EU AI Act: "We don’t use any AI"? Are you sure?
Chatbot, personalised recommendations, AI product shots – you probably use more AI than you think. What the EU AI Act means for your shop and what you need to label before 2 August 2026.
Ask around your team: "Do we actually use AI?" Most people say no on reflex. Then you look closer — there's a chatbot handling support, the homepage serves up personalised recommendations, half the product copy comes out of a tool, and those slick new lifestyle shots? Also AI. Welcome to the club. This is exactly where the EU AI Act comes in, and it's aimed at far more than the big tech players.
The clock is ticking. On 2 August 2026 the core transparency rules kick in. If you don't know by then which AI is running in your shop — and where — you're risking fines of up to €15 million or 3% of annual turnover. Sounds heavy, but it's manageable if you start now instead of the week before the deadline.
This article covers what the EU AI Act means for your shop and what to do about it. It's practical guidance, not legal advice.
First things first: what is this law?
The EU AI Act — officially Regulation (EU) 2024/1689 — is the first comprehensive AI law. It's been in force since August 2024 and applies in stages. And it applies directly across the whole EU, with no separate national law needed. For a plain-language overview, the European Commission runs a dedicated AI Act page.
The logic is simple: the riskier the use, the stricter the rules. Banned practices (like manipulative nudging) have been off the table since February 2025. High-risk AI such as CV screening gets the full set of obligations. Chatbots and the like fall under the transparency duties of Article 50. The spam filter in your inbox? Nobody cares.
For retail, one date matters: 2 August 2026. That's when Article 50 gets real.
Provider or deployer — and why it's you
Article 50 knows two roles. Providers build the AI — OpenAI, Anthropic, Google, Microsoft. Deployers use it. That's you, the moment an AI system runs in your shop. Did you build it yourself? Doesn't matter.
Here's the part that catches people off guard: the law doesn't care about the product name, it cares about the function. If a system draws conclusions on its own, calculates recommendations or generates content, it's AI. Which means almost every shop is in scope.
One duty has been ticking even longer: AI literacy under Article 4, in force since February 2025. In short: your team needs to know what it's doing with its AI tools. Everyone, regardless of company size.
What needs a label — and what doesn't
The responsibility is split. Providers have to make sure chat and voice bots are recognisable as AI and that synthetic content — audio, image, video, text — is marked up technically.
Your job as a deployer comes down to two things: deepfakes — AI-generated images, videos or audio meant to look real — and AI texts on matters of public interest such as health, finance, politics or law. Both need a visible label for your users.
Translated into everyday shop life: a chatbot has to reveal that it's AI. Realistic AI-generated product or mood imagery needs a note. Your ordinary, editorially checked product descriptions, on the other hand, usually stay out of scope. Breathe easy there.
Labelling without wrecking your design
There are two layers. Machine-readable is the provider's job: watermarks and metadata (think C2PA) sit invisibly inside the content. Visible is yours: a clear note right next to the content — where people actually see it, not buried in the terms or down in the footer.
A layered approach works best: a short label right at the content (icon plus text), with details on demand via tooltip, FAQ or an info page. And you don't have to design the icons yourself — the EU provides them, ready-made and free: "AI", "AI generated" and "AI modified". You can download them from the European Commission's official page.
And it doesn't have to sound clunky. On a chatbot, this does the job: "You're chatting with an AI assistant — replies are generated automatically." Under an image, "Created with AI" is enough. Done.
The neat shortcut — plus your four to-dos
For AI texts there's a way out: the labelling duty can fall away if a human checks facts, sources and plausibility before publication and a clearly identifiable person takes editorial responsibility. So a clean sign-off process saves you real work. Not a bad deal.
To keep the pressure off:
Build an AI inventory. Every tool, every use case with AI — from the chatbot to image generation. You'll be surprised how much adds up.
Check your providers. Do your tools already mark synthetic content machine-readably (C2PA, metadata)?
Create labelling templates. CMS blocks, labels and standard wording for chatbot, images and video — set it up once, then it runs.
Sort out sign-off and contracts. Who reviews, who takes responsibility? And do your agreements with agencies and freelancers still fit?
Bottom line
The EU AI Act isn't a big-corporate topic. The moment a chatbot answers in your shop or an AI image goes live, you're on the hook as a deployer — and 2 August 2026 is coming faster than your next sale is planned.
Starting early pays off twice: you're on the safe side of the rules, and you build trust with customers who increasingly want to know where AI is involved. Transparency here isn't a burden, it's a selling point.
And the effort is manageable. Nobody's asking you to switch AI off — only to show where it's already at work. Start today, not in the last week of July.
Talk to us
Not sure how much AI is really running in your shop and what needs a label? We'll go through your setup with you and build the labelling cleanly into your frontend. Get in touch — we'll sort it out together.
FAQ
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689, the EU's first comprehensive AI law. It regulates AI systems by risk level and has applied in stages since August 2024; the Article 50 transparency duties become binding on 2 August 2026.
Do I have to label AI-generated images and videos in my shop?
Yes, if they look real (deepfakes). As a deployer you have to visibly label AI-generated images, videos or audio meant to pass as genuine, with a clear note right next to the content.
What's the difference between a provider and a deployer?
Providers are the makers of AI systems (e.g. OpenAI, Google). Deployers are the users — that's your company. Providers mark synthetic content machine-readably; deployers visibly label deepfakes and AI texts on matters of public interest.
Do I need to label my chatbot?
Yes. Users must be able to tell they're chatting with AI, not a human. A clear notice before the first input satisfies the Article 50 transparency duty.
When does the EU AI Act apply to online shops?
The key transparency duties under Article 50 apply from 2 August 2026. The AI literacy duty under Article 4 has already been in force since February 2025.