Most e-commerce AI agents are not high-risk under the EU AI Act, so Article 26's deployer duties apply less often than retailers fear. They do apply where an online retailer's agent assesses customers for credit or manages warehouse and delivery staff. There, the retailer must assign oversight to people with competence, training and authority, and be able to show it.
What does Article 26 require?
Article 26 sets the obligations of deployers of high-risk AI systems. In substance, a deployer must use the system according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data it controls is relevant and sufficiently representative; monitor the system and suspend use if a serious risk appears; report serious incidents; keep the logs under its control for an appropriate period; inform workers' representatives and affected workers before using a high-risk system at work; and inform people subject to its decisions where required.
A checklist version of these duties is in the deployer obligations checklist under the EU AI Act, and the underlying definition in what a deployer is.
Where does e-commerce meet the high-risk list?
Three places, mostly.
Credit at checkout. If the retailer itself assesses whether a shopper can pay later, in instalments or on account, that is a creditworthiness assessment of an individual, which the Act lists as high-risk. Where a separate lender does the assessment, the lender is the deployer, but the retailer should know where that line sits in its own checkout.
Warehouse and delivery workforce. The Act treats AI used to allocate tasks based on individual behaviour or traits, or to monitor and evaluate workers' performance, as high-risk. An agent that sets pick rates per worker, assigns delivery routes based on past performance, or flags workers for review is a high-risk system. This is the e-commerce use most likely to trigger Article 26, and the one retailers most often overlook.
Recruitment. Seasonal hiring at scale often uses agents to screen applicants. Screening and selection are high-risk uses.
Customer service agents, product recommendation agents and pricing agents are generally not high-risk, though Article 50 requires that shoppers be told when they are dealing with an AI system.
What competence does each high-risk use need?
For checkout credit, the overseers are the credit or risk staff who set the agent's criteria and review held decisions. They need to read the agent's assessment and the facts behind it, separating sealed order history and signed payment data from declared details the shopper typed in. They need authority to decline or approve against the agent, and the ability to suspend automatic approvals if fraud or default patterns shift.
For workforce management, the overseers are shift managers and operations leads. They need to understand what the agent measures, what it cannot see, such as a broken scanner or a blocked aisle, and when its assessment of a worker is unfair. Authority means a manager can set aside the agent's allocation or performance flag without justifying it upwards, and must review any flag that could lead to discipline before it reaches the worker. Workers' representatives must be informed before the system goes live, and in many EU countries their agreement shapes how performance data may be used.
For recruitment, the overseers are recruiters and hiring managers. They need to recognise proxy criteria, read provenance of claims in an application, and override the agent's ranking.
Across all three, training must follow the agent. An agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. If a workforce agent drops to depth 1, shift allocation becomes manual immediately; managers must be able to do it.
How does a retailer meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify high-risk uses | Inventory of agent capabilities marked high-risk or not, with reasons | Inventory with owner sign-off |
| Oversight assigned to named people | Named overseers for checkout credit, workforce and recruitment capabilities | Assignment register |
| Necessary competence | Assessment on the retailer's own cases before oversight rights are granted | Assessment results by person |
| Necessary authority | Managers can set aside allocations and flags; credit staff can override | Overrides in the agent's record |
| Inform workers' representatives | Consultation before go-live of workforce and recruitment agents | Consultation records |
| Monitor and suspend | Trained staff review outcomes by group and suspend on drift | Monitoring reports; suspension events |
| Transparency to shoppers (Article 50) | Customer-facing agents identify themselves as AI | Conversation openings |
What counts as proof of competence is explained in what evidence of competence is.
What will a regulator ask?
A market surveillance authority or labour inspectorate may focus on the workforce agent: what does it measure, who reviews its flags, how were managers trained, were workers' representatives informed? A consumer credit supervisor may look at checkout credit. A data protection authority, following a complaint from a worker or shopper, will ask what the agent decided, on what data, and who reviewed it. Each will want to see the record of decisions and the training records of the people who made them.
What does Article 26 not cover?
It does not apply to non-high-risk agents, which is most of a retailer's estate. It does not set employment, consumer or credit rules, which apply independently and sometimes more strictly. It does not prescribe training content or credentials. And it does not shift responsibility to a marketplace or platform provider: where the retailer uses the system under its own authority, the retailer is the deployer. Retailers sometimes use external credentials, such as those from Pryme Intelligence Academy, as part of their evidence, but the duty to judge competence stays with the retailer. For sectors where more agents are high-risk, see Article 26 duties in banking and in healthcare; the broader picture is in AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is a product recommendation agent high-risk?
Generally not. Recommending products is not among the Act's high-risk uses, though transparency and consumer law still apply.
Does a pick-rate target set by an agent count as task allocation?
If the agent sets targets or assigns work based on individual workers' behaviour or past performance, it is likely within the high-risk workforce uses. Check the exact use with counsel.
Who should be trained first in an e-commerce business?
Shift and operations managers overseeing workforce agents, because that use is high-risk, affects many people at once and is easy to miss. Credit and recruitment overseers follow.