EU AI Act for Shopify Sellers: What Applies to You

Your EU orders still come in and nothing in your admin has changed. But you have read that an AI chatbot now needs a disclosure, and meanwhile the descriptions on half your catalogue — and a fair number of the photographs — were made by a generator.

That is the EU AI Act, and the date everything was counting down to is behind you: the transparency rules in Article 50 have applied since 2 August 2026. Guidance written before that date and never updated still tells you to get ready. There is nothing left to prepare for. There is a check to run.

This is an operational triage, not legal advice. The Act splits its duties by role, and most of what a store owner reads about Article 50 belongs to the provider of the AI system rather than to the merchant who switched it on. What follows is which role you are in, whether the Act reaches your store at all, which of your AI surfaces owes anything, and what to do about the one that usually does.

The Quick Verdict

Find the thing running on your store in the left column. Everything after this table is the reasoning underneath it.

Did the EU AI Act Deadline Already Pass?

The Act did not switch on all at once. Article 113 sets a general date and then names four exceptions to it, and reading those four is what settles the question for transparency: none of them mentions Chapter IV, which is the chapter physically titled Transparency obligations for providers and deployers of certain AI systems and containing Article 50. So the general rule governs, and the general rule reads “It shall apply from 2 August 2026.”

That matters more than a date usually does, because the shape of the advice around this topic was set before it. A page telling a merchant to prepare for the AI Act is describing a world that ended in the first week of August 2026. The useful question now is not what is coming; it is which of the duties already running touch a store at all.

Are You a Deployer or a Provider?

Every duty in Article 50 is addressed to one of two roles, and the whole article becomes readable once you know which one is yours. The definitions are short, and the second one contains the only exception that could take a shop out of it.

The exception in the second definition is the one people hope will save them, and it does not: a store is a commercial activity, not a personal non-professional one. The Commission puts the same test in plainer terms, writing that where an activity earns an economic benefit on a regular basis, or otherwise forms part of a business, trade, occupational or freelance activity, it is professional — and the person running it is a deployer of that AI system.

Notice what the table does not contain: a row for “online shop”. That is not an omission on our side. No wording we found in the articles of the regulation names an online seller, a retailer, an e-commerce operator or a merchant at all — the closest the text comes is Recital 16, which mentions filters used on online marketplaces and is preamble rather than binding text. The regulation works entirely in the two roles above, and so does the Commission's own Article 50 page, which as we read it mentions neither e-commerce, nor an online store, nor a retailer, nor a merchant. The surfaces we read and the terms we searched are listed in the box further down. The practical consequence is that a store never finds itself named; it finds itself in a definition.

Does It Reach a Store Outside the EU?

Article 2(1) lists seven categories the regulation applies to, and a shop acting as a deployer appears in that list twice — once for a business established inside the Union, once for one outside it. The two entries are a sentence each, and the whole difference between them sits in the clause that ends the second.

If your business is established or located inside the Union, subparagraph (b) applies with no further condition attached. If it sits outside, subparagraph (c) is the entry that reaches you, and its condition is written into the sentence: it points at the output rather than at the company, so what matters is where what the system produces ends up being used. One case sits outside both deployer entries: if the own-brand question at the top of this page put you on the provider side, subparagraph (a) reaches providers placing on the market or putting into service AI systems in the Union, irrespective of whether they are established or located within the Union or in a third country.

Recital 22, which is preamble rather than binding text, gives the reason plainly — the drafters wanted to prevent circumvention of the regulation and to protect natural persons located in the Union. Read that way, the clause at the end of subparagraph (c) is doing exactly the job it was written for.

The same article closes the personal-use door a second time: Article 2(10) says the regulation does not apply to the obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity, which is the scope-level twin of the definition above. Where your own configuration sits close to the line drawn by subparagraph (c), that is the point to put the question to your own lawyer rather than to an article — it is the one judgement on this page that turns on the specifics of your business rather than on the text.

What Article 50 Actually Asks of a Deployer

This is the sentence the whole article turns on, so it is worth taking from the European Commission rather than from us. Asked which transparency duties fall to deployers, the Commission answers with a list of two items — and the two obligations most merchants worry about are not on it.

Read that against a normal storefront and the list gets shorter still. Emotion recognition and biometric categorisation are a class of system, not a description of a chat widget. Deepfake labelling is about content that would pass for real. And the text limb carries its own qualifier — published on matters of public interest — which a product description does not meet, for reasons the section below spells out.

One boundary belongs here rather than at the end, because it is the most common way this article gets over-read. Paragraph 6 says in terms that paragraphs 1 to 4 do not affect the requirements and obligations set out in Chapter III and are without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems. A short list under Article 50 is not a short list under the Act, and it says nothing at all about the rest of the law you already operate under.

How the Disclosure Has to Appear

Paragraph 5 governs the information required by paragraphs 1 to 4 alike, and it is short enough to quote in full: the information must be provided “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”, and it “shall conform to the applicable accessibility requirements”.

Two words in that sentence do the work. Exposure is what makes an image different from a chat: a shopper is exposed to a picture the moment the page renders, without clicking anything, so a disclosure that waits behind a tab or a link is already late. And accessibility rules out the tempting shortcut of baking the notice into the image itself as pixels, where a screen reader cannot reach it.

Which of Your AI Surfaces Owes Anything?

A working store rarely has one AI surface. It has a chat widget, a generator that wrote half the catalogue, maybe an image tool, and a couple of apps whose AI nobody thinks about. Each is a different answer, and the differences come from the role split above rather than from how advanced the tool is. If you are still mapping what your platform's own AI does and where it sits in the admin, our guide to where Shopify's AI lives in your admin covers that inventory in one section; this page picks the story up at the legal duty.

The chat widget on your storefront

This is the duty every article about the AI Act mentions and almost none attributes. It is the first paragraph of Article 50, and its first word decides who it is for.

Two things follow that are easy to miss. The obligation is about how the system is designed and developed, which is not something a merchant does to a third-party widget, and it carries an unless it is obvious exception judged from the point of view of a reasonably well-informed and observant person. A bot introduced on the page as an AI assistant is in a different position from one that opens with a human first name and no context.

The Commission's own Article 50 page narrows the trigger further, saying its Guidelines on Transparency of AI-Generated Content set out four cumulative criteria for when this obligation applies at all. Cumulative means every one of them has to be met, so it is worth checking your widget against the whole set rather than the first line.

AI-written product and collection copy

This is the question that brings most merchants to the topic, and the answer sits in a qualifier rather than in an exemption. The second subparagraph of paragraph 4 describes a narrow kind of publishing, and the qualifier is doing all of the work.

A product description is published to sell a product. A collection page is published to sell a category of products. Neither is published with the purpose of informing the public on a matter of public interest, so the duty in that subparagraph does not attach to them — and the editorial-control carve-out below it never comes into play, because you never got past the first condition. Where a store genuinely does publish something of a different kind, the qualifier is the thing to weigh, not the fact that AI was involved.

There is a second text duty in the Act, and it is the one people half-remember. Paragraph 2 requires that the outputs of a generative system be marked in a machine-readable format and detectable as artificially generated or manipulated — but it opens with “Providers of AI systems”, so it is a duty on whoever built the generator. It is a good question to put to a vendor and a bad one to try to answer yourself with a line of theme code.

AI-generated or AI-edited imagery

The first subparagraph of paragraph 4 reads: “Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated.” Unlike paragraph 1, that sentence starts with deployers, which is you. Everything then depends on what the Act means by a deep fake — and it defines the term itself, in Article 3(60), as “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful”.

Most commentary reads that definition as being about faces and politicians. The word objects is in the list too, and a product is an object. That does not make every generated image a deep fake — the definition has more than one test, and the second one is about whether a viewer would take it for real. Running the definition as a checklist over your own catalogue is more useful than arguing about the term.

The preamble points the same way. Recital 134 — interpretive rather than binding — says deployers who use an AI system to generate or manipulate image, audio or video content that appreciably resembles existing persons, objects, places, entities or events, and would falsely appear authentic, should clearly and distinguishably disclose the artificial origin by labelling the output accordingly. The practical reading for a catalogue: a stylised render nobody would mistake for a photograph is a different case from a generated studio shot of a product that does not exist in that form. One boundary applies to the back catalogue: the Commission states that content generated prior to 2 August 2026 does not need to be labelled retroactively, though it encourages deployers to label it where possible — so the assets to sort first are the ones a generator made from August 2026 onwards.

Tools that read emotion or sort people

Paragraph 3 says: “Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable.” The duty is triggered by the class of system, not by how the vendor markets it, which is why this is a question to answer from documentation rather than from a feature list.

One boundary sits inside the definition rather than in the paragraph. Article 3(40) defines a biometric categorisation system as one assigning natural persons to specific categories on the basis of their biometric data, “unless it is ancillary to another commercial service and strictly necessary for objective technical reasons” — and Recital 16, which is preamble, gives filters categorising facial or body features used on online marketplaces as a feature that could constitute such an ancillary one, because they can be used only in relation to the principal service of selling a product. Emotion recognition carries no equivalent carve-out.

For most catalogues nothing here fires, and that is a fair thing to conclude — a text generator and a support chatbot are not systems of this class by their own description. It is still the paragraph worth checking deliberately rather than assuming, because unlike the content duties it does not depend on anything a shopper can see, and an app can acquire a feature between one release and the next.

Which Move Comes First for Your Store?

The table at the top answers by surface — what each AI thing owes on its own. This answers by situation, because a real store runs several of them at once and they do not all deserve the same Tuesday. Five questions, and the result is the first move rather than a grade.

What to Ask the Vendor Behind Your AI

Once the role split is clear, most of your Article 50 exposure turns into procurement rather than compliance work. You are not being asked to build anything; you are being asked to know who built what, and to notice when a supplier cannot answer.

The second question is the only one you can verify without the vendor, and it takes a minute: open your own storefront in a browser that has never used the widget, and read the first thing it says. A silent opening line is not proof of a breach — the unless it is obvious exception exists — but the Commission says that exception should be interpreted in a restrictive manner, given that it deprives people of transparency, so a silent widget is a fair reason to ask the supplier what position they take and why.

What Shopify Publishes About Article 50

This is worth stating plainly, because the absence changes what you should do. No official Shopify page we have found describes a store's obligations under Article 50 — what a search-engine query restricted to its help centre and main site returned instead was third-party app listings and a community post by an outside developer. That is not a criticism of the documentation; the duty the Act writes for a merchant is small and mostly not platform-specific, so there is little for a platform to document.

What Getting the Role Wrong Costs

Penalties under the Act are graded by which provision was broken. For the transparency obligations of providers and deployers under Article 50, the regulation sets administrative fines of up to 15 million euro or 3% of worldwide annual turnover — and the regulation's own wording adds two qualifiers that matter: the percentage applies where the offender is an undertaking and is measured on the preceding financial year, and the authority takes whichever of the two figures is higher.

Read it as a ceiling for the worst case rather than as a price list, because that is what an up to figure is. For a small store the arithmetic then runs the other way. Article 99(6) says that in the case of SMEs, including start-ups, each fine is up to whichever of those two figures is lower, and the Commission adds that proportionality can be taken into account for small and medium sized enterprises and small mid-cap companies. Neither of those is an exemption or a discount: the first decides which of the two figures the maximum is read from, and the second is something an authority may weigh afterwards. The ceiling's real use to a small store is proportion — it explains why the role question at the top of this page deserves a couple of hours and a written answer, rather than a shrug and a disclaimer copied from someone else's footer.

Your Article 50 Triage

Steps one and two are the same for everyone and they are the ones worth doing this week. After that the order bends to your situation: if the quiz put you on the imagery route, step four is the one that decides your workload, so do it before step three. If your chat is the only thing missing a line, step three is a five-minute job and the rest is an email.

What This Doesn't Cover

The risk with a page like this one is that a narrow answer gets read as a wide one. Article 50 is a transparency article about certain AI systems; it is not the Act, and the Act is not the whole of the law that reaches a store selling into the EU.

The two regimes at the bottom of that table come up constantly for the same reader, because they land on the same parcel and get filed as one pile of EU paperwork. Packaging extended producer responsibility makes whoever first places packaging on a national market pay for its collection and recycling — our guide to EU packaging rules for Shopify sellers owns that topic.

Product safety asks who inside the EU answers for the product itself and what a listing has to show before the sale, which is the subject of our guide to GPSR for Shopify sellers. Neither packaging nor product safety is discharged by anything you do for Article 50, and Article 50 is not discharged by anything you do for them.

The Bottom Line

The reason this topic feels heavier than it is comes down to how the advice around it is written: addressed to the owner of the storefront, in the second person, without ever saying which role the duty belongs to. Once Article 50 is read in its own terms, the store is a deployer, the deployer's list under that article has two items on it, and one of those two almost never applies to a shop.

Frequently Asked Questions