Does the EU AI Act apply to non-EU retailers?

Yes. Article 2 catches providers and deployers established in a third country where the output of the AI system is used in the Union. The Commission's guidelines apply a foreseeability test: if you direct or authorise distribution into the EU, you are in scope. A UK or US store with a euro-priced storefront and EU shipping is squarely inside. Many global retailers apply one standard everywhere rather than maintaining separate processes per region.

Do I have to label every AI-generated product photo under the EU AI Act?

No, and this is the most common misreading. As a deployer your duty under Article 50(4) covers deepfakes: content that resembles a person, object, place or event that exists or could plausibly exist, and that would falsely appear authentic. A fully generated image that makes your product look better than it really is qualifies. A real product photographed against an AI-generated backdrop is listed in the Commission's own guidelines as not a deepfake, provided the ad is not likely to mislead about the product. Machine-readable marking under Article 50(2) is the duty of whoever built the generator, not of the merchant.

Do I have to label AI-written product descriptions?

No. The text duty in Article 50(4) only covers text published to inform the public on matters of public interest, and the Commission's guidelines give AI-manipulated text forming part of a company's advertisement or product descriptions as an example that falls outside it. A blog post on a public-health or public-policy topic is a different question.

When do the EU AI Act transparency rules start, and did the Digital Omnibus delay them?

Article 50 applies from 2 August 2026 and the Digital Omnibus on AI did not delay it. The omnibus moved the high-risk rules to 2 December 2027 and 2 August 2028, and added one transitional rule inside Article 50: providers of generative systems already placed on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking obligation in Article 50(2). The chatbot disclosure duty in Article 50(1) starts on 2 August 2026 with no transition.

What are the penalties for breaching Article 50?

Up to 15,000,000 euro or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs and start-ups the cap is whichever of those two is lower, so a small business is exposed to the percentage rather than the headline figure. Enforcement runs through national market surveillance authorities, who can act on their own initiative or on a complaint from any affected person.

Do I have to use C2PA content credentials?

No. Neither the AI Act, the Commission's Article 50 guidelines nor the Code of Practice names C2PA. Recital 133 lists watermarks, metadata identifications, cryptographic provenance methods, logging, fingerprints and other techniques as acceptable approaches. C2PA is one credible way to do the cryptographic-provenance part, and the Code of Practice expects providers to implement at least two layers of machine-readable marking, so signed metadata alone is not sufficient under the Code. This is a duty on generative-AI providers, not on merchants.

The EU AI Act compliance guide for ecommerce: the deadline is here

Article 50 applies from 2 August 2026. The per-platform implementation checklist, the questions to put to your chatbot and media vendors, the records to keep, and a decision tree for what actually needs marking.

The Sellarix team · 23 Jul 2026 · 9 min read

The EU AI Act's transparency obligations apply from 2 August 2026. That is ten days away as this guide is updated, so the framing has changed: this is no longer a plan, it is a punch list. If your store uses AI to generate product media, write copy, answer customers or recommend products, and you sell into the EU from anywhere in the world, work through it.

This is practical guidance, not legal advice. Confirm specifics with your DPO or counsel. Every obligation below links to its primary source, and every link was checked on 23 July 2026.

For the reasoning behind each decision, including why blanket-labelling every AI image is the wrong answer and what the Commission's 20 July guidelines actually say, read the companion article: what you actually have to mark, and what you don't. This guide is the doing part.

What the EU AI Act is

The EU AI Act is the first comprehensive law governing artificial intelligence. It entered into force on 1 August 2024 and applies in stages. It takes a risk-based approach: a small set of practices are banned, a defined set of uses are high-risk and carry heavy obligations, and a broader set carry lighter transparency duties. Most ecommerce AI (search, recommendations, content generation, customer service) sits in the transparency tier rather than high-risk, and those duties are real and enforceable.

The deadline has arrived: 2 August 2026

Article 50 applies from 2 August 2026 and the Digital Omnibus on AI did not move it. The omnibus delayed the high-risk rules to 2 December 2027 and 2 August 2028, and added one narrow transitional rule inside Chapter IV: providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2). That extension belongs to model vendors, not to merchants, and it does not touch the chatbot disclosure duty.

One thing genuinely works in your favour. Content generated before 2 August 2026 does not have to be labelled retroactively, and the Commission has said explicitly that it does not expect anyone to audit pre-existing content databases or reprint packaging. Text is the exception: text generated before the date but published on or after it does need labelling where the text rule applies at all.

Who has to do what

Article 50 at a glance. Most merchants are deployers, so paragraphs 3 and 4 are the ones that bind them.
Paragraph	Duty	Falls on	Applies from
50(1)	Inform people they are interacting with an AI system	Provider	2 August 2026
50(2)	Mark outputs machine-readably and make them detectable	Provider	2 August 2026 (2 December 2026 for systems already on the market)
50(3)	Inform people exposed to emotion recognition or biometric categorisation	Deployer	2 August 2026
50(4)	Visibly disclose deepfakes, and AI text on matters of public interest	Deployer	2 August 2026

You become a provider if you build an AI system in-house and put it into service under your own name, or if you fine-tune someone else's model and ship it as yours. A company that only commissions an agency, without deciding or controlling how AI gets used in production, is not a deployer at all.

The marking decision tree

Run every asset through this before you badge it. The deployer duty is about deception, not about whether a machine touched the pixels, so most AI-assisted work does not need a label.

Is it image, audio or video? No (it is text, a chart, a diagram, a spreadsheet): stop. The deployer duty in 50(4) covers image, audio and video, plus text only where it is published to inform the public on matters of public interest. Product descriptions and listing copy are out.
Was an AI system used to generate or manipulate it? No (Photoshop, Lightroom, a designer, a camera): stop. No AI system, no Article 50.
Does it resemble a person, object, place, entity or event that exists or could plausibly exist? No (a sphinx over the Eiffel Tower, an abstract render, a fantasy scene): stop.
Could it mislead a reasonably foreseeable viewer about its authenticity or truthfulness? No (real product against a generated backdrop, AI colour correction, background extension, rescaling, rearranging real products): stop. The Commission lists these as minor-impact.
All four yes? It is a deepfake under Article 3(60). Apply a visible, perceivable label at first exposure, and record why.
Edge case: is it evidently artistic, creative, satirical or fictional? Then the duty is reduced to disclosing the existence of the generated content in a way that does not hamper enjoyment of the work. Read this narrowly: content that is purely commercial or informative does not qualify.

The trap in both directions. Under-label a fully generated product shot that flatters the item and you have an Article 50 problem and a misleading-advertising problem. Over-label everything and you have told customers something untrue about your own photography, on a page where truthfulness is regulated.

The implementation checklist, per platform

The job is the same everywhere: a flag on the asset, one badge component, and a disclosure on the assistant. The work differs by how much control the platform gives you.

Shopify

Create a metafield definition, for example compliance.ai_disclosure on Product and on MediaImage: a boolean plus a short reason string.
Render the EU icon in the product-gallery snippet when the flag is true. Top-right, no intervening overlay, and check it survives the lightbox, the zoom view and the mobile carousel.
Give the badge an alt or aria-label announcing AI origin, so assistive technology reads it.
Turn on the AI disclosure in Shopify Inbox, Sidekick-powered chat or your third-party assistant, so it appears at or before the first message.
Do not spend engineering time forcing IPTC tags through the Shopify CDN. Shopify acknowledged on 14 May 2026 that its CDN strips IPTC metadata and the issue was still open on 9 July 2026. Machine-readable marking is the provider's duty in any case.

WooCommerce

Add a post meta key on the product and a matching field on the media attachment, so the flag travels with the asset rather than the listing.
Filter woocommerce_single_product_image_thumbnail_html to inject the badge, or override the template if your theme has already replaced it.
Audit chat plugins separately. Woo's own AI assistant is admin-facing and out of scope for the disclosure duty; whatever front-end chat plugin you installed is not.
If you generate copy or images with Jetpack AI, record which assets came from it.

Adobe Commerce / Magento

Add a product attribute for the disclosure flag and surface it in the media gallery template.
If your creative pipeline runs through Adobe Firefly, Content Credentials are attached on generation. Verify they survive your image CDN and resizing pipeline, because that is where they usually die.
Product recommendations and merchandising services do not need an interaction disclosure. Recommender systems sit outside Article 50(1).

BigCommerce

Use a custom field on the product for the flag, or a metafield if you are on a Stencil theme you control.
Copy generated with BigAI Copywriter does not need labelling. Product descriptions are not text published to inform the public on matters of public interest.
Third-party AI image apps from the marketplace are the exposure. List them and check what each writes into the file.

Custom and headless

Put the flag in the PIM or DAM, not the storefront, so it survives a replatform and reaches app, marketplace feed, retail media and email.
Expose it in your product API so every channel can render the badge consistently.
If you call a model API directly and ship the result under your own brand, work out whether you have become a provider. If so, paragraphs 1 and 2 are yours and the Code of Practice expects two layers of machine-readable marking.

What to ask your vendors

Send this to every AI vendor in your stack and keep the replies. Written answers are part of your evidence file, and a vendor who cannot answer question three is a vendor you will be explaining in September.

For a chatbot or assistant vendor

Do you consider yourself the provider of this AI system under Article 50(1), and do you consider us a deployer?
Does the assistant disclose its AI nature at or before the first message, by default, without configuration?
Is the disclosure visible on every entry point: the widget, the proactive prompt, the email channel, the voice channel?
If a human agent takes over mid-conversation, how is that transition disclosed?
If the product blends AI drafts with human sending, which outputs count as AI-generated, and how do you mark them?
Does the assistant do emotion recognition or biometric categorisation of any kind? If yes, we have a separate duty under Article 50(3).
For agentic features: does the agent disclose both its artificial nature and the party it acts for?

For a generative media or copy vendor

Have you signed the Code of Practice on Transparency of AI-Generated Content? Which sections have you opted out of?
What machine-readable marking do you apply, and does it include both digitally signed metadata and an imperceptible watermark?
Is a detection tool publicly available so a third party can verify the mark?
Where in the file does the mark live: EXIF, XMP, a C2PA manifest, or a watermark in the pixels?
Does the mark survive resizing, re-encoding, cropping and format conversion?
Were the systems we use placed on the market before 2 August 2026, and are you relying on the transitional period to 2 December 2026?
Do you offer a perceptible label as well as the machine-readable mark, and can we switch it on?

Records and evidence: what to keep

Nobody is going to ask for a compliance binder. They are going to ask a question, and you need to answer it from a file rather than from memory. Keep these, dated, in one place, and review them quarterly.

Eight records. A shared folder and a spreadsheet is a perfectly adequate implementation.
Record	What it contains	Why you need it
AI system inventory	Every AI system touching a customer: chat, search, recommendations, media generation, copy, try-on, voice. Vendor, version, date adopted, whether you modified it	Establishes scope and fixes your role for each system
Role determination	For each system: provider or deployer, and one line of reasoning	The first question a market surveillance authority asks
Marking decisions	For each borderline asset: what it is, which deepfake criterion it fails or meets, who decided, when	Shows the assessment was made rather than guessed
Vendor correspondence	The answers to the questions above, in writing	Demonstrates due diligence on the parts you do not control
Code of Practice position	Whether you or your vendors are signatories, and any opt-outs	Signatories get a recognised route to demonstrating compliance; non-signatories must show adequacy another way
Disclosure screenshots	The chat disclosure and a labelled asset, captured on the day you shipped them	Cheap, dated proof that the control was live
Gap analysis	If you are not a Code signatory, a comparison of your measures against the Code's measures	The Commission's guidelines say non-signatories are expected to have done this
AI literacy note	Who was trained, on what, when	Article 4 has applied since 2 February 2025 and is widely forgotten

The ten-day punch list

Turn on the AI disclosure in your chat assistant. This is the duty most stores will breach and it has no grace period.
Sort generated media into three piles: fully generated product imagery, real product plus generated environment, everything else. Only the first pile is likely to need a label.
Build the badge once as a component driven by an asset-level flag.
Email your chatbot and media vendors the questions above.
Fetch ten of your own served product images and check what metadata survives your CDN.
Write the eight records into one folder.
Check whether emotion recognition or biometric categorisation is running anywhere, including in a session-replay or personalisation tool you forgot about.
Diary 2 December 2026: the Article 50(2) transitional period ends and the new prohibitions on non-consensual intimate imagery start.

How Sellarix helps

Every AI-generated image, video and 3D view from the Content and Media suite carries machine-readable synthetic-media marking, and the Serve assistant discloses that it is AI on first contact. Because everything runs on one platform, the marking and the disclosures stay consistent across the catalogue rather than being stitched together across separate tools, and the asset-level flag travels into every channel. See the trust centre for the full compliance posture, and the AI readiness scan if you want to see what a crawler finds on your store today.

Related reading: the Article 50 article for the reasoning and the primary-source citations, the EU right of withdrawal for the other live EU deadline, and the helpdesk comparison for which assistant vendors already ship a compliant disclosure.