EU AI Act risk categories: where ecommerce AI systems fall

The EU AI Act creates a four-tier classification system for AI systems. The tier your AI system falls into determines what you must do: nothing, disclose, assess or prohibit. For ecommerce merchants and the platforms they use, knowing where each AI tool lands is now a compliance requirement.

The Act applies to deployers, not just providers. If you use an AI system in your store, even one built by a third-party vendor, you carry obligations as the deployer. This matters significantly for mid-market merchants who rely heavily on AI-powered apps. Our EU AI Act transparency guide covers the full scope of these deployer obligations.

The four risk tiers: a summary

The EU AI Act organizes AI systems into four categories based on the risk they pose to health, safety and fundamental rights:

• Unacceptable risk: prohibited. These AI systems are banned outright. They cannot be deployed in the EU. Examples: social scoring systems, real-time remote biometric identification in public spaces, AI that exploits psychological vulnerabilities.
• High risk: regulated with heavy obligations. These systems can be deployed but only with conformity assessments, registration in the EU database, ongoing monitoring and human oversight. Examples: biometric identification, credit scoring, employment AI.
• Limited risk: transparency obligations only. These systems must inform users they are interacting with AI, or that content is AI-generated. The compliance cost is relatively low. Examples: chatbots, AI-generated content systems.
• Minimal risk: no specific obligations. The vast majority of AI applications fall here. Spam filters, AI-powered search suggestions, inventory forecasting. No additional compliance requirements.

Ecommerce chatbots and virtual assistants: limited risk

Customer service chatbots, product recommendation chatbots and virtual shopping assistants are classified as limited-risk AI systems under Article 52. See our detailed guide on AI chatbot compliance requirements for implementation specifics. The obligation is transparency: users must be informed they are interacting with an AI, not a human.

The disclosure must happen at the start of the interaction. It must be clear and unambiguous. A small "AI assistant" label in the chat interface is generally sufficient. The user does not need to consent, but they must be informed.

There is an exception: if it is "obvious from context" that the user is interacting with an AI, disclosure is not required. A clearly robotic chat interface with an avatar named "ShopBot" might qualify. But vague chat interfaces designed to look like human customer service do not qualify for this exception.

Enforcement timeline: Article 52 obligations for limited-risk systems apply from August 2026. Merchants using AI chatbots should audit their implementations now.

Recommendation engines: where they fall

Product recommendation engines, "customers also bought" systems and personalized homepage sorting algorithms are generally classified as minimal risk. There is no specific EU AI Act obligation for these systems beyond good governance practices. For a deeper look at what transparency is expected, see our guide on AI product recommendation transparency.

However, the classification can shift depending on implementation. A recommendation engine that uses sensitive personal data categories (health status, religion, political views) to make recommendations may face additional constraints under GDPR, even if not under the AI Act specifically.

Dynamic pricing algorithms are also generally minimal risk unless they can be shown to discriminate based on protected characteristics. Our guide on AI dynamic pricing legality covers the legal boundaries in detail. An algorithm that charges higher prices to users in lower-income zip codes could trigger high-risk classification under the "unfair treatment" provisions.

Fraud detection: potentially high risk

This is where ecommerce merchants need to pay close attention. AI fraud detection systems that make or significantly influence decisions about whether to accept a transaction, cancel an order or block an account may fall into the high-risk category.

Annex III of the EU AI Act lists high-risk systems. One of the categories is AI used to evaluate the creditworthiness of natural persons or to establish their credit score. A fraud detection system that assigns a risk score to a customer and blocks their purchase based on that score has functional similarities to credit scoring.

The European AI Office has signaled that fraud detection systems used in "law enforcement" contexts are clearly high-risk. Commercial fraud detection is more ambiguous. The key factors: does the system significantly affect the individual's access to services? Does it use biometric or behavioral data? Is the decision automated without meaningful human review?

If you use a third-party fraud detection tool that automatically blocks orders or customer accounts, obtain the provider's AI Act compliance documentation. They may have already completed a conformity assessment. If they have not, you need to understand whether you carry that obligation as the deployer.

Biometric identification: high risk or prohibited

Biometric identification in ecommerce is rare but growing. Age verification using facial analysis, "try on" features using real-time facial mapping and frictionless checkout using face recognition all involve biometric data.

Remote biometric identification systems used in real-time in publicly accessible spaces are prohibited. An ecommerce website is not a public physical space, so this prohibition does not directly apply to online stores. But post-remote biometric identification (processing stored biometric data) is high-risk.

Age verification using AI analysis of facial features, a common use case for stores selling age-restricted products, is high-risk. This means conformity assessment, registration in the EU AI database, human oversight and documentation requirements all apply.

Stores using these features through third-party providers (Yoti, Veriff and similar) should request compliance documentation from their providers. The provider may handle the conformity assessment, but deployers retain obligations.

Credit scoring and buy-now-pay-later: high risk

Buy-now-pay-later (BNPL) integrations are standard on mid-market ecommerce stores. Klarna, Afterpay, Affirm and similar providers use AI to assess creditworthiness in real time and decide whether to offer financing.

These systems are unambiguously high-risk under the EU AI Act. They are covered explicitly in Annex III. The BNPL provider, as the AI system provider, bears the primary compliance obligation. They must complete a conformity assessment, register the system and maintain technical documentation.

As the deployer (the merchant integrating BNPL into their checkout), you have obligations too: use the system according to the provider's instructions, implement human oversight mechanisms and cooperate with monitoring requirements. In practice, this means ensuring you have a complaints process for customers who are denied financing and that you can escalate to the provider.

Employment AI: high risk with HR implications

Ecommerce companies with warehouse operations, customer service teams and logistics functions often use AI for workforce management. Scheduling algorithms, performance monitoring AI, recruitment AI and productivity tracking tools all potentially fall into the high-risk employment AI category.

The EU AI Act treats AI used in employment contexts with particular care because of the power imbalance between employer and employee. Systems that monitor worker productivity in real time, score employee performance using AI or automate HR decisions are high-risk.

This affects ecommerce operations more than pure-play online retail. If your business includes a warehouse with AI-powered pick-pack-ship optimization that also monitors worker productivity, you have a high-risk AI system deployed. Conformity assessment and human oversight requirements apply.

Conformity assessment: what high-risk systems require

For high-risk AI systems, the EU AI Act requires conformity assessment before the system is placed on the market or put into service. The assessment must cover:

• Risk management system. Documentation of risks identified, mitigations implemented and residual risks accepted.
• Data governance. Training data quality, data provenance and bias assessment.
• Technical documentation. System architecture, capabilities, limitations and intended purpose.
• Logging and record-keeping. Automatic logging of system operations to enable post-deployment audit.
• Transparency to users. Information provided to users about how the system works and its limitations.
• Human oversight. Measures to ensure humans can monitor, intervene and override the system.
• Accuracy, robustness and cybersecurity. Demonstrated performance standards and security measures.

Most merchants will not build high-risk AI systems themselves. They will deploy them through vendors. The critical task is ensuring your vendors have completed conformity assessments and can provide the required documentation.

Self-assessment for limited-risk systems

For limited-risk systems (chatbots, AI-generated content), the compliance path is simpler. No third-party conformity assessment is required. Self-assessment is sufficient. This means:

• Documenting which AI systems you deploy and their purpose.
• Confirming they fall in the limited-risk category based on their function and context.
• Implementing the required transparency disclosures (AI chatbot labels, AI content labels).
• Maintaining records of the AI systems used and the disclosure implementation.

Timeline: when obligations apply

The EU AI Act's implementation is phased. The key dates for ecommerce merchants:

• February 2025. Prohibited AI systems: the unacceptable risk prohibitions applied immediately. Any real-time biometric identification in public spaces, social scoring systems or psychological manipulation AI must already be off.
• August 2025. GPAI (general-purpose AI) model obligations: providers of large AI models (like GPT-4 or Claude) must comply with transparency and documentation requirements.
• August 2026. Limited-risk transparency obligations: chatbot disclosures, AI content labeling. This is the deadline most ecommerce merchants need to hit.
• August 2027. High-risk system obligations: full conformity assessment requirements for high-risk AI systems deployed in ecommerce.

Penalties by tier

The EU AI Act has three penalty tiers:

• Prohibited systems violations: up to 35 million euros or 7% of global annual turnover. Deploying a prohibited AI system is the most serious violation.
• High-risk system violations: up to 15 million euros or 3% of global annual turnover. Non-compliance with obligations for high-risk systems: failing conformity assessment, inadequate documentation, no human oversight.
• Other violations (including transparency): up to 7.5 million euros or 1.5% of global annual turnover. This covers limited-risk transparency failures: not labeling AI chatbots, not disclosing AI-generated content.

A practical risk assessment framework for ecommerce

A structured approach for mid-market merchants:

• Step 1: inventory your AI systems. List every AI-powered tool in your stack. Include third-party apps in your ecommerce platform's app store. Many apps use AI without advertising it prominently.
• Step 2: classify each system. For each system, determine the risk tier based on its function. Chatbots: limited risk. Product recommendations: minimal risk. Fraud detection: assess carefully. Biometric features: high risk.
• Step 3: request vendor documentation. For any high-risk system, request the vendor's conformity assessment documentation. If they cannot provide it, that is a compliance risk for you as the deployer.
• Step 4: implement disclosures. For limited-risk systems (chatbots, AI content), implement the required transparency labels by August 2026.
• Step 5: document your assessment. Keep a record of your AI system inventory, classifications and compliance steps taken. This is your evidence if regulators come asking.

Frequently asked questions

What risk category do ecommerce chatbots fall under in the EU AI Act?

Most ecommerce chatbots are classified as limited-risk AI systems under the EU AI Act. This means they must comply with Article 50 transparency obligations, primarily disclosing to users that they are interacting with an AI.

Is fraud detection high risk under the EU AI Act?

AI fraud detection systems that automatically block orders or accounts may fall into the high-risk category, especially if they significantly affect a consumer's access to services. Merchants should request conformity assessment documentation from their fraud detection vendors.

Are product recommendation engines regulated by the EU AI Act?

Most product recommendation engines are classified as minimal risk and have no specific EU AI Act obligations. However, if they use sensitive personal data or produce discriminatory outcomes, additional constraints may apply.

What is the penalty for deploying a prohibited AI system?

Deploying a prohibited AI system under the EU AI Act can result in fines up to 35 million euros or 7% of global annual turnover. Prohibited systems include social scoring and real-time biometric surveillance in public spaces.