AI Act and GDPR for e-commerce: how to adapt your online shop in 2026
If you run an online shop and already use AI to chat, recommend or price, you have new legal obligations. Here’s what affects you, what doesn’t, and how to adapt your e-commerce without slowing down your sales.
Published on · Updated on · 9 min read
There’s one detail that comes up in almost every SEO audit I do for online shops: legal texts haven’t been reviewed in years. And with the EU Artificial Intelligence Act now in force, that oversight is no longer just an image problem — it can cost you penalties.
But before you panic: the law isn’t designed to slow your business down. It’s designed so that the AI you already use — the chatbot, product recommendations, dynamic pricing — doesn’t become a legal problem or a trust problem for your customers.
In this article I explain what the law requires, which parts really affect you as an e-commerce, and how to adapt your shop step by step. If you’re starting from scratch, begin with what SEO is and why it remains the foundation of everything, because many of these decisions affect your visibility on Google.
What the AI Act changes for your e-commerce
For years, when a client asked for «a chatbot on the shop» or «personalised recommendations», the answer was purely technical: find the best tool, plug it in, make it work.
That era is over. The same integration now carries legal responsibilities that can’t be delegated to the tool or the provider. The final responsibility is yours.
Some concrete examples that are already enforceable:
- A chatbot that doesn’t tell the user they’re talking to an AI: transparency breach.
- A dynamic pricing system that charges more to users with old devices or certain postcodes: risk of algorithmic discrimination.
- An external API that sends customer data to servers outside the EU without safeguards: GDPR violation.
- A lead scoring or credit-granting system inside the marketplace: reinforced transparency and human oversight obligations.
What used to be «just another integration» is now a data processing activity regulated by two rules that apply at the same time.
The 4 risk levels and where your shop falls
The AI Act doesn’t ban innovation. It classifies each system according to its risk level and applies proportionate measures. Most online shops fall between two categories, but it’s worth knowing all four.
Unacceptable risk (prohibited)
These are uses banned outright in Europe. It’s very rare to find them in a normal e-commerce, but worth keeping in mind:
- Subliminal manipulation that exploits vulnerabilities (age, disability).
- Social scoring systems.
- Real-time biometric identification in public spaces.
- Facial recognition databases without consent.
- Assessing people based on sensitive characteristics to predict behaviour.
High risk
Not banned, but subject to very strict obligations: prior conformity assessment, continuous risk management, transparency in automated decisions, effective human oversight and documentary records.
In e-commerce they appear in specific cases: consumer credit granting, identity verification in marketplaces or automated seller selection. If your shop does any of this, this affects you.
Limited risk (where most shops fall)
This is the category for chatbots, product recommenders, synthetic content generators and emotion recognition systems. In other words: what almost every modern e-commerce has.
Main obligations:
- Transparency: the user must know they’re interacting with an AI («Hi, I’m an AI assistant powered by…»).
- Labelling: AI-generated content (like edited product images) must be labelled as such.
- Updated privacy policy explaining what data the AI uses, for what purpose and who processes it.
Minimal risk (everything else)
Internal search, basic recommendations, product filters. No heavy obligations, but transparency recommendations and best practices to avoid bias apply.
How GDPR fits with the AI Act
They’re not competing rules. They complement each other:
- GDPR protects personal data.
- The AI Act regulates how the systems that process that data are designed, trained and used.
And in e-commerce, almost all the AI you use processes personal data: purchase habits, browsing, preferences, interaction history. That’s why you have to comply with both at the same time.
The GDPR principles that AI makes more critical:
- Lawfulness, fairness and transparency: you need a valid legal basis and to explain the use.
- Minimisation: only the data strictly necessary for the purpose.
- Accuracy: AI makes mistakes, invents and biases. You must prevent that.
- Storage limitation: don’t keep data indefinitely «just in case».
- Integrity and confidentiality: protection against unauthorised access.
- Accountability: document everything and be able to demonstrate it.
If your AI processes personal data with high risk to people’s rights, you need a Data Protection Impact Assessment (DPIA) before deploying it. If not, you can move forward without one.
International transfers
This is one of the most common practical problems. Many popular AI providers have servers outside the EU. The EU-US Data Privacy Framework since 2023 helps, but it’s not automatic: it’s still your responsibility to verify that the provider complies and to document it.
In practice, this means: standard contractual clauses, impact assessments where applicable, and not assuming that because a tool is «popular» it automatically complies.
Mistakes a customer spots in 5 seconds
Legal texts aren’t a «fine-avoider». They’re trust signals that the user’s brain processes unconsciously before deciding whether to buy or not.
When a customer sees these details, they don’t reason step by step: they simply don’t buy.
- Generic or copy-pasted legal texts. «Is this website professional?».
- Broken links in the footer. «Can I trust leaving my card details here?».
- Mentions to the now-closed ODR platform. «This website hasn’t been updated in years».
- References to repealed laws. Same effect.
- Cookies with no real CMP. Banners with pre-ticked «Accept» and «Reject», or no option to configure.
There’s one detail that often gets overlooked: these mistakes don’t just affect conversion. They also show up at SEO level because they affect E-E-A-T: experience, authority and trust in Google. Google reads those signals the same way a user does: as indicators that the site is well maintained or abandoned.
Checklist to adapt your e-commerce
This is what I review when a client asks me for a combined technical and legal audit. You don’t have to do everything at once: you can go in phases.
Audit your website
Review legal texts, cookies, integrated AI features and automations already in place. Make a real list, not the one you think you have.
Update your legal texts
Remove references to repealed laws. Add a specific section about AI with the providers used and user rights. A well-written legal text is noticed in conversion.
Configure cookies and consent
Install a certified CMP (Cookiebot, Complianz, etc.). Classify cookies by purpose. Granular consent whenever there are multiple purposes. Document each consent.
Adapt chatbots and AI features
Clear notice to the user on the first message. Consent if it collects data. Verify where data is processed and with which provider. Keep anonymised logs.
Carry out a DPIA if risk is high
Only if your AI takes automated decisions with impact on people (credit, scoring, identity verification). In a normal e-commerce, it’s usually not necessary.
Document and monitor
Keep records for audits. Review every 6-12 months or when regulations change. This isn’t a project: it’s a process.
If your shop runs on WordPress, part of the work can be reused. For example, review the importance of WordPress maintenance and robots.txt and sitemap XML correctly configured, because both affect the legal side and visibility at the same time.
My practical recommendation: don’t try to comply with everything in one week. Start with legal texts and CMP (immediate impact on trust and conversion), then move on to chatbots and AI features, and leave documentation for last. With that, you’re already ahead of 90% of the shops in your sector.
Conclusion: the law doesn’t slow you down, it protects you
Adapting your e-commerce to the AI Act and GDPR isn’t an expense: it’s an investment in trust and scalability. A shop that respects the law sells more. It’s that simple.
Two ideas to take away:
- The regulation doesn’t require your AI to be perfect. It requires that it can’t harm your users or your reputation.
- Automation is a multiplier. Without legal control, it also multiplies your mistakes. Compliance is the rail that allows that speed to be safe.
If you want to dig deeper into how this affects your visibility in traditional search engines and in AI, take a look at the articles on Search Console and visibility in generative AI and the difference between SEO, GEO and AEO. The legal side and the SEO side are going to go hand in hand more and more.
Frequently asked questions
Does the AI Act force me to review my e-commerce even if I don’t use chatbots?
If you don’t use any AI features, the AI Act barely affects you. But GDPR does, and you probably already have analytics or advertising cookies that touch it. Also, tools like product recommenders or internal AI search count, even if you don’t see them as «AI».
How much could a penalty for breaching the AI Act cost?
The regulation sets penalties of up to €35 million or 7% of global annual turnover for the most serious breaches, and up to €15 million or 3% for less serious ones. In practice, most penalties will focus on high-risk cases, not on e-commerce chatbots.
Do I need to hire a DPO for using AI on my online shop?
Not just for using AI. The DPO (Data Protection Officer) is mandatory in specific cases: large-scale processing of sensitive data, systematic large-scale monitoring or when required by the supervisory authority. For a normal online shop, it’s usually not necessary.
Does this regulation also affect my visibility on Google and in AI?
Indirectly, yes. A shop with outdated legal texts, broken links or badly managed cookies sends abandonment signals that Google interprets as low quality. And AI models that generate answers tend to discard sources that look poorly maintained. Complying is also an E-E-A-T signal.
Do you want to review the legal and SEO side of your e-commerce?
I analyse your online shop and give you an action plan with the legal and technical points that should be resolved first.