EU AI Act for E-commerce Businesses

The EU AI Act for e-commerce means that any online store using artificial intelligence - whether for recommendation engines, dynamic pricing, chatbots, or AI-generated product descriptions - must take measures to support the development of AI literacy among staff and relevant persons, considering their knowledge, experience, training, context, and the people affected. This applies even to small Lithuanian e-commerce businesses with only a few employees: obligations are based on how you use AI, not on your turnover. In practice, the first steps are to inventory your tools, identify AI functions visible to customers, organise staff training records, and have clear rules for using ChatGPT in your company.

Does the AI Act even apply to my online store?

The short answer is almost always yes if you use any AI tool in your business. The EU AI Act regulates users of AI systems ("deployers"), not just creators. If your online store uses AI from a third party (for example, Shopify recommendations, ChatGPT for descriptions, or Klaviyo forecasts), you are a deployer with corresponding obligations.

The most important point for small e-commerce businesses is Article 4 of the AI Act (AI literacy), which has applied since 2 February 2025. It requires that companies take measures to support the development of AI literacy for employees and relevant persons, taking into account their knowledge, experience, training, context, and the people affected. Company size is not an exception - even a 3-person online store has this obligation. For more on scope, read who the EU AI Act applies to.

Which AI tools in an online store fall under regulation?

In e-commerce, AI often operates "behind the scenes", so the first step is to understand where it is actually used. Typical AI use cases in online stores:

Once you have this list, it is worth formalising it into an AI tools register - a document where you record which AI tools you use, for what purpose, and who is responsible. The register is a practical foundation for your entire compliance.

What specific obligations apply to e-commerce companies?

For e-commerce businesses, the most relevant groups of obligations are:

1. AI literacy (Article 4, effective from 2025-02-02). Employees who use AI tools - from the marketing specialist writing descriptions with ChatGPT to the customer service team managing a chatbot - must be trained. What is needed is not a formal course, but a real understanding of the risks (for example, that AI can generate incorrect product information). This obligation does not require a specific or sufficient individual level, only measures to support literacy development.

2. Transparency when using chatbots. If a buyer interacts with an AI chatbot, they must be clearly informed that they are communicating with a machine, not a human. This transparency obligation is broadly applied and is one of the most relevant for e-commerce.

3. Labelling of AI-generated content. If you automatically generate images or texts with AI, in certain cases you must ensure that the content is recognisable as AI-generated.

For most online stores, AI use falls into the minimal or limited risk category, so there is no need for complex high-risk system obligations. However, AI literacy and transparency requirements are already in effect. For more on the timeline: general-purpose AI model rules began applying on 2 August 2025, subject to transitional provisions, and most remaining AI Act obligations apply from 2 August 2026. High-risk AI systems listed in Annex III have requirements effective from 2 December 2027, and high-risk AI embedded in regulated Annex I products - from 2 August 2028.

How does e-commerce differ from service or manufacturing companies?

AI use in e-commerce has three distinctive features that are less common in other companies:

• Direct mass contact with users. Chatbots and recommendations interact with thousands of buyers, so the transparency obligation carries real weight.
• AI decisions directly affect money. Dynamic pricing and personalisation directly change what and at what price the buyer sees.
• Large amounts of personal data. Recommendations and segmentation are based on purchase history, so the interface between the AI Act and GDPR is particularly sensitive in e-commerce. Note that bans on AI tools often apply to unapproved or public tools; lawful basis, data minimisation, approved tools, and safeguards must be assessed rather than assuming blanket permission.

If your business is more focused on services or a mix, you may also find the related article AI Act for Service Companies useful, which discusses different usage scenarios.

What to do practically in the coming weeks?

A concrete action plan for a small Lithuanian online store:

1. List your AI tools. Review your e-commerce platform, marketing tools, customer service, and content creation. Write down where AI is used.
2. Record the register. Enter the tools into an AI tools register - name, purpose, provider, responsible person.
3. Train employees. Support the development of AI literacy among those who use AI. There are free AI literacy training courses with knowledge checks. This training and these documents are practical measures, but not a mandatory legal minimum or a guarantee of compliance. The free path is for one signed-in participant; team training is included in the paid documentation package.
4. Add a transparency label. If you use a chatbot, clearly show the buyer that they are interacting with AI.
5. Prepare a policy and guide. Write down AI usage rules and a short employee AI guide so it is clear what not to do (for example, uploading customer data to public, unapproved AI tools; assess lawful basis, data minimisation, and safeguards).

The four documents - the AI usage policy, AI tools register, compliance record and employee AI guide - together with AI literacy training and certificates - can be automatically generated by nebedirbam.lt for a fixed €149 + VAT (€299) based on compliance expert-reviewed templates, without hourly fees or waiting. This brings the preparation work into one guided process. These documents are recommended practical records, but not mandatory legal requirements or a compliance guarantee.

Who is responsible in the online store and how to avoid pitfalls?

In a small e-commerce company, responsibility often "gets lost" because several people use AI for different purposes. A practical solution is to assign one responsible person (often the manager themselves) who oversees the AI tools register and training implementation. This prevents so-called shadow AI, where employees install AI tools without oversight.

Documents must not only be prepared but also updated when the tools used change. You can find our full collection of articles on AI Act practices in the list of all articles, and the official regulation text on the EU law portal EUR-Lex (Regulation (EU) 2024/1689).

Frequently Asked Questions

Do I need compliance if I only use Shopify and ChatGPT? Yes. Even if the AI system itself belongs to the provider, you are the deployer and the AI literacy obligation has applied to you since 2 February 2025.

Does a chatbot have to identify itself as AI? Yes, the transparency obligation requires informing the buyer that they are communicating with an AI system, not a human.

Are fines realistic for a small online store? AI Act sanctions are significant, and compliance can be time-consuming if done manually. Basic AI literacy can be obtained for free via AI literacy training, and full documentation can be automated.

This article’s legal information is based on official EU AI Act sources: AI Act Service Desk - Article 4 and EU Digital Strategy - Regulatory Framework on AI.