- What the EU AI Act Already Requires of an Online Store
- Deployer, Not Provider, and Still Responsible
- Where Try-On and Colour Tools Meet the Rules
- Five Questions to Put to Your AI Vendor
- Frequently Asked Questions
- Conclusion
Most retailers running an AI feature on their product pages filed the EU AI Act under 2027 problems. That filing is wrong: the transparency rules in Article 50 have been applicable and enforceable since 2 August 2026, and they apply whether or not a system is classed as high-risk. The direct answer for a fashion ecommerce team: what binds you today is disclosure, content marking and staff competence, not conformity assessment.
This post sets out what already applies to an online store, what the digital omnibus actually postponed, and the questions that settle the matter with your vendor. It is an operator's reading of the regulation, not legal advice, so treat it as the shortlist to take to your counsel.
What the EU AI Act Already Requires of an Online Store
The AI Act, Regulation (EU) 2024/1689, phases in by type of obligation rather than all at once. Two tranches already reach an ecommerce business, and a third was pushed back.
The prohibited practices in Article 5 and the AI literacy duty in Article 4 have applied since 2 February 2025. The Article 50 transparency and information obligations became generally applicable and enforceable across the EU on 2 August 2026, independent of any high-risk classification. Breaching Article 50 carries fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, under Article 99(4).
What the digital omnibus did and did not postpone
The AI Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk deadlines: Annex III standalone systems slipped from 2 August 2026 to 2 December 2027, and Annex I product-embedded systems to 2 August 2028.
It left Article 50, the Article 5 prohibitions and the general-purpose AI model obligations exactly where they were. The headlines about a delay were about high-risk, a category a styling widget on a product page almost certainly does not fall into anyway.
Deployer, Not Provider, and Still Responsible
The Act splits duties between the provider, who builds the system and places it on the market, and the deployer, who runs it under their own authority. A retailer embedding a third-party AI stylist is a deployer, which is a lighter load than a provider's, not an empty one.
Three deployer duties matter on a product page. You must inform people exposed to emotion recognition or biometric categorisation about how the system operates, and process their data in line with EU data protection law. You share the obligation to mark AI-generated or manipulated content in a machine-readable, detectable format. And where content is a deepfake depicting a real person, place or event, the disclosure sits with you.
Article 4 is the one teams forget. It requires you to build AI literacy among the staff operating these systems, and it has been live since February 2025. For a 10-person ecommerce team that is a half-day briefing and a record that it happened, not a programme.
Where Try-On and Colour Tools Meet the Rules
Three features common to a fashion product page touch rules that are already live.
A conversational assistant. Article 50 requires that people interacting with an AI system are told so, unless it is obvious from the context. A widget that answers from your catalogue, as product questions does, should say it is an AI assistant on its opening screen. That is a label, not a redesign.
A try-on render. A virtual try-on output is AI-generated image content, so the machine-readable marking obligation is in scope and worth confirming with your vendor in writing. Generative systems already on the market before 2 August 2026 were given until 2 December 2026 to meet that marking duty, so a tool installed last year is inside that window right now.
A colour profile. Article 5(1)(g) prohibits outright any AI system that categorises people from biometric data in order to deduce or infer sensitive attributes such as race, political opinions or sexual orientation. A colour profile that reads undertone from a selfie to return a palette is not doing that, but you should be able to show it, because the prohibited tier carries the heaviest penalties in the Act. Ask what the model outputs and what it keeps.
None of this is the same question as data protection. Whether the photo is biometric data under GDPR, and on what legal basis you process it, is covered in Virtual Try-On and GDPR: A Compliance Guide for Retailers.
Five Questions to Put to Your AI Vendor
- Are you the provider of this system under the AI Act, and will the contract say so?
- Are generated images marked in a machine-readable format, and since when?
- Does any model infer a sensitive attribute from a photo, and what exactly is retained?
- What AI disclosure text does the widget render, and can we edit it to match our tone?
- Which documentation will you hand us if a national authority asks?
A vendor who cannot answer those five in a single email is a vendor whose compliance posture you will be inheriting. The wider evaluation grid, size output and pricing unit included, is in How to Choose a Virtual Try-On Vendor in 2026, and the comparison pages state what each tool does and does not do, with the date each fact was read.
"The Article 50 transparency and information obligations are now generally applicable and enforceable by national competent authorities across the EU." Goodwin, in its August 2026 alert on the transparency obligations.
If you are mapping which of these duties your current product page triggers, book a 30-minute demo: we go through the disclosure, marking and retention answers for the features you actually run.
Frequently Asked Questions
Does the EU AI Act apply to an ecommerce site using a third-party AI tool?
Yes, as a deployer. You are not the provider of the model, so conformity assessment is not your job, but the Article 50 disclosure and marking duties, the Article 5 prohibitions and the Article 4 AI literacy requirement all reach the business running the system.
Was the AI Act delayed to 2027?
Only for high-risk systems. Regulation (EU) 2026/1744 moved Annex III standalone high-risk obligations to 2 December 2027 and Annex I product-embedded ones to 2 August 2028, and left Article 50 transparency, the Article 5 prohibitions and the general-purpose AI model duties untouched.
Is a virtual try-on render a deepfake under the Act?
The deepfake disclosure duty targets content that would falsely appear authentic, which fits poorly with an image a shopper asked for from their own photo and views themselves. The marking obligation on AI-generated content is the one to confirm with your vendor, and the answer belongs in writing. The Commission guidelines on prohibited practices are the reference point for the Article 5 side of that question.
Conclusion
For a fashion retailer, the EU AI Act is not a 2027 compliance project. It is three small jobs that are already due: label the assistant, confirm how generated images are marked, and brief the team. The features carrying real risk are the ones that infer something sensitive about a shopper, which comes back to what your vendor's model outputs and keeps. For a walk through your own product page, request a pilot and we will go feature by feature.
