NIGC Convenes in Milwaukee as Regulators Weigh Online Gaming and Cyber Risk

The National Indian Gaming Commission gathered tribal regulators, compliance officers, and industry advisers in Milwaukee this week for its 2026 National Training Conference, hosted at the Potawatomi Hotel & Casino. The annual event is less a policymaking forum than a working classroom, but the sessions on the agenda offered a useful reading of where the federal regulator of tribal gaming is focusing its attention: the migration of gaming online, the growing threat of cyberattacks, and a broader push to modernize how the commission oversees a record-setting industry.

Those priorities arrive at a moment of scale. Tribal gaming has posted several consecutive years of record gross revenue, and the sector now accounts for a large share of all gaming activity in the United States. Regulating an industry of that size with a comparatively small federal agency requires the NIGC to keep sharpening its tools, and the conference functions as one of the main venues where those tools are shared with the tribal regulators who do most of the day-to-day work.

Online gaming and the limits of federal reach

Among the most closely watched topics is the commission's role—and the boundaries of that role—when gaming moves onto phones and servers. The federal statute that created the NIGC was written for a brick-and-mortar world of bingo halls and casino floors, and applying it to internet-based play raises hard questions about where tribal authority begins and ends. Much of the online expansion tribes have pursued relies on routing wagers through servers located on Indian lands, a structure explained in our guide to the hub-and-spoke model. How the commission treats those arrangements has direct consequences for tribes weighing whether and how to enter digital markets.

The stakes are visible in states that have already built large online industries around tribal and commercial operators alike. Michigan, for instance, has run a mature internet gaming market for five years; our Michigan market deep dive shows how quickly online revenue can come to rival, and in some months exceed, the economics of the physical floor. Regulators studying those markets are effectively previewing questions the whole industry will face.

Cybersecurity moves up the agenda

If online expansion is the opportunity, cybersecurity is the accompanying risk, and it featured prominently on the conference schedule. High-profile ransomware attacks on major casino operators in recent years put the entire gaming industry on notice, and tribal operations—many of which run critical community services on the same revenue—have strong reason to treat digital defense as a governance issue rather than an IT afterthought. Sessions aimed at helping regulators identify core threats and mitigation strategies reflect a recognition that a single successful attack can idle a casino floor and expose sensitive patron data at the same time.

For tribal regulators, cybersecurity is no longer a technical specialty tucked inside the operations department; it is a sovereignty and continuity concern that reaches the governing council.

The commission's minimum internal control standards already touch on information security, but the pace of the threat has pushed regulators to move beyond baseline compliance toward active resilience planning. That shift—from checklists to preparedness—mirrors a broader modernization theme running through the week's programming.

Much of the conference's value, however, is more prosaic than the marquee panels suggest. A large share of the schedule is devoted to the practical craft of regulation: background investigations and licensing of gaming employees, audit techniques, surveillance standards, and the mechanics of enforcing internal controls on a busy casino floor. These are the tasks tribal gaming commissions perform every day, and the training exists to keep hundreds of regulators across the country working from a shared and current playbook. In an industry where a lapse in controls can jeopardize a tribe's compact or invite federal enforcement, that consistency is itself a form of risk management.

Modernization as a through-line

Underlying the specific sessions was a steadier message about updating the machinery of oversight itself: better data practices, clearer guidance for tribal gaming commissions, and training that keeps pace with technology. The NIGC does not license or operate casinos; its authority runs through approving ordinances, reviewing management contracts, and enforcing federal standards, with the bulk of regulation carried out by tribal gaming commissions on the ground. Readers who want to understand that division of labor can review our explainer on how the NIGC regulates tribal gaming, and the broader statutory picture in our legal guide.

Also circulating among attendees was fresh attention to the litigation testing whether federally regulated prediction markets can offer sports-style contracts in states without tribal consent—a fight that tribal regulators view as a direct challenge to gaming exclusivity. The conference did not resolve any of these questions, and it was never meant to. But the agenda made the commission's near-term concerns unusually legible: keep the regulatory framework current, help tribes defend their networks, and figure out how a statute built for casino floors should govern an industry that increasingly lives online.