EU AI Act enforcement begins 2 August: what commerce teams must do now
On 2 August 2026 the EU AI Act reaches full enforcement. Fines run up to €35 million or 7% of global turnover. Most commerce businesses are not building high-risk AI systems — but that does not mean nothing applies to you.
22 July 2026
Four obligations deserve attention this week:
- Inventory your AI systems. List every AI tool your business uses and classify each by the Act's risk tiers.
- Meet transparency requirements. Customers interacting with a chatbot must be told they are talking to AI. AI-generated content presented to the public must be identifiable as such.
- Ensure AI literacy. The Act requires that staff using AI systems have adequate training. Document what training exists and close the gaps.
- Check your vendors. You remain responsible as a deployer. Our AI vendor evaluation guide covers what to request.
What this means in practice
The obligations that reach most commerce businesses are the transparency ones in Article 50, and they are cheaper to meet than teams expect. A notice in the first message of a chatbot, a label on generated product copy, and a documented route for a person to review and reverse an automated decision will close most of the gap for a typical retailer.
What takes longer is the inventory underneath. You cannot classify systems you have not listed, and AI arrives in a commerce stack faster than governance does: a personalisation feature here, a generative description tool there, a fraud score inherited from a payments provider. Teams that already keep a one-row-per-system spreadsheet find this week uneventful. Teams that do not are starting from zero under time pressure.
The distinction that decides your duties
Most commerce companies are deployers: they use a vendor's system under their own authority. You become a provider the moment you substantially modify a system, put it under your own brand, or use it for something the vendor never documented. The obligations differ, and the answer is not always the one a vendor gives you.
For the full step-by-step preparation list, use our EU AI Act checklist, updated July 2026. The vendor evaluation guide covers what to request from suppliers, and customer data and AI covers where this overlaps with the GDPR.
One email a month.
New research, event dates and guides as we publish them. Nothing else, and you can unsubscribe from any message.