AI Act in eCommerce: What are the new requirements for online retailers?
02.09.2026 9 min. 138 views
From 2 August 2026, new transparency requirements for the use of artificial intelligence (AI) systems, set out in the European Artificial Intelligence Act (AI Act), began to apply in the European Union. For businesses, this means specific obligations when using AI systems and AI-generated or manipulated content.
The Act also affects online retailers that use AI systems and tools in their operations. The topic is particularly relevant to the eCommerce sector, as AI is already present at different levels of online retail - in search and product recommendations, chatbots and customer service, content and image creation, translations, and the automation of internal processes.
The AI Act does not regulate the online store itself, but the specific AI systems and the organisations that provide/use them. The requirements apply to the specific AI systems that a business provides or uses and to its role in relation to them.
In this article, we will look at what the AI Act is, which of its requirements are most relevant to eCommerce, and what practical steps online retailers should take.
What is the European AI Act?
The Artificial Intelligence Act - Regulation (EU) 2024/1689, known as the AI Act, introduces a common European regulatory framework for the development and use of artificial intelligence. It introduces uniform rules for all EU countries, with the main objective of ensuring that the development and use of artificial intelligence are safe, transparent, and consistent with fundamental rights.
The AI Act follows a risk-based approach. This means that the requirements for a particular AI system depend on its intended purpose, how it is used, and its potential impact on people. Some AI applications are mainly subject to transparency obligations, others are subject to significantly stricter rules, while certain practices are prohibited.
It is important to make a distinction - the AI Act is a regulation, not a directive. This means that the regulation applies directly in all European Union Member States, including Bulgaria, without the need for its requirements to first be transposed into national legislation.
Different parts of the regulation apply in stages. From 2 August 2026, the transparency rules under Article 50 also apply, which are particularly relevant to some of the AI systems used in digital business.
Who is a provider and who is a deployer?
To understand what obligations an online retailer may have, it is important to distinguish between two of the main roles under the AI Act:
- Provider - an organisation that develops an AI system or has an AI system developed and places it on the market or puts it into service under its own name or trademark.
- Deployer - an organisation that uses an AI system under its authority as part of its professional activities.
In the context of eCommerce, the online retailer is often in the role of a deployer when using a ready-made external AI solution - for example, a chatbot, a content generation tool, a product recommendation system, or another AI service.
The distinction has practical significance because providers and deployers may have different obligations. For example, the technical mechanisms that enable generated content to be recognised as created or manipulated using AI are the responsibility of the provider of the respective system. The online retailer, as a deployer, may in turn have transparency obligations depending on how it uses the system. In certain cases, this includes informing users or labelling content.
How does the AI Act affect online retailers?
Artificial intelligence is used in many processes in eCommerce, for example:
- intelligent search and product recommendations;
- chatbots and virtual assistants;
- content and offer personalisation;
- generation and optimisation of product descriptions;
- image generation and processing;
- marketing content;
- automated translations and localisation;
- product catalogue categorisation and enrichment;
- dynamic pricing;
- analysis and automation of internal processes.
However, this does not mean that all AI applications in an online store automatically fall under the same requirements. What matters is the specific system, its intended purpose, how it is used, and the role of the online retailer.
Which transparency requirements are important for eCommerce?
Among the rules most relevant to online retailers are the transparency requirements under Article 50 of the AI Act.
Chatbots and other interactive AI systems
For AI systems that interact directly with people, the provider is required to design the system so that users are informed that they are interacting with AI. For online retailers as deployers, this means ensuring that a notification is provided in the interface at the first interaction, with the information presented in a clear and accessible manner.
For online retailers using ready-made external AI solutions, this means checking whether the AI chatbots and other interactive AI systems they use provide the necessary information directly in the interface. It is not sufficient for the use of AI to be stated only in the Terms and Conditions or Privacy Policy.
The same principle applies to other AI systems that interact directly with users, such as voice bots and AI assistants in mobile applications or social networks.
AI-generated or manipulated content
Using AI to create content does not automatically mean that every product description, banner, or marketing text must be visibly labelled as "created with AI".
Providers of AI systems that generate or manipulate text, images, audio, or video must ensure that the outputs can be recognised as AI-generated or manipulated through machine-readable marking (for generative systems placed on the market before 2 August 2026, a grace period for its implementation is provided until 2 December 2026). It is important here to distinguish between the technical marking of content, which is the responsibility of the AI system provider, and visibly informing the user, which is required from the deployer only in certain cases.
Deepfake content
Under the AI Act, a deepfake is an AI-generated or manipulated image, audio, or video that resembles an existing real or realistic person, object, place, organisation, or event and may falsely appear to be authentic or truthful.
When using such content, the deployer must disclose its AI origin in a clear and perceptible manner to the user. The presence of machine-readable technical marking alone is not sufficient to fulfil this obligation. The user must be able to understand the origin of the content without using specialised software.
AI-generated texts on matters of public interest
Separate rules also apply to AI-generated or manipulated texts published for the purpose of informing the public on matters of public interest.
They must be labelled when they fall within the scope of the regulation. An exception is provided where the text has undergone genuine human review or editorial control and a natural or legal person holds editorial responsibility for its publication. The European Commission clarifies that a superficial check solely for spelling or grammar does not constitute sufficient editorial control.
The European Commission guidelines explicitly state that AI text that is part of an advertisement or product description is not considered text on a matter of public interest when it does not contain claims concerning health, consumer safety, or sustainability.
What should online retailers do?
For most online stores, the first practical step is to identify where and for what purposes AI is already being used.
1. Make an inventory of the AI systems you use
Check not only the visible AI functionalities in the online store, but also the solutions that operate in the background. The review should cover the eCommerce platform itself, custom functionalities, extensions, external services, API integrations, and the tools used by marketing, customer support, content, and eCommerce teams.
It is good practice to conduct the review together with the eCommerce agency, technical team, and providers of the external solutions being used, and to document the results in an up-to-date internal list of the AI solutions in use, their providers, intended purpose, and how they interact with users and data.
2. Determine your role and the applicable requirements
The AI Act uses the intended purpose of the system and the context in which it is used as important factors in determining the applicable requirements. For certain AI functionalities, the main focus is on transparency towards the user - for example, when a person interacts directly with an AI system or when certain AI-generated or manipulated content is used. Other standard eCommerce applications of AI may be associated with more limited specific obligations under the AI Act.
For AI applications involved in more sensitive processes with a potentially significant impact on people, a more in-depth legal assessment is required.
3. Check how AI is presented on the frontend of the online store
Transparency is one of the important topics in the AI Act.
Where applicable to the specific AI system and the role of the online retailer, direct user interaction with AI turns part of the preparation for the AI Act into not only a legal and technical task, but also a UX/UI task.
The information should be placed where the user will actually see and understand it, rather than only in the Terms and Conditions or another difficult-to-access page. The European Commission states that notification of direct interaction with AI should be clear and distinguishable from the beginning of the first interaction.
4. Check the providers of AI solutions
A large part of the AI functionalities in online stores are implemented through external platforms, SaaS services, extensions, and API integrations. It is therefore important to check how the providers of the AI solutions you use address the applicable requirements of the AI Act and what information and documentation they provide about their systems.
Pay attention to what data is sent to the AI system, how it is processed and stored, and whether it is used to train models. Online retailers are advised to request information and available documentation from their external AI providers in a timely manner regarding how they address the applicable requirements of the AI Act, including the technical marking of AI-generated or manipulated content where such a requirement applies.
5. Check the personal data protection requirements as well
If the AI system processes users' personal data, a separate review should also be carried out against the requirements of the GDPR. Where necessary, the information provided to users and the internal processes for processing personal data should be updated.
6. Prepare your team
Since 2 February 2025, the rules on AI literacy under Article 4 of the AI Act have been in force. The AI Act also places emphasis on so-called AI literacy - the knowledge and understanding of people who work with AI systems. Organisations providing or using AI should take steps to develop knowledge among their employees according to their profile and work context.
For an online retailer, this may mean training and internal rules for:
- marketing and content teams that use AI for content;
- customer support specialists who work with an AI chatbot;
- eCommerce and catalogue managers;
- employees using AI for translations and product information;
- developers and technical teams that integrate AI solutions.
In practice, this may include internal rules, instructions, and training tailored to how the different teams use AI.
This article does not constitute individual legal consultation or advice. We recommend discussing the topic with the person responsible for these matters in your company.
In conclusion
The AI Act requires businesses to have a clear understanding of which AI systems they use, for what purposes, and what requirements arise from the specific way in which they are applied.
For eCommerce businesses, this requires coordination between the technical, legal, and organisational aspects of using AI. A good starting point is therefore to review existing AI solutions and processes, determine the applicable requirements, and plan the necessary changes where they are needed.
Sources:
- EUR-Lex - Regulation (EU) 2024/1689 - European Artificial Intelligence Act (AI Act)
- European Commission - Guidelines on transparency obligations for providers and deployers of AI systems
- European Commission - Transparency obligations under Article 50: Questions & Answers
- European Commission - Code of Practice on Transparency of AI-Generated Content
- European Commission - AI literacy
Published in:
e-commerce tips