Are product recommendation engines high-risk under the EU AI Act?

Generally no. A recommendation engine that suggests products, ranks search results, or personalizes a storefront is not listed in Annex III as high-risk. It falls into the minimal-risk tier for AI Act purposes. But it can still trigger transparency obligations, the prohibition on manipulative or deceptive AI, and parallel GDPR rules on profiling — so 'not high-risk' is not the same as 'no obligations.'

Does the EU AI Act ban dynamic pricing?

No. Dynamic and personalized pricing is not prohibited by the AI Act itself. What the Act prohibits is AI that uses subliminal, manipulative, or deceptive techniques, or that exploits vulnerabilities of specific groups, to materially distort behavior and cause harm. Pricing that exploits a known vulnerability or uses covert manipulation is the risk — straightforward demand-based pricing is not. Separate EU consumer-protection and data-protection law also constrains personalized pricing.

Do I have to tell customers they're talking to an AI chatbot?

Yes. Under the EU AI Act transparency rules, AI systems that interact directly with people must be designed so users are informed they are interacting with an AI, unless it is obvious from the context. A shopping-assistant chatbot on your store must make clear it is an AI, not a human agent.

We're a US ecommerce brand shipping to the EU. Are we in scope?

If EU consumers interact with your AI — your recommendation engine, chatbot, or personalization affects EU shoppers — you are in scope. The AI Act applies extraterritorially based on where the people affected are, not where your company is incorporated.

EU AI Act for Ecommerce & Retail 2026: Recommendation Engines, Dynamic Pricing & Chatbots

"Not High-Risk" Is Not "No Rules"

The EU AI Act sorts systems into risk tiers: prohibited, high-risk, limited-risk (transparency), and minimal-risk. Annex III names the high-risk categories — things like credit scoring, hiring, biometric ID, and access to essential services. Ordinary retail AI isn't on that list. Your product recommender, your "customers also bought" widget, your search ranking, and your homepage personalization sit in the minimal-risk tier as far as the high-risk regime goes.

That's genuinely good news — you don't need a conformity assessment or an Annex IV technical file for a recommendation engine. But two other parts of the Act reach you anyway: the transparency obligations for AI that talks to people, and the outright prohibition on manipulative AI. Those apply regardless of risk tier.

How Common Retail AI Sorts Out

Minimal-Risk (No High-Risk Duties)

•Product recommendation engines
•Search and category ranking models
•Homepage and email personalization
•Demand-based dynamic pricing
•Inventory and demand forecasting
•Fraud and chargeback detection

Triggers Transparency or Prohibition Rules

•Customer-facing AI chatbots (must disclose AI)
•AI-generated product images or reviews (labeling)
•Synthetic 'spokesperson' avatars (disclosure)
•Manipulative nudges exploiting vulnerabilities
•Covert pricing that hides material info
•Emotion-recognition at checkout (restricted)

The Manipulation Prohibition Is the Real Retail Risk

Article 5 of the AI Act prohibits AI systems that use subliminal, purposefully manipulative, or deceptive techniques to materially distort a person's behavior in a way that causes — or is reasonably likely to cause — significant harm. It also bans AI that exploits vulnerabilities tied to age, disability, or a specific social or economic situation. This is the provision ecommerce teams should actually study, because conversion-optimization culture sits uncomfortably close to it.

Fake-scarcity timers, AI that learns a shopper is in financial distress and pushes high-interest BNPL at them, or personalization that exploits a known compulsion — those are the kinds of "dark patterns" the prohibition targets. A normal "only 3 left" message that's actually true, or an honest recommendation, is not manipulation. The line is deception plus harm, not persuasion.

Dynamic Pricing: Allowed, But Not Unbounded

The AI Act does not ban dynamic or personalized pricing. What constrains retail pricing AI is the combination of the manipulation prohibition, EU consumer-protection law (which requires that personalized pricing based on automated decision-making be disclosed), and GDPR rules on profiling. The practical rule: you can price dynamically, but you can't do it covertly in a way that exploits a vulnerability, and you may need to tell EU shoppers when a price was personalized to them.

The Compliance Checklist for Online Stores

Customer-Facing AI

☐Label your shopping chatbot clearly as AI
☐Disclose AI-generated images, reviews, or avatars
☐Disclose when a price was personalized via automation
☐Avoid emotion-recognition on shoppers
☐Document that 'scarcity'/'urgency' claims are truthful
☐Give a path to a human for support escalations

Governance & Data

☐Inventory every AI system touching EU shoppers
☐Confirm none fall in Annex III high-risk categories
☐Run a manipulation/dark-pattern review of nudges
☐Map personalization to a GDPR lawful basis
☐Honor profiling opt-outs and DSAR requests
☐Check third-party AI vendors' AI Act posture

Where Marketplaces Carry Extra Weight

If you run a marketplace rather than a single-brand store, you sit at the intersection of the AI Act and the Digital Services Act. The DSA already imposes transparency on recommender systems for larger platforms — you must explain the main parameters of your ranking and, for very large platforms, offer a non-profiling option. Treat the AI Act transparency rules and the DSA recommender-system rules as one combined obligation rather than two separate projects.

What Non-Compliance Costs

Breaching the Article 5 prohibition on manipulative AI carries the Act's steepest penalty — up to €35M or 7% of global annual turnover. Transparency violations are lower but still material. For most retailers the bigger near-term exposure is consumer-protection enforcement over dark patterns and undisclosed personalized pricing, which European regulators have been actively pursuing. The AI Act sharpens those existing risks rather than replacing them.

Frequently Asked Questions

Do we need a conformity assessment for our recommendation engine?

No. Recommendation and personalization engines are not in the Annex III high-risk list, so the conformity-assessment and technical-documentation regime for high-risk systems does not apply. Your obligations are transparency (for any customer-facing AI) and staying clear of the manipulation prohibition, plus GDPR.

Is showing different prices to different users illegal in the EU?

Not under the AI Act per se. Personalized pricing is permitted, but EU consumer law requires you to inform consumers when a price has been personalized using automated decision-making, and the manipulation prohibition bars covert or vulnerability-exploiting pricing. Disclose it and keep it honest.

Our chatbot is clearly branded as 'Bot' — is that enough disclosure?

If a reasonable user would understand from the context that they're dealing with an AI, the transparency duty is met. A clearly labeled bot persona generally satisfies it. The rule targets AI designed to pass as human, not honestly branded assistants.

We use AI-generated lifestyle images on product pages. Do we have to label them?

The AI Act's transparency rules require that AI-generated or manipulated image, audio, and video content be marked as artificially generated in a machine-readable way, with disclosure to users in many contexts. For purely illustrative product imagery the application is still settling, but the safe path is to mark AI-generated media and disclose it.

Light Touch, Not No Touch

Ecommerce got off easy under the EU AI Act compared to fintech or HR tech — almost none of your AI is high-risk. The trap is concluding there's nothing to do. Label your chatbots, mark AI-generated media, disclose personalized pricing, and pressure-test your conversion nudges against the manipulation prohibition.

Do those four things and an online store is in good shape for August 2026 — without the heavy compliance machinery the high-risk sectors are building.