Short answer
EU-facing operators should inventory AI uses, check provider and deployer roles, disclose covered interactions and synthetic content, and review higher-risk uses.
The answer in detail
For an e-commerce operator within the EU AI Act's scope, the practical starting point is an inventory: which tools speak to customers, generate realistic content, make decisions about people or receive personal data? Then identify the merchant's role and the obligations that apply to each use. Being outside the EU does not automatically put a business outside the Act's scope.
The benchmark
The EU AI Act applies in stages. The Commission's current implementation timeline, checked on October 29, 2026, distinguishes the following milestones. Do not interpret a later high-risk deadline as a postponement of every obligation.
| Date | Milestone |
|---|---|
| February 2, 2025 | General provisions, AI literacy and prohibitions apply |
| August 2, 2025 | General-purpose AI model rules and governance milestones |
| August 2, 2026 | Article 50 transparency and other applicable rules |
| December 2, 2026 | Limited Article 50(2) transition for certain preexisting systems, plus specified new prohibitions |
| December 2, 2027 | Annex III high-risk rules under the amended timeline |
| August 2, 2028 | Annex I regulated-product high-risk rules under the amended timeline |
The December 2026 transition is not a general extension for every chatbot or generated image. The Commission identifies a particular transition for certain providers of synthetic-content systems already placed on the market before August 2, 2026.
A merchant using a vendor's assistant is generally a deployer. A business developing, commissioning or placing a system on the market under its own name may be a provider; the precise facts matter. The Commission's Article 50 FAQ explains that providers outside the EU can also be covered, including specified EU-market and EU-output situations.
The Commission’s current implementation timeline provides the application dates. Assess the business’s EU scope and actual role before applying them; a national regulator’s explanatory summary is not a worldwide rule.
The rule
Check three distinct issues: transparency, prohibited practices and the risk category of the actual use.
For covered direct interactions, the AI system must make the interaction's AI nature clear unless the applicable obviousness exception is met. Do not assume that a human name or realistic avatar makes disclosure unnecessary. Verify the provider's implementation and what shoppers actually see.
Synthetic-content marking by providers and visible disclosures by deployers are different obligations. Realistic generated or manipulated images, audio and video may fall within the deepfake rules depending on the statutory definition and context. Do not state that every AI-created illustration requires the same label. Conversely, an invisible machine-readable mark does not automatically replace a visible disclosure where one is required.
Prohibited manipulation and exploitation have legal conditions; the Act does not simply label every poor recommendation illegal. Review deceptive or coercive design alongside the dark-pattern checklist.
Product recommendations or drafting product descriptions do not automatically become high-risk uses. Employment screening and creditworthiness evaluation deserve separate assessment. The source notes the financial-fraud-detection distinction from credit scoring; that distinction does not exempt a tool from every other applicable law. GDPR can apply where personal data is processed within its scope.
The steps
- Inventory tools with columns for vendor, purpose, direct customer interaction, realistic generated output, decisions about people and customer data shared. Include embedded AI in existing software, not only stand-alone chatbots.
- Determine provider/deployer roles and assess each use. A few unchecked boxes are not proof of exemption from all regulation. Escalate employment, credit and other potentially high-risk applications for review against the applicable annex and exclusions.
- Test the opening disclosure. For example: “I'm the brand's AI assistant. I can make mistakes; type ‘human’ for our team.” Make the route real and localize it to the shopper's language. See AI customer-service boundaries.
- Write a content-review policy. Identify when realistic synthetic content needs disclosure, how it will appear and who approves it. A plausible generated model wearing a real product merits review; avoid making a definitive classification from the label “AI image” alone.
- Review vendor contracts and technical documentation. Ask about required output marking, supported disclosures, permitted data use and whether customer information is used for model training. A different processing purpose needs its own assessment.
- Provide and document AI-literacy measures appropriate to the tools, staff and context. Keep dated training material and practical instructions rather than assuming a vendor account gives the team sufficient knowledge.
The pitfall
“High-risk rules were delayed” is not a reason to close the file on transparency or prohibited uses. Nor does disclosure make an inaccurate customer-service answer harmless. The agent-responsibility article discusses that separate issue.
A sensitive-health brand described by the contributors withheld automated answers while reliability remained uncertain. That is a risk decision beyond adding a label. Keep human review and verified product knowledge where a wrong answer can cause serious consequences.
What to tell your team
“In this fictional inventory, one of seven tools speaks directly to customers. We are checking its disclosure and escalation, reviewing synthetic-content labels and two vendor contracts, and assessing whether any decision-making use is high-risk. Each action has an owner and a deadline tied to the applicable EU rule.”
