Strategy
AI Act and GDPR: what the law asks of a store's AI agent
AI Act and GDPR for online stores: what your AI agent must tell customers, what the Omnibus postponed and what to ask your provider. A ShopGuru guide.
An AI agent in your store's customer service that talks to customers is subject to two EU laws at once: the GDPR, which already applied to every conversation, and the AI Act's transparency rules, which apply from 2 August 2026. We separate what each one asks of the store owner, what the Omnibus package postponed and the questions to ask your provider before signing.
Article summary
- The AI Act, Regulation (EU) 2024/1689, requires that people know they are interacting with an AI system, unless that is obvious.
- The obligation in Article 50(1) applies from 2 August 2026, was not postponed by the Omnibus and requires a clear notice, at the latest at the first interaction.
- An agent that serves an online store's customers is not on the AI Act's list of high-risk uses, whose rules the Omnibus postponed to 2027 and 2028.
- The GDPR applies to customer conversations, and a provider that processes them on the store's behalf needs a contract under Article 28.
- A decision that matters to the customer, such as refusing a refund, stops being solely automated when a person on your team reviews and approves it.
- This article describes the law in force on 12 October 2026, is for information only and is not legal advice.
What the AI Act asks of an agent that talks to customers
Article 50(1) of the Artificial Intelligence Act says that AI systems intended to interact directly with people must be designed so that those people are informed they are interacting with an AI system. The exception is when this is obvious to a person who is "reasonably well-informed, observant and circumspect".
Paragraph 5 adds the how and the when: the information is given "in a clear and distinguishable manner", at the latest at the first interaction, and meets the applicable accessibility requirements. The text does not set a sentence or a format.
The obligation falls on the provider: whoever develops the system, or has it developed, and places it on the market or puts it into service under their own name. The store that uses it is the deployer. With a custom-built agent, who is which depends on the contract, and it is worth having it in writing.
In our reading, a store should not bet on the "obvious" exception, because in a chat or on WhatsApp customers can't always tell a person from an agent. The wording of the notice is a decision for each store and its provider, to be checked with a lawyer.
"A customer messaging on WhatsApp at 11pm has no way of knowing who is on the other side. The law asks that they find out." ShopGuru
Breaching Article 50 can lead to fines of up to 15 million euros or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, the lower of the two applies (Article 99(6)).
The AI Act timeline after the Omnibus
Regulation (EU) 2026/1744, the Digital Omnibus on AI, of 8 July 2026, was published in the Official Journal on 24 July and entered into force on 27 July. It moved several dates, but not the one that matters most to a store with an agent.
| AI Act obligation | Applies from | Did the Omnibus change it? |
|---|---|---|
| AI literacy (Article 4) | 2 February 2025 | Rewritten: support AI literacy, no guaranteed minimum level |
| Telling customers they are talking to an AI (Article 50(1)) | 2 August 2026 | No |
| Machine-readable marking of generated content (Article 50(2)), systems already on the market | 2 December 2026 | Yes, a transition period |
| High-risk, Annex III | 2 December 2027 | Yes, it was 2 August 2026 |
| High-risk, Annex I (regulated products) | 2 August 2028 | Yes, it was 2 August 2027 |
The marking in Article 50(2) is an obligation for providers of systems that generate content, text included, and it is worth asking your provider how they meet it. For images your store generates, see AI product images.
The high-risk postponement barely touches customer service. Annex III lists uses such as recruitment, education or the credit scoring of individuals; an agent that answers questions about sizes, shipping and orders is not on it. If it started assessing a customer's creditworthiness to approve instalment payments, the analysis would be different.
What the GDPR already required of customer conversations
A customer conversation almost always contains personal data: name, phone number, address, order number, sometimes a photo of a damaged product. The GDPR applies to all of it, with or without AI.
In most cases, the store owner is the controller of their customers' data, and a provider that processes the conversations on their behalf is a processor. Article 28 requires a contract setting out the subject matter, duration and purpose of the processing, and binds the provider to process the data only on documented instructions. If the provider uses another one, such as the AI model provider, it needs prior written authorisation.
Article 13 requires that customers know, at the time of collection, who processes their data, for what purpose, who receives it and whether it leaves the European Union: the store's privacy policy has to mention conversations with the agent. Article 5 brings in two principles that matter here: collect only what is needed, and keep it no longer than necessary.
"The AI Act asks that customers know who they are talking to. The GDPR asks that they know what happens to what they say." ShopGuru
Article 22 gives customers the right not to be subject to decisions based solely on automated processing that significantly affect them. Whether a refused refund falls under that definition depends on the case. Reviewed and approved by a person on your team, it is no longer solely automated.
In practice, this is decided in the agent's design: which actions it takes on its own, which go through a person, and what it does when it doesn't know the answer, as we describe in after-hours customer service.
In Portugal, the GDPR is enforced by the CNPD, the national data protection authority, which provides templates for the record of processing activities for controllers and processors. The customer service agent is one more activity to add to that record.
The Digital Omnibus package includes another Commission proposal that amends the GDPR, but on the date of this article it was still under discussion in the European Parliament and the Council. Until it is adopted and published, the GDPR applies as it stands.
Questions to ask your AI agent provider
We recommend getting these answers in writing before an agent starts talking to customers, whoever the provider is.
- Who is the provider of the system under the AI Act, and how is Article 50 met?
- In which message, and with what wording, does the customer learn they are talking to an AI?
- Is there a processing agreement that complies with Article 28 of the GDPR?
- Which other providers process the conversations, including the AI model provider, and in which country?
- Is data transferred outside the European Economic Area, and with what safeguards?
- Are conversations used to train models? How long are they kept, and how are they deleted?
- Which actions does the agent take on its own, and which go through a person on your team?
- What happens to customer data if the store ends the contract?
"A question your provider can't answer in writing already tells you a lot about the provider." ShopGuru
Frequently asked questions
Does the AI Act apply to a small online store?
Yes. The AI Act does not exempt SMEs from the transparency obligations in Article 50. Only the ceiling on fines changes: the lower of the fixed sum and the percentage of turnover.
Does the agent have to say it is an AI in every message?
Article 50 asks that the information be clear and arrive at the latest at the first interaction, without requiring it to be repeated in every message. How to give it in each channel is a decision to check with a lawyer.
Who enforces the AI Act in Portugal?
In September 2025, the Portuguese government announced that it intends to appoint ANACOM as the market surveillance authority for the AI Act. The CNPD continues to enforce the GDPR. It is worth checking the Diário da República to see whether the law that sets the national authorities and fines has been published.
Where to start
The first step is to put in writing what the agent will process: which data, in which channels, with which providers and for how long. With that, a 30-minute call with a ShopGuru engineer is enough to see what still needs deciding. Book a call.
About this article
Written by ShopGuru's engineers. Published on 12 October 2026 and reviewed on 21 October 2026. It reflects the law in force on the publication date: Regulation (EU) 2024/1689 (Articles 3, 4, 50, 99, 113 and Annex III), as amended by Regulation (EU) 2026/1744, and Regulation (EU) 2016/679 (Articles 5, 13, 22 and 28). This article is for information only and is not legal advice.