EU AI Act for Ecommerce: What Applies Now, What Moved to 2027, and What to Do

This guide from Elogic Commerce explains what the EU AI Act requires from online stores after the Digital Omnibus changed the timeline in July 2026. It covers B2C and B2B stores, the Article 50 transparency rules, the high-risk dates and the fines. It also gives the Elogic Commerce AI Act Ecommerce Matrix: 24 common ecommerce AI use cases, each mapped to the rule, the role, the date and the other EU law to check.

Quick answer

The EU AI Act applies to every online store that uses AI with people in the EU, wherever the store is based. Since 2 August 2026, Article 50 requires AI chatbots and assistants to say that they are AI, and realistic AI images to carry a visible label. High-risk rules, such as in-house credit checks for pay later, start on 2 December 2027.

About this guide

Elogic Commerce checked this guide against Regulation (EU) 2024/1689, the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Commission guidelines and FAQ on Article 50 (July 2026) and the Code of Practice on AI-generated content (June 2026). This guide is not legal advice. Use it to prepare the questions for your legal counsel and the tasks for your development team.

What changed in 2026

Three things changed in 2026. The Digital Omnibus moved the high-risk rules. The Article 50 transparency rules started on time. The Commission published the final guidance on how to apply them.

• 10 June 2026. The Commission published the final Code of Practice on marking and labeling AI-generated content, with a set of EU icons for labels (Bird & Bird).
• 20 July 2026. The Commission published the final guidelines on Article 50. The Commission FAQ was updated on 24 July 2026 (European Commission).
• 27 July 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force. It moved the Annex III high-risk rules to 2 December 2027 and the Annex I rules to 2 August 2028 (Usercentrics).
• 27 July 2026. The AI literacy duty in Article 4 changed from ensuring a sufficient level of AI literacy to taking measures that support it.
• 2 August 2026. Article 50 started to apply, and national authorities got the power to fine.
• 29 July 2026. In Germany, the Bundesnetzagentur confirmed its central role. Sector authorities such as BaFin keep their own areas (Bundesnetzagentur).

Elogic Commerce view

The Omnibus moved the heavy rules, not the visible ones. For most online stores, the 2026 work is in the storefront: the chatbot notice, the image labels and the metadata pipeline.

Why this matters: the 2026 numbers

AI use in European commerce grew faster than trust in it. That gap is why the transparency rules came first.

• 20.0% of EU enterprises with 10 or more employees used AI in 2025, up from 13.5% in 2024. Among large enterprises, the share was 55.0% (Eurostat, December 2025).
• 9.5% of EU enterprises used AI to generate pictures, video or sound in 2025, and 8.8% used it to generate written or spoken language (Eurostat).
• 56% of European consumers have used AI to shop at least once, in a survey of 13,500 consumers in 15 countries (Deloitte, 2026).
• 63% of European respondents use AI tools to compare products, and 56% want a person to make the final decision (McKinsey, March 2026).
• 46% of European respondents bought a product that AI recommended in the past six months (Klaviyo, March 2026).
• Only 35% of European consumers trust companies to use their data with AI, against 48% globally (Ipsos, at Shoptalk Europe 2026).
• Zalando reported that its AI assistant reached 10 million users in Q1 2026 and that 90% of its site content is now AI-generated (Shoptalk Europe 2026).
• 83% of organizations assessed by Vision Compliance had no formal inventory of their AI systems. The sample was its client base in eight industries, retail included (Vision Compliance, April 2026).

Elogic Commerce view

Shoppers use AI more than they trust it. A clear AI notice is a legal duty and a trust signal at the same time. Design it as part of the brand, not as a legal footnote.

EU AI Act timeline for online stores

Article 5 and Article 4 apply since February 2025. Article 50 applies since August 2026. The high-risk rules apply from December 2027 and August 2028.

Date	What applies	Ecommerce example
1 Aug 2024	The AI Act enters into force.	No store duty yet.
2 Feb 2025	Prohibited practices (Art. 5). AI literacy (Art. 4).	No AI-personalized pressure on vulnerable shoppers. Staff training on AI tools.
2 Aug 2025	Rules for general-purpose AI models.	Duties for model providers such as OpenAI, Anthropic and Google, not for stores.
27 Jul 2026	Digital Omnibus in force. Art. 4 softened.	High-risk dates move.
2 Aug 2026	Article 50 transparency. National fines.	Chatbot notice. Deepfake labels. Public-interest text labels.
27 Sep 2026	Green claims rules (ECGT). Not the AI Act.	AI-written environmental claims need evidence.
20 Nov 2026	Consumer Credit Directive 2. Not the AI Act.	Buy now, pay later becomes regulated consumer credit.
2 Dec 2026	Machine-readable marks for generative tools already on the market.	Image and text tools must mark output.
Q4 2026	Digital Fairness Act proposal expected. Not the AI Act.	Dark patterns and personalization rules.
2 Dec 2027	High-risk rules, Annex III.	In-house credit checks, recruitment AI, emotion recognition.
2 Aug 2028	High-risk rules, Annex I.	AI in regulated products, for example toys or machinery.

Does the EU AI Act apply to your online store?

Yes, if your store uses AI with people in the EU. The AI Act applies to providers and deployers outside the EU when the output of their AI system is used in the EU. The duties attach to each AI system and to your role for that system, not to the store as a whole.

Provider or deployer

A provider develops an AI system, or has it developed, and puts it into service under its own name or trademark. A deployer uses an AI system under its authority for professional purposes. Most online stores are deployers of bought-in tools. A store becomes a provider when it builds its own assistant, or has an agency build it, and runs it under the store brand.

Elogic Commerce view

On headless and composable stacks, the merchant often builds the assistant on a model API and runs it under its own brand. That usually makes the merchant the provider under Article 50(1). Treat the AI notice as a product requirement in the first sprint.

B2B stores are in scope

The Article 50(1) notice protects all natural persons: consumers and professionals. A buyer who talks to an AI assistant on a distributor portal must get the notice. See B2B ecommerce development and AI in B2B ecommerce for the wider B2B context.

What is out of scope

• AI that runs only machine to machine. When a shopper’s AI agent calls your checkout API, Article 50(1) does not apply. When your AI agent talks to the shopper, it does.
• AI that works in the background with no direct contact with people, for example demand forecasting.
• Personal, non-professional use of AI.

EU AI Act risk categories, with ecommerce examples

The AI Act has four practical levels: prohibited, high-risk, transparency (Article 50) and minimal risk. Most store AI is minimal risk. The storefront AI that talks to shoppers or makes realistic media sits in the transparency layer.

Category	What it means	Ecommerce examples	Main duty
Prohibited (Art. 5)	Banned since 2 Feb 2025	AI-personalized pressure on vulnerable shoppers that causes significant harm; emotion recognition of employees	Stop it
High-risk (Annex III)	Strict duties from 2 Dec 2027	In-house credit checks for pay later or pay on invoice; recruitment AI; emotion recognition of shoppers	Risk management, human oversight, logs
Transparency (Art. 50)	Applies since 2 Aug 2026	Chatbots, AI agents, deepfake images and video, AI text on public-interest topics	AI notice, machine marks, visible labels
Minimal risk	No specific AI Act duty beyond Art. 4 and Art. 5	Recommendations, ecommerce site search, forecasting, fraud detection, dynamic pricing	Document it. Check GDPR, DSA and consumer law.

The AI Act does not use the term limited risk. Many guides use it for the Article 50 layer. One system can be high-risk and also need the Article 50 notice.

The Elogic Commerce AI Act Ecommerce Matrix

The Elogic Commerce AI Act Ecommerce Matrix maps 24 common ecommerce AI use cases to the EU AI Act rule, the responsible role, the date and the other EU law to check. Use the Elogic Commerce AI Act Classifier to check one use case, or read the full table. The Elogic Commerce Storefront AI Disclosure Scan measures how European stores apply the storefront rows in practice.

#	Use case	AI Act rule	Who acts	From	Also check
1	Product recommendations shown as ranked lists	Minimal risk. No Article 50 duty. The Article 5 limits on manipulation apply.	Merchant (deployer)	2 Feb 2025 (Art. 5)	GDPR Art. 21: shoppers can object to marketing profiling. DSA Art. 27 if you run a marketplace.
2	Site search and semantic search (search box and result list)	Minimal risk. Usually no Article 50 duty, because there is no two-way conversation.	Merchant (deployer)	No AI Act date	Consumer law: marketplaces must disclose the main ranking parameters. DSA Art. 27.
3	AI shopping assistant, conversational search or sell-side AI agent	Art. 50(1): tell the shopper that it is AI at the first interaction, unless this is obvious.	Provider of the assistant (the vendor, or the merchant for its own branded build)	2 Aug 2026	GDPR for chat data. The notice must be accessible (European Accessibility Act).
4	Customer service chatbot or AI support agent	Art. 50(1): AI notice at the first interaction.	Provider. The merchant checks the notice on the live storefront.	2 Aug 2026	GDPR. Consumer law: do not make the bot look like a person.
5	Voice assistant or AI phone agent	Art. 50(1): say that it is AI at the start of the call.	Provider	2 Aug 2026	GDPR. National rules on call recording.
6	A shopper’s own AI agent that calls your API or checkout	Outside Art. 50(1). The exchange is machine to machine, with no person in it.	Not applicable	No AI Act date	Payment authentication (PSD2 strong customer authentication), your terms of sale, fraud controls.
7	Photoreal AI image or video of a real product, person or place	Art. 50(4): visible label if it would falsely appear authentic (deepfake). Art. 50(2): the AI tool provider marks the file.	Merchant labels. The tool provider marks.	2 Aug 2026 (marks for older tools: 2 Dec 2026)	Consumer law: the image must show the product as sold. Google Merchant Center: keep the IPTC AI tag.
8	AI background or scene around a real product photo	Apply the deepfake test case by case: resemblance, audience and context.	Merchant (deployer)	2 Aug 2026	Google Merchant Center: IPTC value compositeSynthetic.
9	Synthetic models, virtual try-on images or AI avatars in product media	Usually a deepfake label when realistic. An avatar that talks with viewers also needs the Art. 50(1) notice.	Merchant labels. The provider builds the notice.	2 Aug 2026	Personality rights if the model resembles a real person.
10	AI-written product descriptions with no health, safety or environmental claims	No visible AI Act label: this is not text on a matter of public interest. The AI tool provider marks the output.	Tool provider marks	2 Aug 2026	Consumer law: descriptions must be accurate. Google Merchant Center: send AI text in the structured description attribute.
11	AI-written text with health, safety or environmental claims, published without human review	Art. 50(4): label it, unless a person reviews it and holds editorial responsibility.	Merchant (deployer)	2 Aug 2026	Green claims rules (ECGT) from 27 Sep 2026. Health claims rules.
12	AI translation of the catalog	No marking duty: translation counts as standard editing in the final Commission guidelines.	Not applicable	No AI Act date	National language rules for consumer information.
13	AI summaries of customer reviews	The AI tool provider marks the output (Art. 50(2)).	Tool provider	2 Aug 2026	Consumer law bans fake reviews. Say how you check that reviews are real.
14	Dynamic pricing based on demand, stock or time	Minimal risk.	Merchant (deployer)	No AI Act date	Price Indication Directive. Unfair Commercial Practices Directive.
15	personalized pricing based on a shopper profile	Minimal risk. Prohibited if it exploits vulnerabilities and causes significant harm (Art. 5).	Merchant (deployer)	2 Feb 2025 (Art. 5)	Consumer Rights Directive: tell the shopper that the price is personalized. GDPR. Digital Fairness Act proposal (Q4 2026).
16	Fraud detection and payment risk screening	Not high-risk. Annex III point 5(b) excludes fraud detection.	Merchant (deployer)	No AI Act date	GDPR Art. 22 if the system blocks customers automatically.
17	Credit checks for pay later, pay on invoice or consumer credit limits	High-risk (Annex III point 5(b)) when the system evaluates the creditworthiness of natural persons.	Provider (Art. 16) and deployer (Art. 26)	2 Dec 2027	Consumer Credit Directive 2 (includes BNPL) from 20 Nov 2026. GDPR Art. 22.
18	Credit limits for B2B buyers	Not Annex III for companies (legal persons). Sole traders are natural persons, so the high-risk rule can apply to them.	Merchant (deployer)	2 Dec 2027 (sole traders)	GDPR applies to data about sole traders.
19	Recruitment and HR screening for store, warehouse or service staff	High-risk (Annex III point 4).	Deployer (Art. 26)	2 Dec 2027	GDPR. Works council rules where they apply.
20	Emotion recognition from the voice or face of shoppers	Art. 50(3) notice now. High-risk (Annex III point 1(c)) from 2 Dec 2027. Text sentiment analysis is not emotion recognition.	Deployer	2 Aug 2026	GDPR rules for biometric data.
21	Emotion recognition of employees (warehouse, call centre)	Prohibited (Art. 5(1)(f)), except for medical or safety reasons.	Not permitted	2 Feb 2025	Labour law.
22	AI-personalized pressure tactics, for example false urgency aimed at vulnerable shoppers	Prohibited if it materially distorts behavior and causes significant harm (Art. 5(1)(a) and (b)).	Not permitted	2 Feb 2025	Unfair Commercial Practices Directive. DSA Art. 25 on dark patterns. Digital Fairness Act proposal.
23	Demand forecasting, inventory and delivery routing	Minimal risk.	Merchant (deployer)	No AI Act date	None specific.
24	Staff use of generative AI tools (marketing, service, catalog)	Art. 4: take measures that support the AI literacy of staff.	Merchant (deployer)	2 Feb 2025 (softened 27 Jul 2026)	Internal AI policy. GDPR for data put into tools.

DOWNLOAD THE TOOLKIT (XLSX) DOWNLOAD THE MATRIX (CSV)

The Elogic Commerce AI Act Ecommerce Matrix, version 1.0, law checked 25 September 2026. Free to reuse under CC BY 4.0 with a link to this page.

Article 50 for online stores: chatbots, AI images and AI text

Article 50 has four duties. Providers must build an AI notice into systems that talk with people and must mark generated content. Deployers must give notice of emotion recognition and must label deepfakes and certain AI text. All four apply since 2 August 2026.

Chatbots, shopping assistants and AI agents

The Commission FAQ gives four criteria. The notice duty applies when all four are true:

1. The system is an AI system.
2. It is designed for a real two-way exchange, not only for collecting data or giving fixed automated responses.
3. The AI itself communicates with the person, with no human intermediary.
4. The other side is a natural person: a consumer, a professional or another user.

The notice must appear from the start of the first interaction, in a clear and distinguishable way, and must meet accessibility requirements. The exception for obvious cases is narrow. The test is an average person who is reasonably well-informed, observant and careful. This also applies to what agentic commerce is: an AI agent that sells to shoppers needs the notice.

Example notices that meet the timing rule:

• Chat: You are chatting with the [Store] AI assistant. Ask for a person at any time.
• Voice: This is the [Store] AI voice assistant. Say agent to talk to a person.
• Agent: I am an AI shopping agent for [Store]. I can compare products and place orders that you confirm.

Put the notice in the first message and in the widget header. A notice only in the privacy policy or the terms is not sufficient.

AI-generated product images and video

The AI Act defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic. Objects are included, so product images are in scope. The Commission FAQ sets three cumulative criteria: resemblance, existence (real or plausible) and false appearance of authenticity. Context and audience expectations count.

Image type	Deepfake? (Elogic Commerce reading)	Action
Photoreal AI render of the real product, shown as the product photo	Likely yes	Visible label on or next to the image
Real product photo with an AI background of a room	Depends on context: the product is real, the scene is not	Decide per page template and record why
Synthetic human model wearing a real garment	Likely yes when realistic	Visible label
stylized illustration or physically impossible scene	No	No label. The tool provider still marks the file.
Retouching: dust removal, color correction, crop	Not generation	No label

The label must reach the shopper at first exposure, without special tools. The EU icon from the Code of Practice is one option. The deployer cannot rely on hidden metadata alone. Content generated before 2 August 2026 needs no retroactive label, but the Commission encourages it.

Elogic Commerce view

Treat the product page as the first exposure. Put the label in the gallery component, not in the footer, so it follows the image to category pages, search results and product feeds.

AI-written product descriptions and other text

The text label in Article 50(4) applies only to text that is published to inform the public on matters of public interest. The Commission list includes public health, environmental protection and consumer safety. Advertising and product text are outside this scope unless they make claims on health, consumer safety or sustainability (Lewis Silkin).

Human review removes the label duty. The review must check the substance of the text, and a person or company must hold editorial responsibility. A spell check or a grammar check is not sufficient.

From 27 September 2026, the EU green claims rules (ECGT) also ban vague environmental claims without evidence on product pages (Latham & Watkins).

Elogic Commerce view

Send every AI-written claim about health, safety or the environment to a named reviewer. One review step removes the label duty and the greenwashing risk at the same time.

Machine-readable marks: whose job?

Article 50(2) is a provider duty. The makers of image, video, audio and text tools must mark the output so that software can detect it. Tools on the market before 2 August 2026 have until 2 December 2026. The final guidelines treat translation as standard editing, so AI translation needs no mark, but AI summaries and substantive rewrites do (Faegre Drinker).

The store must not remove the marks. Google Merchant Center already requires the IPTC DigitalSourceType value trainedAlgorithmicMedia on AI-generated product images, and AI-generated titles and descriptions in separate attributes (Google Search Central). One small 2026 test of 60 Shopify product images found no IPTC AI tag and no C2PA manifest in any file (Sellarix). Test your own upload, resize, CDN and feed steps.

Emotion recognition and biometric categorization

If a store uses emotion recognition or biometric categorization on shoppers, for example voice sentiment analysis in a call centre, the store must tell the people exposed to it. Text sentiment analysis of chat messages is not emotion recognition, because it does not use biometric data. Emotion recognition of employees is prohibited, except for medical or safety reasons.

High-risk AI in ecommerce: what moved to December 2027

Few store systems are high-risk. The main cases are credit checks on natural persons, recruitment AI and emotion recognition. All three apply from 2 December 2027.

• Credit checks. AI that evaluates the creditworthiness of natural persons is high-risk (Annex III point 5(b)). A BNPL provider usually runs this check. A store that runs its own check, for example for pay on invoice, is a deployer of a high-risk system. See also agentic payments.
• Fraud detection is excluded from point 5(b). It is not high-risk.
• B2B credit. Credit limits for companies are outside point 5(b). Sole traders are natural persons, so checks on them can be inside it.
• Recruitment and HR AI for store, warehouse or service staff is high-risk (Annex III point 4).
• Emotion recognition of shoppers is high-risk (Annex III point 1(c)) and needs the Article 50(3) notice now.

From 2 December 2027, a deployer of a high-risk system must use it as instructed, assign human oversight to competent people, monitor it, keep its logs for at least six months and inform the people concerned. From 20 November 2026, the Consumer Credit Directive 2 also brings buy now, pay later into EU consumer credit law (European Parliament).

Elogic Commerce view

If you run your own pay-on-invoice scoring, start the inventory and the human review design now. December 2027 is only one replatforming cycle away.

Prohibited practices: where personalization stops

Normal personalization is allowed. Article 5 bans AI that uses manipulative or deceptive techniques, or that exploits vulnerabilities such as age, disability or economic situation, when it materially distorts behavior and causes significant harm. This applies since 2 February 2025, with fines up to EUR 35 million or 7% of worldwide turnover. Example: a system that detects financial distress and then targets that shopper with false urgency. The Digital Fairness Act proposal, expected in Q4 2026, targets dark patterns and unfair personalization directly (European Parliament).

Beyond the AI Act: GDPR, DSA and consumer law

For most store AI, other EU laws set more duties than the AI Act. Check them in the same review.

Topic	AI Act	Other EU law that also applies
Product recommendations	Minimal risk	GDPR Art. 21: shoppers can object to marketing profiling. DSA Art. 27: marketplaces explain the main parameters. DSA Art. 38: very large platforms offer an option without profiling (euai-act.com).
personalized prices	Minimal risk; Art. 5 limits	Consumer Rights Directive: tell the shopper that the price is personalized by automated decision-making. GDPR.
Search ranking	Minimal risk	Consumer law: marketplaces disclose the main ranking parameters.
Customer reviews	Art. 50(2) marks on AI summaries	Consumer law bans fake reviews and requires information on how reviews are checked.
AI-written green claims	Art. 50(4) label without human review	Green claims rules (ECGT) from 27 September 2026.
Credit checks	High-risk from 2 Dec 2027	Consumer Credit Directive 2 from 20 November 2026. GDPR Art. 22 on automated decisions.
Chatbot data	Art. 50(1) notice	GDPR. See our review of GDPR extensions for Magento 2. The notice must also be accessible.
A bot that pretends to be a person	Art. 50(1)	Unfair commercial practices law. In Germany, competitors can also act against misleading practices.

The EU AI Office is competent for AI systems integrated into very large online platforms under the DSA. Large marketplaces are in this group.

Platform checklists

The rules are the same on every platform. The places where you implement them are different.

Adobe Commerce (Magento) and Hyvä

• Check every chat and assistant extension. The extension vendor is often the provider, but the first-message text is usually set in the admin. Confirm it on the live store.
• Product Recommendations and Live Search rank products. They need no Article 50 notice. Record them in the inventory.
• Test the image pipeline end to end: upload an AI image with IPTC and C2PA data, then download it from the storefront and from the product feed. Adobe Firefly writes C2PA Content Credentials (Content Authenticity Initiative). Check that your resize and CDN steps keep them.
• On Hyvä theme work, add the AI label as a gallery component attribute, so it works on product, category and search templates. More on the platform: Adobe Commerce (Magento).

Shopify and Shopify Plus

• Shopify Magic and Sidekick help merchants create content in the admin. Sidekick talks to staff, not to shoppers, so it needs no shopper notice. Staff use falls under Article 4.
• Check the first message of every chat app, including AI agents from the App Store.
• In September 2026, merchants on the Shopify Community still asked for a built-in AI labeling tool (Shopify Community). Third-party apps fill the gap. A theme metafield and a gallery snippet also work.
• Test that the Shopify image CDN keeps the metadata you need for Google Merchant Center. See Shopify Plus development.

Salesforce Commerce Cloud and Agentforce

• Confirm that the welcome message of every customer-facing Agentforce agent says that it is an AI agent, in every storefront language.
• Einstein product recommendations rank products and need no notice. Record them in the inventory.
• Map where generated product content enters the catalog and who reviews health, safety or environmental claims. More: Salesforce Commerce Cloud and Salesforce Commerce Cloud consultants.

BigCommerce, Shopware and commercetools

• BigCommerce development: chat and AI content come from apps. Check each app’s first message and its image output.
• Shopware: AI text features create product descriptions. Route claims on health, safety or the environment to a reviewer.
• commercetools and other headless stacks: the merchant often builds the assistant. That makes the merchant the provider. Put the notice, the marks and the logs into the product backlog.

EU AI Act fines and enforcement

Article 99 sets three fine levels. For SMEs, the lower of the two amounts applies.

Breach	Maximum fine	Ecommerce example
Prohibited practices (Art. 5)	EUR 35 million or 7% of worldwide turnover	Manipulative targeting of vulnerable shoppers
Most operator duties, including Article 50 transparency	EUR 15 million or 3% of worldwide turnover	A chatbot with no AI notice. An unlabelled deepfake product image.
Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1% of worldwide turnover	Wrong answers to a market surveillance request

National market surveillance authorities enforce most rules (AI Act Service Desk, Article 99). The EU AI Office is competent for AI systems built on a general-purpose AI model by the same provider and for AI systems in very large online platforms.

EU AI Act compliance checklist for ecommerce

Use this order. It fixes the duties that already apply first. The Elogic Commerce AI Act Ecommerce Toolkit has a template for each step.

1. Make an inventory of every AI system: storefront, back office, marketing and service tools.
2. For each system, record the provider, the purpose, the data and the people it affects.
3. Mark your role for each system: provider or deployer.
4. Classify each system with the matrix: prohibited, high-risk, Article 50 or minimal risk.
5. Show the AI notice in the first message of every chatbot, assistant, voice agent and AI agent.
6. Run the deepfake test on AI product images and video. Add visible labels where needed.
7. Route AI-written claims on health, safety or the environment to a named reviewer.
8. Test that AI metadata survives upload, resize, CDN and feed export.
9. Send the vendor questionnaire to every AI vendor. Ask about marks, notices and logs.
10. Take measures that support the AI literacy of staff who use AI tools.
11. List any in-house credit checks on natural persons. Plan for the December 2027 rules.
12. Set a review date for each system and after each new EU guidance.

DOWNLOAD THE TOOLKIT (XLSX)

Eight claims about the EU AI Act that are wrong

These claims appear in widely read guides. Check them before you plan work.

Claim	Fact
The EU AI Act was delayed.	Only the high-risk rules moved. Article 50 applies since 2 August 2026.
Transparency failures cost up to EUR 7.5 million or 1%.	Article 50 breaches are in the EUR 15 million or 3% tier. The EUR 7.5 million tier is for incorrect information to authorities.
Every AI product description needs an AI label.	No. Only public-interest text without human review needs a label.
Every AI-edited image needs a label.	No. Only deepfakes need a visible label.
Our chatbot vendor covers all duties.	The vendor builds the notice and the marks. The store labels deepfakes and public-interest text and checks the live notice.
Fraud detection is high-risk AI.	No. Annex III point 5(b) excludes fraud detection.
Chatbots must keep logs for six months under the AI Act.	The six-month log rule is for deployers of high-risk systems, from December 2027.
A notice in the privacy policy is sufficient.	No. The notice must appear at the first interaction.

How Elogic Commerce helps

Elogic Commerce is an ecommerce engineering company, founded in 2009, with 200+ specialists and 500+ delivered projects. Elogic Commerce company-level compliance is ISO 27001 · SOC 2 Type II · ISO 9001. For the EU AI Act, Elogic Commerce does the implementation work that a legal opinion does not do:

• Makes the AI inventory of the store, the integrations and the back office, with the role for each system.
• Adds the Article 50 notice to assistants and AI agents, and checks that it is accessible.
• Builds the AI label into the product gallery and fixes the image and feed pipeline so that AI metadata survives.
• Adds the review step for AI-written claims in the catalog workflow.
• Designs human oversight and logging for in-house credit checks before December 2027.

Elogic Commerce works on Adobe Commerce, Shopify Plus, Salesforce Commerce Cloud, BigCommerce, Shopware and commercetools, for B2C and B2B stores. See AI solutions for ecommerce, Magento B2B agency and enterprise ecommerce development.

Sources

• Regulation (EU) 2024/1689 (AI Act), EUR-Lex
• European Commission: Transparency obligations under Article 50, FAQ, updated 24 July 2026
• European Commission: Guidelines on transparency of AI-generated content
• European Commission: Code of Practice on AI-generated content
• AI Act Service Desk: Article 50 and Article 99
• Eurostat: 20% of EU enterprises use AI technologies, December 2025
• Bundesnetzagentur: key role in the implementation of the AI Act, 29 July 2026
• European Parliament: Digital Fairness Act, legislative train
• Google Search Central: guidance on generative AI content

Download, reuse and cite

Cite this guide

Elogic Commerce (2026). EU AI Act for Ecommerce: What Applies Now, What Moved to 2027, and What to Do. https://elogic.co/blog/eu-ai-act-ecommerce/

You can reuse the Elogic Commerce AI Act Ecommerce Matrix, the figures and the toolkit under CC BY 4.0. Credit Elogic Commerce and link to this page.

Downloads: the Elogic Commerce AI Act Ecommerce Toolkit (XLSX, with the inventory template, the vendor questionnaire and the checklist) and the matrix (CSV).

Talk to Elogic Commerce

Do you need the AI notice, the image labels or the AI inventory in your store before the next review date? Talk to Elogic Commerce. We can start with a short review of the AI systems on your storefront, or with ecommerce consulting for the full stack.