AI in your shop: what applies since 2 August

Provider or deployer: which role you have

The AI Act assigns duties by role. A provider develops an AI system or has it developed and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. A shop is almost always a deployer, sometimes a provider as well.

• You use a ready-made chat tool or image generator as the maker supplies it: you are a deployer. The chatbot notice and the marking of images are the maker’s duty.
• You built your own chatbot or had an agency build it, and you run it in your shop under your name: according to the Commission, you are then a provider and must make sure the notice is there yourself.
• You take someone else’s AI system, modify it substantially, for example with your own training data, and run it under your name: you become a provider too.
• Your staff, freelancers or contractors work with AI on your behalf and under your control: you remain the deployer, not them.
• You commission an agency to make an ad and do not decide whether or how it uses AI: according to the Commission, you are not a deployer. The agency is.
• You create content as a creator regularly and for money: that is professional, not personal use. You are a deployer.

The chatbot notice

The Commission explicitly lists chatbots in e-commerce and customer support as cases where the notice is required. It reads the exception “it is obvious anyway” narrowly: it only applies when an average person has almost no doubt left. According to the guidelines, a chat window in a shop does not qualify.

According to the Commission, recommendations (“You might also like”), automatic translation and search that does not generate content are among the things not covered. If AI only helps your support staff write their replies, the AI does not talk to customers directly, so the chatbot notice does not apply.

1. 1

   Before the first reply

   The notice has to be there at the latest at the first interaction, clear and distinguishable. For example above the input field: “You are chatting with our AI assistant.”

2. 2

   Accessible

   The regulation requires the notice to meet accessibility requirements. So real text that screen readers can read, not just an icon.

3. 3

   Humans and AI mixed

   If sometimes a human answers and sometimes the AI, the AI answers have to be recognisable. Exception: a human properly reviews the answer and sends it themselves.

4. 4

   AI agents

   If an AI acts on your behalf, for example booking or negotiating, the guidelines say it should disclose that it is an AI and on whose behalf it acts.

AI images and video: when a notice is required

Not every AI image needs a label, only deepfakes. The AI Act means AI content that resembles real persons, objects, places or events and would falsely appear authentic. Objects are explicitly included, so your product counts too.

The Commission’s guidelines give advertising examples. A deepfake is an AI product image that shows the product differently, more appealing or of higher quality than it really is. So is a realistic AI influencer testing a real product, or a teleshopping-style video with synthetic customers. Not a deepfake: your real product in front of an AI background, as long as the image does not mislead about the product. Colour correction, a background swapped for purely aesthetic reasons, arranging real products or upscaling an image have, according to the Commission, little effect on how authentic the content appears.

Where a label is required, it has to be visible or audible, at the latest when someone first sees the content. The invisible marking in the file is not enough, the Commission says explicitly. And importantly: the notice does not make a misleading product image legal. If an image shows your product as better than it is, that is still misleading advertising.

AI text in your shop

For text, there is only one labelling duty: published text meant to inform the public on matters of public interest, such as health, the environment or consumer safety. The Commission explicitly names product descriptions and ad copy as an example that is not covered, except for claims related to health, consumer safety or sustainability, for example.

The duty does not apply when a knowledgeable person reviews the content and someone holds editorial responsibility. According to the Commission, spell-checking does not count as review.

What does not apply to you right now

• Machine-readable marking (Article 50(2)) is a duty of the AI tool providers, not of the shops using them. For tools already on the market before 2 August 2026, the Digital Omnibus moved it to 2 December 2026.
• Content created before 2 August 2026 does not need to be labelled retroactively. The Commission does encourage it.
• The strict rules for high-risk AI, which include AI for credit scoring of individuals, only apply from 2 December 2027 under the Digital Omnibus.
• The Digital Omnibus softened the AI literacy duty (Article 4): providers and deployers must take measures to support the AI literacy of their staff. Nobody has to guarantee a specific level.
• Purely personal use of AI is outside the AI Act. That ends once you earn money with it on a regular basis.