, consumer and IP law) rather than an AI Act; law firms and the government both characterise the position as principles-based rather than codified.
On 29 January 2026 the Gibraltar Financial Services Commission issued its first formal Policy Statement on the Use of Artificial Intelligence, setting a permissive, principles-based expectation for GFSC-regulated firms deploying AI, aligned with existing conduct, governance and technology-risk obligations.
The Gibraltar GDPR and the Data Protection Act 2004, enforced by the Gibraltar Regulatory Authority as Information Commissioner, impose obligations directly relevant to AI (lawful basis, DPIAs, automated decision-making, penalties up to £17.5m or 4% of global turnover). Following the July 2025 UK–EU treaty on Gibraltar, the Data Protection Regulations 2026 re-aligned the Gibraltar GDPR with the EU GDPR.
On 21 January 2026 the Ministry of Justice, Trade and Industry, together with Numero Partners and Hyper Island, hosted the invitation-only AI Futures & Foresight Conference. Minister Nigel Feetham reaffirmed Gibraltar's ambition to 'take a responsible lead' in AI adoption via innovation, skills and 'smart regulation', building on months of Ministry work.
At Gibraltar Day in London 2025 the Government announced it would establish an AI taskforce of regulatory experts to design a framework, mirroring the approach that produced the 2018 DLT Regulatory Framework. As of early-to-mid 2026, the taskforce has been announced but not formally launched, and no draft AI bill has been published.
Gibraltar is outside the EU and the EU AI Act does not apply domestically, but Gibraltar-based providers, deployers, importers or distributors whose AI systems' output is used in the EU can fall within the Act's extraterritorial scope — a compliance issue flagged by local practitioners as more immediately relevant than any domestic AI law.
Since 2025 HM Government of Gibraltar has stood up multiple internal AI systems (e.g. a Tax Office chatbot supporting Llanito, a Central Arrears Unit database, a treaty chatbot, AI-assisted customs risk management, and analytics tooling used with the GFSC), demonstrating an 'adopt-then-regulate' posture consistent with the proposed principles-based framework.
Timeline - major decisions & events
HM Government of Gibraltar and Numero Partners convened C-suite leaders from finance, gaming, insurance, DLT, telecoms and law; Minister Feetham framed the goal as taking a responsible lead in AI adoption and concluded the issue is an 'alignment opportunity' between government, regulators and industry. Signals the current policy direction ahead of any AI-specific legislation.
HM Government of Gibraltar ↗The Ministry of Justice, Trade and Industry announced the invitation-only AI Futures & Foresight Conference as part of a programme on innovation, skills and 'smart regulation' to broaden Gibraltar's economic base. Marked AI moving onto the formal government agenda.
HM Government of Gibraltar ↗Chief Minister Fabian Picardo indicated the government would consult widely on whether and how to regulate AI, citing broad implications for the delivery of public services. This is the origin point of Gibraltar's deliberation over a dedicated AI regime, which as of 2026 has not yet produced legislation.
Gibraltar Chronicle ↗Gibraltar introduced regulations setting market-integrity standards for DLT/virtual-asset firms (press release 299/2022), targeting market manipulation and abuse. Reinforced the principles-based DLT regime within which AI-driven trading and analytics tools must operate.
HM Government of Gibraltar ↗Government, GFSC and industry formed a working group to operationalise the new market-integrity principle for DLT providers. Established the supervisory expectations around fair trading, surveillance and disclosure that constrain automated/AI trading systems.
HM Government of Gibraltar ↗On leaving the EU transition period, Gibraltar adopted the 'Gibraltar GDPR' alongside the Data Protection Act 2004, with the Gibraltar Regulatory Authority as Information Commissioner. It carries the right not to be subject to solely automated decisions/profiling, currently the most concrete legal control on AI affecting individuals.
Gibraltar Regulatory Authority ↗Following consultation with the GFSC, GANT and licensees, Gibraltar updated the DLT Providers Regulations to add a tenth regulatory principle requiring firms to maintain market integrity (press release 631/2020). Extended the outcomes-based regime that governs technology-driven financial firms.
HM Government of Gibraltar ↗Gibraltar's principles-based Distributed Ledger Technology framework, billed as the world's first purpose-built blockchain regulatory regime, took effect, requiring DLT firms to be licensed by the GFSC. Its outcomes-focused, technology-neutral principles are the regime within which AI tools in financial services are currently supervised, absent a dedicated AI law.
Gibraltar Financial Services Commission ↗Gibraltar's foundational data-protection statute established the legal architecture for processing personal data 'by automated means or not' and the supervisory authority later designated as the Gibraltar Regulatory Authority. It underpins all subsequent automated-processing and profiling controls relevant to AI.
Gibraltar Regulatory Authority ↗Gibraltar - other topics
Artificial Intelligence in other countries
Last verified 9/15/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →