What the EU AI Act Means for Online Merchants

The EU AI Act is a regulation that sets rules for AI systems by risk level. Most online stores use tools in the lower-risk groups, such as chatbots, product text generators and recommendation widgets. For these tools, the main duties are transparency and staff AI literacy, not heavy certification.

This article gives a general overview. It is not legal advice. Read the official text and ask a lawyer before you make decisions for your business.

What is the EU AI Act?

The AI Act is Regulation (EU) 2024/1689. It entered into force in August 2024. It applies in phases, so different parts apply from different dates.

The Act covers two main roles that matter for stores:

• Provider: the company that develops an AI system or places it on the market.
• Deployer: the company that uses an AI system in its own business.

Most merchants are deployers. You use a chatbot, a writing assistant or a fraud tool that someone else built. Some obligations still apply to you in that role.

Dates and details in the AI Act framework have been adjusted by later EU measures. Check the current text and the European Commission's AI Act pages for the dates that apply today.

The risk-based approach

The Act sorts AI uses into groups. The higher the risk to people, the stricter the rules.

• Prohibited practices: a short list of uses the EU bans, such as certain manipulative techniques and some forms of social scoring. A normal store does not use these.
• High-risk systems: AI used in sensitive areas, such as hiring, credit scoring or access to essential services. These carry detailed duties.
• Transparency duties: rules for AI that talks to people or creates content. This group matters most for stores.
• Minimal risk: most other tools, with no specific duties under the Act.

The groups are about the use of the tool, not the brand name. The same language model can be minimal risk in one job and high-risk in another.

Where a store is most likely to be affected

Check each AI tool in your shop and ask what it does. The following uses are common.

Chatbots and virtual assistants

If customers talk to an AI chat on your site, the transparency rules apply. In general terms, people must be told that they are talking to an AI system, unless this is obvious from the context.

A simple label such as "AI assistant" in the chat header helps. Do not give an AI chat a human name and photo without any note.

AI-generated content

Providers of systems that generate text, images, audio or video must mark outputs in a machine-readable way. Deployers have separate duties in some cases, for example for deepfakes and for AI-generated text that informs the public on matters of public interest.

Ordinary product descriptions and marketing copy are usually a different case than news-style text. Still, read the official wording and the Commission's guidance. If your AI produces realistic images of people or events, take extra care with labels.

Fraud and credit-type tools

A fraud score that blocks an order is not automatically high-risk under the Act. Creditworthiness assessment of individuals is named as a high-risk area. If a tool decides whether a customer may pay later or by invoice, ask the vendor how it is classified.

Personalisation and recommendations

Product recommendations and search ranking are usually minimal risk. GDPR still applies to the personal data behind them.

AI literacy

The Act includes a duty about AI literacy. Providers and deployers must take measures so that their staff have a sufficient level of AI literacy for the tools they use. This duty has applied since early 2025.

For a small team, this can be simple:

• Write down which AI tools the team uses and for what.
• Explain the limits of each tool, such as wrong facts and invented details.
• Name one person who reviews AI output before it goes live.
• Keep a short record of the training or briefing you gave.

A practical checklist for merchants

Use this list to review your store. Do it once, then repeat when you add a new tool.

1. List every AI feature: chatbots, writing tools, translation, fraud scoring, recommendations, image tools.
2. Note the vendor and the purpose of each one.
3. Mark where the tool talks to customers or creates public content.
4. Add a clear AI notice to chats and to any realistic AI-generated media.
5. Ask each vendor how they classify the tool under the AI Act.
6. Check your contracts for who is the provider and who is the deployer.
7. Keep human review for decisions that affect customers in a significant way.
8. Update your privacy notice if AI tools process personal data.

AI Act and GDPR together

The AI Act does not replace GDPR. If an AI tool processes customer data, you still need a legal basis, a processing agreement with the vendor and a clear privacy notice. Automated decisions that have legal or similarly significant effects on a person have their own rules under GDPR.

What to do now

Start with the list of tools. Most stores will find that only a few uses need action, mainly chat labels and AI literacy. Keep records, so you can show what you checked and when. Watch the official sources for changes to dates and guidance.

Frequently asked questions

Does the AI Act apply to a small online store?

Yes, if you use or offer AI systems in the EU market. The Act has no general exemption for small shops. The duties depend on your role and the type of use, so a small store with a chatbot has few duties, but they exist.

Do I need to label AI-written product descriptions?

The rules depend on the use and on the exact text of the Act. A normal product description is not the same as AI content about matters of public interest. Check the official text and Commission guidance. As good practice, keep a human review step and be honest about AI use.

Is my chatbot a high-risk system?

A customer service chatbot is normally not high-risk. It falls under the transparency group. Customers should know they are talking to an AI. If the bot makes decisions in sensitive areas, ask a lawyer.

Where can I read the official rules?

Read Regulation (EU) 2024/1689 in the Official Journal of the European Union. The European Commission also publishes guidance and explainers on its AI Act pages. Use those, not blog posts, as your final source.