EU AI Act: What E-commerce Teams Need to Know

What the transparency and labelling rules mean for your store's content and for your brand.

Note: information verified up to 25 September 2026. This article is informational and does not replace legal advice.

E-commerce teams were among the first to adopt generative AI at scale: product descriptions, catalogue images, social media videos, emails, ads and shopping assistants.

Since 2 August 2026, the transparency rules of Article 50 of the EU AI Act (Regulation (EU) 2024/1689) apply. The Digital Omnibus on AI, Regulation (EU) 2026/1744, delayed parts of the high-risk regime, but it did not delay these obligations.

There is, however, a lot of oversimplified information going around. The most common version is: "from now on, all AI content has to be labelled". That is not what the regulation says.

For an e-commerce team, the useful question is a different one:

What content are we using, who generated it, does it look authentic, and who is accountable for it?

What Article 50 requires, in four situations

1. Chatbots and shopping assistants

When a customer interacts directly with an AI system, they must be informed that they are talking to AI, unless that is obvious to a reasonably well informed and observant person.

The information must appear at the latest at the first interaction. A visible line at the start of the conversation is usually enough:

"You are chatting with an AI assistant."

In practice:

• do not give the assistant a name and a photo that suggest a human employee without clarifying that it is AI;
• do not hide the information in the terms and conditions;
• define when the conversation moves to a real person, and make that clear.

This obligation falls mostly on the provider of the system, but it is the store that decides how the assistant presents itself to the customer. Check with your provider what is already implemented.

2. AI-generated images, video and audio

Providers of systems that generate or manipulate image, video, audio or text must mark the outputs in a machine-readable format, so they are detectable as artificially generated or manipulated, to the extent that this is technically feasible.

This obligation belongs to the tool provider. But your team's process can undo it.

Many content production flows strip metadata by default: exporting, compressing, cropping, converting format, uploading to a platform. If the tool applied a technical marking and your process erases it, you are destroying the very mechanism that exists to comply with the law.

Questions to ask your providers:

• Does the tool apply machine-readable marking?
• Which standard or technology does it use?
• Which steps in our flow can remove that marking?
• How do we check that it survived until publication?

3. Deepfakes

Anyone publishing image, audio or video generated or manipulated by AI that resembles real people, objects, places or events, and appears authentic, must disclose that the content was generated or manipulated.

In e-commerce, this has very concrete applications:

• synthetic models wearing or using products, presented as real photographs;
• AI-generated "customer" videos recommending a product;
• the founder's voice or face saying things they never recorded;
• environments or scenes that look like real photos of a store, factory or event;
• generated product demos that look like real recordings.

Here the responsibility lies with whoever publishes: the store or the brand.

For clearly artistic, satirical or fictional content, disclosure can be made in a way appropriate to the context, without ruining the work. But a product ad rarely fits that category.

4. Text on matters of public interest

Text generated or manipulated by AI and published to inform the public on matters of public interest must be identified as such, except where there was human review or editorial control and someone takes editorial responsibility for the publication.

A brand blog publishing informational articles (health, sustainability, personal finance, product safety) should have a real editorial process and an identifiable owner. A superficial review is not the same as editorial control.

And what about product descriptions?

This is the point that causes the most confusion.

A commercial product description is not, as a rule, a publication on a matter of public interest. Article 50 does not impose a "made by AI" label on every product page.

That does not mean anything goes. Descriptions and images remain subject to consumer protection and misleading advertising rules. AI-generated content:

• cannot attribute features to a product that it does not have;
• cannot invent certifications, materials, measurements or results;
• cannot show a product in a way that does not match what the customer will receive;
• cannot invent reviews or testimonials.

The most common risk in e-commerce is not a missing label. It is mass-generated text with a false claim that nobody reviewed.

Common situations in an online store

The brand is the asset at stake

The fines in the AI Act are significant: they can reach 15 million euros or 3% of worldwide turnover for several infringements, with higher caps for prohibited practices. For SMEs, Article 99 provides that the lower of the relevant caps applies.

But in e-commerce the most immediate risk is a different one: customer trust.

A customer who finds out the "happy customer" in the video does not exist, or that the item they received looks nothing like the photo, does not need to know the AI Act to stop buying.

Transparency done well is not a defensive label. It is part of the brand's promise.

A simple process for the content team

1. Inventory

List every AI tool the team uses, including personal and free accounts, and what each is for: text, image, video, voice, chatbot, recommendations.

2. Classify each type of content

For each format, ask:

• Is it a direct interaction with the customer?
• Is it synthetic image, video or audio?
• Does it look real? Does it depict a real person, place, event or product?
• Is it informational text on a matter of public interest?
• Could it mislead the consumer about the product?

3. Define disclosure rules

Write a short guide with examples: where and how disclosure appears in videos, images, carousels, product pages and the chatbot. Use clear, consistent language.

4. Protect the technical marking

Review the export and publishing flow so it does not strip metadata or provenance markings unnecessarily.

5. Human review with criteria

Define what always gets human review: product claims, measurements, materials, prices, health, safety, sustainability and any content featuring people.

6. Non-negotiable rules

• No invented testimonials or reviews;
• No synthetic "customers" presented as real;
• No generated demos presented as real recordings;
• No images that alter the product in a misleading way.

7. Record decisions

For each campaign, keep a record of which tools were used, who reviewed the work and what disclosure was applied. If anyone asks, the team can answer with evidence.

Where Painstack fits in

Many teams use AI to produce more content, faster. The question they rarely ask first is: which customer problem does this content solve?

Painstack helps at that earlier layer: gathering market signals, understanding customers' real questions and objections, and validating which messages and products have evidence behind them, before generating dozens of AI variations.

That has a practical effect on transparency: content built from real problems needs fewer exaggerations, invented testimonials or fabricated demos.

Painstack is not a compliance tool and does not replace legal advice. It helps decide what is worth saying and building, based on evidence.

Conclusion

For e-commerce teams, Article 50 comes down to four ideas:

1. Chatbots must say they are AI;
2. Synthetic content must keep the technical marking applied by the tools;
3. Deepfakes, including synthetic models, customers and voices that look real, must be disclosed;
4. Informational text of public interest needs disclosure or real editorial control.

And a fifth one, which does not come from the AI Act but still applies: none of this authorises misleading content.

AI can help you sell better. But customer trust still depends on them receiving what they saw.

Official sources

• Regulation (EU) 2024/1689 — EU AI Act
• Consolidated text of the AI Act after the 2026 amendments
• Regulation (EU) 2026/1744 — Digital Omnibus on AI
• Article 50 — Transparency obligations
• European Commission: enforcement from 2 August 2026
• Guidelines on Transparency of AI-generated Content
• Code of Practice on Transparency of AI-generated Content
• Painstack