The EU AI Act is a retail data problem, not a legal challenge

Today, Mark Howell, Director Retailers EMEA at Rithum takes a look at the EU AI Act to explain why this isn’t just one for your legal team, but a retail data problem that impacts the entire business: Nobody’s running scared, yet. E-commerce as a whole is sleepwalking into the EU AI Act.

Everyone is holding their breath, waiting to see who gets enforced against first. It’s GDPR all over again – nobody was really sure how it was going to work, and nobody could credibly claim to be an expert. That said, the industry is making a catastrophic mistake by treating it as someone else’s problem to solve later.

The challenge isn’t primarily a legal one. It’s a data problem, a process problem, and frankly a people problem. Starting to build the governance foundations now – rather than waiting for an enforcement deadline – is simply less painful than doing it under pressure.

The transparency requirement nobody’s prepared for When people talk about the EU AI Act in the context of retail, the conversation tends to go straight to legal compliance. Tick the boxes, get sign-off from the lawyers, move on.

But the harder question for most e-commerce teams is more basic: do you actually know where AI-generated content exists across your product catalogue? Product descriptions, images, marketing copy, size guides – AI is already embedded across all of it for many retailers, often generated at speed and volume with minimal oversight.

The transparency requirements in the Act mean that content needs to be attributed, flagged and traceable. And right now, most businesses don’t have the governance infrastructure to do that. Marketplace channels are already responding – API schemas are starting to include attributes to flag AI-generated content.

It’s starting to show up, but the retailers haven’t caught up. The puppy problem There’s an analogy that gets used a lot in conversations about AI and retail teams, and it’s stuck because it’s accurate. AI is like a puppy. Train it well and it grows up to be a well-behaved dog that does the right things.

Don’t, and it will, to use the technical term, make a mess on your carpet. We’re already seeing it play out publicly. Posts on LinkedIn about bad AI content going out to consumers. Inaccurate product information published at scale. The problem isn’t the tool – it’s the assumption that the output is ready to use without human review.

Everyone is excited about AI, and understandably so. But it’s only as good as what you’ve put into it, how you’ve coached it and how you’ve trained it. The teams that handle this well are the ones developing a new skill: a healthy distrust of the results.

Not an assumption that it’s great and going to save loads of time – though it will, once it’s trained properly – but the ability to look at the output and ask: where did that come from? Why did it say that? Is that actually accurate?

The stakes are higher than just LinkedIn embarrassment In retail, the consequences of getting this wrong extend far beyond reputational damage. If AI-generated product information is published without proper review and contains inaccuracies that lead to harm or health issues for customers, the situation can escalate very quickly. That’s not a hypothetical.

It’s the logical endpoint of using AI for product data without the governance process behind it. Ingredients, allergens, technical specifications, safety warnings – all of it can be caught up in AI-generated content pipelines if teams aren’t set up to catch the errors.

This is where the EU AI Act becomes less of an abstract compliance challenge and more of a practical operational one. The question shifts from “have we flagged this content as AI-generated?” to “do we have the human expertise in place to verify what the AI is producing before it goes live?”

Building in the adversarial check One of the tactics that must be used is what’s called an adversarial agent. For everything an AI agent produces, a completely separate agent assumes the first one got it wrong – and demands it proves otherwise with data and facts. If it can’t, the output fails.

It’s a useful framework, but it requires someone to have thought about it in the first place. You need a human who can think like a robot to build the agent, and then build the adversarial agent to check the output. That’s a new kind of capability most retail teams aren’t hiring for yet.

The Act, whatever its practical implementation ends up looking like, is going to force those conversations earlier than some businesses would prefer. The alternative is waiting for enforcement – and hoping you’re not first. The window is narrowing The EU AI Act’s requirements are coming into force incrementally.

Right now, most of the retail industry is in watch-and-wait mode, and it’s not hard to see why. When the rules are still being interpreted and no one has been made an example of yet, it’s hard to build momentum internally for investment in governance infrastructure. But that’s exactly the window to