The EU AI Act is now in force — what changed on 2 August

What actually changed

For most commerce businesses, very little of the Act's heaviest machinery applies: recommenders, search ranking and most personalisation sit in the minimal-risk tier and carry no specific obligations. What did change is that the transparency duties are now live rather than pending, and they cover things almost every retailer runs.

• A customer talking to a chatbot has to be told they are talking to an AI system.
• AI-generated content presented to the public has to be identifiable as AI-generated.
• Staff using AI systems at work need adequate AI literacy, and you should be able to show what training exists.
• As a deployer of a vendor's system, responsibility for how it is used sits with you, not only with the vendor.

If you are not there yet

The gap between compliant and not is usually smaller than teams fear, because the customer-facing fixes are cheap. A one-line notice in the first chatbot message, a label on generated product copy, and a documented human review route close most of it. What takes longer is the inventory underneath, and that is worth starting now rather than after a question arrives.

Our EU AI Act checklist walks through the inventory, the risk classification, and the provider-or-deployer question in plain language. The vendor evaluation guide covers what to request from suppliers, and customer data and AI covers the GDPR overlap.

What comes next

The remaining transitional provisions apply from 2 August 2027. Between now and then, the sensible cadence is a quarterly re-run of the AI inventory: new AI tends to arrive in a commerce stack faster than governance does, and the inventory is the document that makes every other obligation answerable.