The use of artificial intelligence (AI) in retail processes has become widespread and functions not only as a technical tool but as a decision‑support system with direct impact on daily operations. Systemic deployment of AI triggers a range of legal obligations: the European Parliament and Council Regulation (EU) 2024/1689 (13 June 2024) — the “AI Regulation” — sets out core rules, while data protection, consumer protection, civil law and employment rules also apply.
Operator vs. provider status and responsibility
Under the AI Regulation, a retail company that uses a third‑party AI system under its own supervision will typically be classified as an operator. Consumers are data subjects under Regulation (EU) 2016/679 (the “GDPR”); they enter into legal transactions with the retailer and provide personal data (from data necessary to conclude the transaction to browsing data generated on the retailer’s webshop).
AI developers acting as service providers must not be overlooked: they often grant access to their systems and may have access to processed data. The AI Regulation imposes specific obligations on providers that differ from those on operators. Status can vary by AI system: a company may be an operator for one system and a provider for another, and status can change over time if the operator makes interventions that effectively transform its role.
Overall, AI use requires compliance not only with the AI Regulation but also with consumer protection, civil, data protection and employment law regimes.
Marketing and personalized recommendations
AI used for marketing aims to influence consumer decisions through segmentation, predictive analytics, personalized recommendations and dynamic pricing. The AI Regulation expressly prohibits systems that use targeted manipulative or deceptive techniques that substantially impair a consumer’s ability to make an informed decision. Such targeted manipulation is objectively forbidden.
However, AI use is not per se unlawful: lawful deployment requires case‑by‑case assessment, taking into account the sensitivity of different consumer groups (for example, adult consumers versus under‑18s, or general household goods versus medical aids).
Because personalized recommendations and predictive analytics often involve profiling, retailers must provide GDPR‑compliant, clear advance information about the purpose and legal basis of data processing and about data subjects’ rights. If profiling leads to automated decision‑making that has legal or similarly significant effects on the individual, such decision‑making is generally prohibited and the data subject has the right to request human intervention.
Information duties should explain that AI produced the decision (or its essential part), describe the underlying logic and main selection criteria, and be given in language understandable to a lay consumer. Practically, AI‑use disclosures can be placed in a dedicated section of the terms and conditions or a separate AI notice, and processes must be in place to answer individual consumer inquiries — where human involvement in responses cannot be avoided.
Dynamic pricing algorithms and sector‑wide shared models may raise competition law issues and require separate legal analysis. AI systems that assess consumer creditworthiness or score consumers may qualify as high‑risk under the AI Regulation and trigger detailed disclosure obligations, including which main factors and data categories influenced the decision.
Chatbots, voice assistants and customer service
AI‑based chatbots, voice assistants and customer terminals are intended for direct consumer interaction. Under the AI Regulation, retailers must inform consumers in advance and clearly when they are not interacting with a human agent.
From a consumer protection perspective, it is essential that AI‑generated information is accurate, clear, up‑to‑date, logged and thus verifiable, particularly in matters of complaints handling, withdrawal or warranty claims. Erroneous responses by an AI system can create liability for the retailer; the company cannot escape responsibility by pointing to the AI or an external developer. Customer service AI systems must therefore ensure continuous human oversight and the possibility of human intervention (the “human in the loop” requirement).
Customer service AI often processes substantial personal data, including complaints and sometimes special categories of data. Retailers must provide GDPR‑required prior information, enable data subjects to exercise their rights, ensure secure logging and deletion of data, and ensure contractual and technical safeguards with external providers.
Customer service staff must continuously monitor AI outputs, manage escalations and avoid relying exclusively on automated responses in matters with legal consequences.
Logistics and supply chain
AI in logistics — demand forecasting, smart warehousing, route optimization, predictive maintenance — indirectly affects consumers through delivery times and service quality. If an AI failure prevents a retailer from meeting contractual deadlines or conditions, the retailer remains liable for late or defective performance.
Logistics AI systems typically contain personal data (delivery addresses, contact details), requiring data minimization, access controls and data security. Retailers must inform consumers about these data processing practices in delivery policies or privacy notices. When a subcontracting courier performs deliveries, the retailer must determine the courier’s role under the GDPR (e.g. data processor) and contractually ensure the processor handles only necessary data and deletes records appropriately. Because many courier models rely on AI platforms, the risk of data loss is higher and contracts and processes must reflect stronger safeguards.
Logistics personnel must be able to review AI forecasts and optimization proposals and intervene manually in case of anomalies; this requires appropriate AI literacy. Relevant sectors must also ensure compliance with NIS2, which intersects with AI and data handling requirements discussed here.
HR and finance systems
AI used in HR and finance (CV screening, performance measurement, time‑tracking, invoice processing, fraud detection) mainly impacts internal processes but carries significant data protection and compliance risks for retailers.
Invoice processing and supplier‑evaluation AI often operate on the entire supplier dataset; protecting supplier business secrets must be contractually and technically addressed with AI providers.
High‑risk AI is common in HR (performance evaluation, selection). Affected employees and applicants must be afforded the right to an explanation of individual decisions. Introducing high‑risk HR AI requires consultation with employee representatives, and certain monitoring practices — for example AI inferring emotions — are prohibited.
Transparency of automated decision logic must be documented and human review must be available to correct AI‑proposed outcomes where necessary.
Conclusions
Consistent AI use in retail can deliver substantial business advantages, but creates complex legal compliance obligations across multiple domains. The AI Regulation establishes baseline rules, yet retailers must also ensure consumer protection, data protection, employment‑related and competition‑law requirements are met. Responsible AI use is therefore a technological, organizational and legal challenge: it demands prior legal analysis, clear contractual arrangements, logging and transparency, and adequate AI training for personnel.
