Regulators Are Asking What Your CRM's AI Is Built to Maximize

On September 24, the Massachusetts Gaming Commission said it would review how every licensed sportsbook in the state uses artificial intelligence and machine learning, starting with DraftKings. Five days later, Michigan's regulator said it was looking into the same issues. Both moves followed a New York Times investigation, published September 19, into how DraftKings used machine learning to target promotions.

The reporting is about one US sportsbook. The questions behind it apply to any operator, and any CRM vendor, that uses models to decide who gets a bonus, a VIP invite, or a mission: what is the model built to maximize, which signals does it read, and who checks its output before it reaches a player? Those are fair questions, and they're harder to answer than they sound.

What the reports said, and how DraftKings responded

According to the Times, DraftKings used machine learning to identify customers who were likely to keep betting, and losing, after receiving promotional offers. CDC Gaming reports that the investigation drew on interviews with about 40 former employees, internal research memos, Slack messages, and customers' betting records.

A separate ProPublica investigation looked at the operator's VIP program. Its reporter deliberately bet like a problem gambler for 10 weeks and was then invited into the program, as Legal Sports Report summarized.

DraftKings rejected the reporting. The company said it doesn't use AI to target anyone based on losses and doesn't market to customers based on signs of potential problem gambling. The Massachusetts commission has said it has not found any wrongdoing and that the review is meant to gather information.

The operator matters a great deal to the Massachusetts market. DraftKings took about $275 million of the roughly $566 million wagered with the state's seven online sportsbooks in August, according to commission figures cited by FairGambling.

Massachusetts already had a rule for this

The review doesn't start from zero. A Massachusetts regulation, 205 CMR 257.02, limits how sports wagering operators can use patron data to promote wagers or offers. It bars doing so through any algorithm, machine learning, or AI system that the operator, or a vendor to the operator, knows or should reasonably expect will make the platform more addictive. The same rule requires operators to analyze player data for their responsible gaming programs and report trends to the commission at least every six months.

Commissioner Paul Brodeur said Massachusetts is one of the only states, possibly the only one, to reference AI in its gambling regulations, per Legal Sports Report. The commission also funded a study of AI in gaming by the UNLV International Gaming Institute, released in November 2025, and set up the AI task force that study recommended. That task force will now look at DraftKings' practices.

Michigan is in a different position. Its laws and rules require self-exclusion, player-set deposit and wagering limits, and responsible gaming information, but they don't mention AI or machine learning. The Michigan Gaming Control Board said it is reviewing the issues raised in both reports and wouldn't say whether any specific operator is under review.

Two details in the Massachusetts wording matter for anyone building CRM. The standard covers what you know or should reasonably expect a system to do, so "we didn't test for that" is a weak defense. And it names vendors, so a supplier can't treat model behavior as purely its client's problem.

Why this lands on the CRM team

Most promotional models are trained to maximize something commercial: deposits, turnover, net gaming revenue, or the chance a player comes back next week. The difficulty is that strong predictors of short-term value overlap with early signs of harm. Frequent deposits, longer sessions, quick reloads after a loss, and raised limits can all read as "high-value player" to a model that only sees revenue.

Take two players who each deposited four times this week. One is a weekend regular who tops up on payday. The other reloaded three times in an hour after losing. A model built to maximize turnover may rank both as strong candidates for a reload bonus. A protection rule should see one player to reward and one to step back from.

So the objective matters more than the algorithm. A simple model with the wrong goal can do more damage than a sophisticated one with clear limits around it.

The direction outside the US is the same

Massachusetts is the sharpest example right now, but regulators elsewhere are moving the same way.

In the EU, the AI Act's ban on AI systems that use manipulative techniques or exploit people's vulnerabilities in ways that cause significant harm has applied since February 2025. Transparency duties under Article 50 started on August 2, 2026. The Digital Omnibus, in force since July 27, pushed the Act's high-risk obligations back to December 2, 2027, as Freshfields explains. Gambling marketing isn't one of the Act's named high-risk categories, though, so that delay changes little for CRM teams. Whether a specific promotional model falls under the prohibition is a legal question, and it's better to ask your counsel now than to hear it first from a regulator.

In Great Britain, the Gambling Commission went after incentive design directly. Since January 19, 2026, wagering requirements are capped at 10 times the bonus, and a single promotion can no longer mix products such as betting and casino.

Brazil shows how far the argument can go. Bill PL 1018/2026, filed in the Senate in March, would ban loyalty programs, cashback, missions, rankings, and personalized messages based on a player's betting history. It hasn't moved since it was filed and may never pass, but it's a clear picture of what lawmakers reach for when they decide the industry won't draw the line itself.

Six things to be able to show about any model that touches promotions

None of this means dropping AI. FanDuel, for one, has said it uses machine learning to spot signs of harmful play. It does mean being able to show your work. These six points are a practical place to start.

1. A written objective, including what the model may never optimize

Every model should have a short statement of what it maximizes and what it isn't allowed to maximize. "Increase 30-day retention among players with no risk markers" is defensible. "Increase expected net revenue per player," with no exclusions, is the kind of objective that ends up quoted in a news story. If nobody on the team can say what a model optimizes, that's the first finding of any review.

2. Inputs you can defend

List the features each commercial model reads. Signals that mostly measure distress, such as rapid reloads after losses, reversed withdrawals, or limit increases, belong in protection models. Feeding them into a model that picks bonus recipients is how a system learns to find the players who struggle to stop.

3. Protection rules that outrank every score

Responsible gaming flags should override model output, and they should be checked when a message or reward is about to go out, as well as when the segment is built. A player who self-excluded this morning shouldn't get a mission invite based on last night's segment. In practice that means one suppression layer that every channel and every game mechanic respects, including email, push, popups, missions, tournaments, and VIP outreach. We cover how this fits into day-to-day retention work in safer gambling at the CRM layer.

4. A reason attached to every decision

If a regulator picks one player and asks why they received a specific offer on a specific day, you should be able to answer from the system, without a data scientist rebuilding the logic after the fact. Models that return each recommendation with its reasons make that possible. A bare score with no explanation makes it very hard.

5. Proof of incrementality, with harm metrics next to revenue

Control groups show whether a campaign changed behavior or paid players to do what they would have done anyway. They can also show whether it changed things you'd rather not see. Put self-exclusions, limit changes, complaints, and opt-outs in the same report as uplift, so a campaign that wins on revenue but raises harm markers doesn't get scaled by default. Our rules for A/B testing in iGaming cover the setup.

6. Human sign-off where the stakes are highest

Automated decisions are fine for a free-spin nudge. VIP invitations, large bonuses, and changes to model logic deserve a named person who approves them and a record of that approval. Ask every vendor for documentation on what each model does and which data it reads, and keep it on file with the validation results. Under a rule like the one in Massachusetts, "our vendor built it" won't satisfy anyone.

VIP programs are where this gets tested first

The ProPublica story landed on VIP for a reason. VIP selection is where a model's output turns into the most personal and most generous treatment an operator offers: a dedicated account manager, bigger bonuses, gifts. If the selection logic rewards intensity of play without checking affordability and risk markers, the program will eventually invite the wrong person. Our guide to VIP player management goes deeper on program design.

Gamification carries the same exposure at a smaller scale. Levels and streaks reward continued activity by design, and so do most missions. They can also have brakes built in: caps on how much a mission can ask a player to stake, cooling-off periods after a limit is hit, and rewards for variety or skill instead of for losses. We've written about the ethics of gamification if you want the longer version.

The Smartico angle

Smartico is a CRM and gamification vendor, so this conversation is about us as much as our clients. The operator owns its responsible gaming policy. Our job is to make that policy enforceable everywhere a player can be reached, and to keep our own models explainable.

CRM automation and gamification run in one engine at Smartico, covering segments, journeys, missions, tournaments, and rewards. A suppression condition built on a responsible gaming flag from your platform applies to campaigns and game mechanics alike, so you don't end up maintaining separate rules in separate tools that slowly drift apart.

Our AI models are calibrated against each brand's own players. Bonus Eligibility, for example, scores active players daily and recommends Eligible or Suppress, with the reasons shown next to each recommendation. Its stated goal is fewer and smaller bonuses while play holds steady.

Campaigns can also run with control groups, so you can show which offers changed behavior and which ones only cost money.

If your team is reviewing how its CRM uses AI, we're happy to walk through these controls on your own data. Book a demo, or if you're at SiGMA World in Rome from November 2 to 5, find us at stand H4-4036. You can book a time at the stand in advance.

Did you find this article helpful? If so, consider sharing it with other industry professionals such as yourself.