This summer many business owners read a single line about the AI Act: postponed to 2027. It is a comfortable reading, and a wrong one. The delay mainly concerns systems that an online shop does not usually build, such as those used to assess credit or select staff. The rules that really affect online sellers, namely transparency towards customers and training for anyone who uses artificial intelligence at work, already apply. And on 2 December 2026 another deadline arrives. Anyone who put the file in a drawer until 2027 is already behind on part of the obligations.
AI Act postponed? For online sellers the rules already apply
The European regulation on artificial intelligence dates from 2024 and applies in stages. In July 2026 the Union approved an amendment, the so-called Digital Omnibus on AI, published in the Official Journal on 24 July and in force from the 27th. This amendment moved the dates that made the headlines, but it did not remove any category of obligation.
To understand what concerns a company that sells online, it helps to start from what is already in force. Since February 2025 certain practices have been banned, including systems that manipulate people or exploit their age, a disability or a difficult economic situation in a way that causes significant harm. Since the same date, anyone using AI at work has had to take care of staff AI literacy. Since 2 August 2026 the transparency rules apply, the ones that go straight into the relationship with the customer.
On AI literacy the Omnibus softened the text: before, companies had to ensure a sufficient level of skills, now they must take measures to support them. It sounds like a lawyer's detail, but for a business the substance remains. If customer service answers with the help of an AI assistant, or if marketing writes product pages with a language model, people need to know what that tool can get wrong, from invented answers to data that should never be pasted in. No certificate is required, but it is worth keeping a record of what has been done, because since 2 August national authorities can check it.
Chatbots, generated photos and videos: AI Act transparency in e-commerce
Transparency is the part of the AI Act that a customer sees. The basic rule is simple: anyone talking to an artificial intelligence system must know it, unless it is obvious from the context. The formal obligation falls on whoever provides the system. If you bought the sales assistant on your website from a vendor, you should demand that it complies. If you built it yourself on top of a model, you are the provider.
Then there is generated content. Anyone who publishes a deepfake, meaning an image, audio or video that realistically shows people, objects or places and could appear authentic, must disclose it. For sellers this touches very concrete cases: the promotional video with a testimonial who does not exist, the synthetic voice of a founder in an ad, the photo of a product worn by a generated model. Product photos retouched with AI are the greyest area, and there the right question is not whether the law requires it, but whether the customer would feel deceived on finding out.
Text is a different case. The labelling obligation covers generated text published to inform the public on matters of public interest, and even there it falls away if there is editorial review with a person taking responsibility for it. A product page written with AI does not fall into this category. It does, however, remain subject to all the existing rules on misleading advertising, and those make no distinction about who wrote the sentence.
On all of this the Commission has clarified the test, with the Code of Practice on labelling AI-generated content, published in its final version in June and judged adequate by the Commission in July, to which adherence is voluntary. For deepfakes the test is simple: there is no need for intent to deceive, and photorealism is not decisive, it is enough that the content could look authentic. The marking applied by the tool's provider does not replace the label of whoever publishes, and content published before 2 August 2026 does not have to be labelled retroactively. Anyone relying on editorial review for text must be able to document it: saying that someone proofread it is not enough.
2 December 2026 and high risk in 2027: what is really postponed
The next date is 2 December 2026. From that day, providers of generative AI systems already on the market before 2 August must mark the text, images, audio and video they produce in a machine-readable way, so that they can be recognised as artificial. For systems launched after August the obligation has applied from day one. On the same day two new bans come into force, on systems that generate non-consensual intimate images of real people and child sexual abuse material.
An online shop that uses third-party tools does not have to mark anything itself, but it should know whether its suppliers do. If your agency or your management software generates images for you with a model that will not be compliant in December, the supplier risks the fine, but you are the one who faces the customer.
The postponed part is the one on high-risk systems. For the uses listed in Annex III, such as recruitment, creditworthiness assessment of individuals, education and biometrics, the rules start on 2 December 2027 instead of 2 August 2026. For AI built into products that are already regulated, such as medical devices or toys, the date moves to 2 August 2028. Online sellers meet high risk at two precise points: when they use AI software to choose who to hire, even just for seasonal peaks, and when they offer instalment payments, where the algorithm that assesses the customer is high risk even though it is usually run by the lending company. In the first case the software provider carries most of the weight, but the company using it has obligations of its own, from human oversight to informing employees before putting it into service.
The penalties have not changed. For banned practices they reach 35 million euros or 7% of worldwide turnover, for transparency and most other obligations 15 million or 3%. For small and medium-sized enterprises the lower of the two amounts applies, and the Omnibus extended part of this treatment to the new category of small mid-caps, that is, companies just above the SME thresholds, as defined by a 2025 Commission recommendation.
The AI Act and marketplaces: why the pressure will come from the platforms
There is a passage in the Omnibus that received little attention and that, for marketplace sellers, matters more than the dates. The European AI Office becomes the sole competent authority for artificial intelligence systems integrated into very large online platforms, those already designated under the Digital Services Act. In practice the big marketplaces will have a single European supervisor for their recommendation engines, shopping assistants and tools that generate listings and images.
My prediction is that the pressure on sellers will not come from an inspection, but from the terms of service. A platform that answers directly to Brussels for its AI will pass part of the risk on to whoever uploads content: declarations on generated images, checks on videos, rules on external assistants connected to the account. It has already happened with product safety and with seller information, and it will happen again. Anyone selling on several channels will find themselves following as many interpretations of the same law as there are marketplaces.
AI Act for e-commerce: three things to do before December
The first is an honest inventory. Which AI tools the company uses, who uses them and for what: chatbots, image generators, customer service assistants, recruitment software, pricing engines. In many companies this list does not exist, because the tools came in from the bottom up, one subscription at a time.
The second is to ask suppliers, in writing, how they are preparing for 2 December and for the transparency rules. A serious supplier already has an answer. One that does not is telling you something about everything else too.
The third is to set an internal rule on generated content that goes beyond the legal minimum. When an image or a video shows something that does not exist that way, you say so. It costs little, protects trust and shields the company from marketplace policy changes. It is worth getting a lawyer's help on the doubtful cases: this article is a business owner's reading, not legal advice.
The AI Act delay is a gift only for those who use it well
The postponement of high risk is a sixteen-month gift, but only for those who use it to prepare. For online sellers the AI Act is not a 2027 problem, it is a question of customer trust today. I would not wait for Brussels or for my marketplace to decide what to tell customers about what artificial intelligence does in the shop. The companies that say it first will not just carry less risk, they will have a selling point the others lack.
CEO & Co-Founder of BusinessLabs. I have attended major international trade shows since 2015 and share here experiences and insights for online sellers.
LinkedIn
