The EU AI Act is the European Union’s regulation on artificial intelligence, which sorts AI systems by risk and sets duties for providers and deployers. For most e-commerce brands, the relevant rules are transparency duties: telling shoppers when they talk to a chatbot and labeling certain AI-generated content. A few uses, such as AI in hiring or credit checks, carry heavier obligations.
Does the EU AI Act apply to stores outside the EU?
It can. The Act applies to providers placing AI systems on the EU market and to deployers using them in the EU, and it also reaches companies outside the EU when the output of an AI system is used in the Union. A Turkish store selling to German customers through a chatbot on its website should assume the rules are relevant.
The obligations are being phased in over several years after the Act entered into force in 2024. Bans on prohibited practices came first, followed by rules for general-purpose AI models, with most other duties applying later. Exact dates and guidance continue to be clarified by the European Commission, so check the current timeline before planning.
How does the risk system work?
- Prohibited practices: for example manipulative techniques that cause significant harm or exploit vulnerable groups
- High-risk systems: listed areas such as employment, credit scoring and access to essential services
- Limited risk with transparency duties: chatbots, emotion recognition, deepfakes and some AI-generated content
- Minimal risk: most other uses, such as spam filters or many recommendation features, with no new specific duties
Most marketing tools fall into the limited or minimal categories. That does not mean no rules apply. GDPR, consumer protection law and the Digital Services Act still govern personal data, misleading practices and platform duties.
What does it mean for common e-commerce use cases?
Customer service chatbots
Shoppers must be told they are interacting with an AI system unless it is obvious from the context. A short line at the start of the chat, such as ‘You are chatting with our AI assistant’, covers it. Offer a clear route to a human for complaints and returns, which consumer law and good service already expect.
AI-generated product images and videos
Deployers of AI that generates deepfakes, meaning realistic images, audio or video of real people, places or events that could be mistaken for authentic, must disclose that the content is artificial. A lifestyle image of a model who does not exist wearing your product sits close to that line. Labeling AI-generated visuals, especially those showing people, is the safe practice.
Product recommendations and personalization
Standard recommendation engines are generally not high-risk under the AI Act. The tighter constraints come from elsewhere: GDPR consent for tracking, the Digital Services Act’s rules on recommender transparency for platforms, and consumer law on dark patterns. Do not use AI to exploit shoppers’ vulnerabilities, such as pressuring people in financial distress, which can touch the prohibited practices.
AI-written product descriptions and blogs
Text published to inform the public on matters of public interest must be disclosed as AI-generated unless it has gone through human review and editorial responsibility. Product copy reviewed by your team is in a safer position. Either way, the store remains responsible for the accuracy of every claim.
Dynamic pricing
AI pricing is not named as high-risk, but consumer law in the EU requires telling shoppers when a price was personalized based on automated decision-making. Combine that with GDPR rules on profiling, and pricing tools need a legal review before launch.
What should a store do first?
- List every AI tool in use: chat, images, copy, pricing, recommendations, fraud checks, hiring
- Note who provides each tool and whether you are a provider or a deployer
- Add AI disclosure to chat widgets and voice assistants
- Set a labeling rule for AI images and videos of people
- Train staff who use AI tools; the Act includes an AI literacy duty for deployers
- Review contracts with vendors for compliance commitments and data handling
How does this connect to PR and reputation?
Regulation is a communications issue as much as a legal one. Brands caught using undisclosed AI models in ads, or chatbots that pretend to be human, face criticism that spreads fast. Clear disclosure, a public statement on how the company uses AI and a contact for questions turn compliance into a trust signal.
How Alien Road applies the EU AI Act in client work
We are a marketing agency, not a law firm, so our role is practical. In a typical engagement we run an inventory of every AI tool touching the client’s marketing and customer journey, documenting what it does, which data it uses and where its output appears. That inventory goes to the client’s legal advisor for the final assessment.
Once the advisor confirms the duties, we handle the implementation on the marketing side: chatbot disclosure text in each language, labeling templates for AI visuals, an internal policy page for the team and a public AI use statement. Our PR team prepares holding statements in case questions arrive from press or customers. Reporting is a quarterly review of the inventory, because new tools appear in marketing stacks every month.
What about AI tools bought from vendors?
Most stores do not build their own AI. They use features inside Shopify, WooCommerce plugins, email platforms and chat providers. In those cases the vendor is usually the provider and the store is the deployer. Deployers still carry duties, especially transparency to users and staff training, and they should use systems according to the vendor’s instructions.
Ask vendors three questions: what AI features are active in your account, how they plan to meet their AI Act obligations and how customer data is processed. Keep the answers on file. When a vendor turns on a new AI feature by default, which happens often, your inventory should catch it at the next review.
- Check release notes from major platforms monthly
- Record default-on AI features and decide whether to keep them
- Keep vendor compliance statements with your contracts
Where to start this week
Open a spreadsheet and list every AI feature your store uses, including ones built into platforms like Shopify, Klaviyo or your chat provider. Add a column for whether customers see its output. Anything customer-facing gets a disclosure check first. Share the list with your legal advisor and agree on a date to review it again.
Keep reading: PR Services · Digital PR