The EU AI Act's Reach Into the UK, Explained for Ecommerce Brands in UK

Direct answer: If your UK ecommerce brand sells to customers in the EU, uses AI for product recommendations, chatbots, dynamic pricing, or personalized marketing, the EU AI Act's transparency obligations now apply to you regardless of where your servers or headquarters sit. The law follows the customer, not the company address, which means Brexit does not exempt a UK storefront from disclosing when AI is making decisions that affect an EU shopper.

Deloitte UK's Tech Trends coverage of EU AI Act enforcement, published in August 2026, flagged a shift that a lot of UK ecommerce operators have been slow to register: the Act's transparency requirements are now being enforced against companies outside the EU that serve EU-based customers, not just EU-domiciled firms. This is the extraterritorial mechanic that GDPR taught the market years ago, showing up again in a different regulatory body. For a UK brand shipping to Germany, France, Ireland, or any other EU member state, "we're not an EU company" stopped being a meaningful shield the moment enforcement activity started targeting the customer relationship rather than the corporate registration. The practical effect is that AI-driven features baked into your storefront — the chatbot answering customer service queries, the recommendation engine surfacing "customers also bought," the dynamic pricing logic adjusting checkout totals — now carry disclosure obligations wherever an EU customer is on the receiving end. This piece walks through what the transparency rules actually require, why UK ecommerce brands specifically are exposed, and what changes in how you build and maintain your site.

What the EU AI Act's Transparency Rules Actually Require

The EU AI Act is a risk-tiered regulation. Most of the attention when it first passed went to the high-risk categories — AI in hiring, credit scoring, biometric identification. Ecommerce brands mostly sit outside those high-risk tiers, which is exactly why so many have assumed the law doesn't touch them. But the Act also carries a separate, lower-threshold layer of transparency obligations that apply much more broadly: when a system is interacting with a person in a way that could be mistaken for human interaction, or when it's generating or curating content that shapes a purchase decision, the operator has to make that visible.

In practice, for an ecommerce storefront, that lower tier covers:

• Chatbots and virtual shopping assistants that a customer might reasonably believe are human
• AI-generated product descriptions, review summaries, or marketing copy presented without disclosure
• Personalization and recommendation systems that materially steer what a customer sees or the price they're offered
• Any AI system making an automated decision with a legal or similarly significant effect on the customer (returns, fraud flags, credit or buy-now-pay-later approval)

Why This Reads as New in August 2026

The obligations themselves aren't brand new — the Act has been phasing in provisions since it passed. What Deloitte's Tech Trends piece flagged as the August 2026 inflection point is enforcement reach: regulators applying these transparency duties to non-EU operators serving EU customers, closing the gap that some UK and international sellers had been operating in on the assumption that only EU-incorporated companies were real targets. That's the part worth sitting with. A rule that exists on paper but isn't enforced against you functions, for planning purposes, like a rule that doesn't exist. A rule that's now actively being applied to companies outside the bloc changes the risk calculation immediately, even if the underlying text hasn't moved.

This distinction between "the law exists" and "the law is being applied to you" is exactly the pattern that caught out a lot of UK and international businesses during GDPR's own early enforcement years. The text was in force well before regulators started making examples of companies outside the EU, and plenty of legal and marketing teams treated the gap between publication and enforcement as a permanent grace period rather than a temporary one. The AI Act's transparency layer appears to be following the same arc, just compressed into a shorter window because regulators now have a template for how extraterritorial digital enforcement works. Teams that assume they have years before this becomes real are making the same bet that didn't pay off the first time around.

It's also worth being precise about what "enforcement" means at this stage rather than assuming a wave of fines has already landed on UK ecommerce brands. A precise figure for how many UK companies have been contacted, investigated, or penalized under this specific transparency provision is not publicly available, and this piece isn't going to invent one. What Deloitte's coverage establishes is the pattern and direction of enforcement activity — non-EU operators are now within scope of active attention, not merely within scope of the text. Reasoning from that pattern, rather than waiting for a headline case involving a recognizable UK retailer, is the more defensible planning posture.

Why This Specifically Matters to UK Ecommerce Brands

UK ecommerce sits in an unusually exposed position here, for reasons that are structural rather than incidental.

First, a meaningful share of UK online retailers sell cross-border into the EU as a matter of course — it's a natural adjacent market, shipping logistics are established, and currency/language localization has been solved for years. That means the EU customer base isn't a hypothetical edge case for most mid-sized UK brands; it's a real, often significant, revenue segment.

Second, UK ecommerce has been an enthusiastic early adopter of exactly the AI features the transparency rules target. Chat-based customer service, AI-written product copy at scale, and recommendation engines tuned by machine learning are now closer to default than exception on any storefront built or refreshed in the last two to three years. The overlap between "features UK brands have shipped to look competitive" and "features the Act requires disclosure on" is close to total.

Third, post-Brexit UK companies no longer have automatic access to EU regulatory guidance channels or lobbying influence the way they did as EU members. That means UK-based legal and compliance teams are often working from secondhand interpretation of EU enforcement patterns rather than direct engagement, which increases the odds of missing a shift like the one Deloitte flagged until it shows up as an actual notice.

Put together, you have a segment of companies (UK ecommerce) with high exposure (EU customers), high adoption of the triggering technology (AI features across the funnel), and comparatively low regulatory visibility. That combination is why this trend is worth acting on now rather than waiting for a UK-specific version of the rule to force the issue.

There's a fourth factor worth naming as well: the competitive dynamics of UK ecommerce make quietly removing AI features an unattractive option. Chat-based support reduces staffing costs and improves response times; recommendation engines lift average order value; AI-assisted content production lets smaller catalogue teams keep listings current. None of that value goes away because a transparency rule now applies — the sensible response isn't retreat from AI, it's making the AI visible. Brands that try to solve this by quietly disabling features to avoid the disclosure conversation altogether tend to give up real commercial advantage for a compliance problem that a labeling and documentation project would have solved more cheaply.

What Changes in Practice for Your Website or App

The transparency requirement is not a request to rip out AI features. It's a requirement to make their presence and role legible to the customer at the point of interaction. That has concrete implications for how a storefront is built.

Front-End Disclosure Points

Every place an AI system talks to, recommends to, or decides something about an EU customer needs a disclosure that's actually noticeable — not buried three clicks deep in a privacy policy. That typically means:

• A visible label on chat widgets clarifying AI vs. human ("You're chatting with our AI assistant")
• A short, plain-language note near AI-curated recommendation modules
• Clear marking of AI-generated or AI-assisted product content where it isn't obviously human-written
• A disclosed, explainable basis for any automated pricing or eligibility decision, with a path to human review

None of this is exotic from a development standpoint — it's UI and content work layered onto existing components. But it does mean auditing every AI touchpoint on the site, which for most ecommerce builds means the recommendation engine, the chat/support widget, any AI copywriting tooling feeding the CMS, and checkout-adjacent logic like dynamic pricing or fraud scoring.

Geo-Awareness and Regional Logic

Because the obligation is tied to whether the customer is in the EU, not where the company sits, storefronts serving both UK and EU customers increasingly need geo-aware logic that can apply the disclosure layer specifically to EU sessions, or apply it globally to avoid maintaining two versions of the same experience. Most engineering teams find it cheaper and safer to build the disclosure pattern once and show it everywhere, rather than fork behavior by region — region-forked compliance logic is exactly the kind of thing that quietly breaks during a redesign eighteen months later.

Documentation and Audit Trail

Beyond the visible UI change, there's a paper trail expectation: being able to show, if asked, what AI systems are running on the storefront, what they do, and how the transparency requirement is being met. This is architecture-adjacent work — knowing which parts of your stack are AI-driven is harder than it sounds once a site has accumulated third-party widgets, plugins, and personalization tools over several years, some of which were added without much scrutiny of what's actually happening inside them.

A useful way to think about this inventory is to walk the customer journey stage by stage rather than trying to list every tool from memory. On the landing and browse pages: is the layout or product ordering personalized by an algorithm? In search and category pages: are results re-ranked by anything beyond simple filters? On the product page: is any description, review summary, or "frequently bought together" module AI-generated or AI-curated? At checkout: is pricing static, or does it adjust based on customer signals? Post-purchase: does a chatbot or automated system handle support, returns, or fraud review? Walking the funnel this way tends to surface touchpoints that a tool-by-tool inventory misses, particularly plugins bundled into a platform theme or app-store add-on that a team installed years ago and stopped thinking about.

Content Management and Editorial Workflow

There's a quieter implication for teams that use AI to help draft or scale product copy, blog content, or marketing emails. If AI-assisted content is published without any indication of how it was produced, and it's the kind of content a reasonable customer might assume was written by a person specifically for their situation, that's squarely inside the spirit of the transparency requirement even where it isn't the most aggressively enforced category yet. Building a simple internal convention — a tag in the CMS, a note in the publishing workflow — for flagging AI-assisted content makes the eventual disclosure step far easier than trying to reconstruct authorship after the fact across hundreds of product listings.

What Should Ecommerce Brands Do About It Right Now?

Start with an honest inventory rather than a rebuild. Most UK ecommerce sites don't need new AI features removed — they need the existing ones surfaced and documented properly. A practical sequence looks like:

1. Map every AI touchpoint across the site and app — chat, recommendations, generated content, pricing logic, fraud/risk scoring, personalization.
2. Classify EU exposure — which of those touchpoints EU-based customers actually encounter, and under what conditions.
3. Design the disclosure layer — UI patterns for labeling AI interactions clearly without degrading the shopping experience.
4. Decide on global vs. regional rollout of the disclosure pattern, weighing engineering overhead against legal risk.
5. Document the system inventory so it's ready to produce if a compliance question comes in.

This is fundamentally a site architecture and front-end project as much as a legal one, which is where a development partner earns its keep rather than a compliance consultant working in isolation. Structuring this correctly also connects to broader work UK ecommerce brands are already doing on how their sites present information to both people and machines — our guide on 13 Types of Schema Markup Every Site Should Use covers how structured data disclosure patterns (which schema markup already does for search engines) parallel the kind of machine-readable transparency the AI Act is now asking for toward customers directly.

There's also a forward-looking angle worth naming: as AI assistants and answer engines increasingly mediate how customers discover ecommerce brands, that layer will care about transparency signals too. If you're already investing in visibility work like the strategies in How to Get Your Brand Mentioned by ChatGPT (2026), building clean, disclosed, well-documented AI touchpoints now avoids having to retrofit two different transparency projects — one for regulators, one for AI-mediated discovery — a year apart. And if your infrastructure roadmap already touches server-side changes for performance or sustainability reasons, it's worth reading alongside our piece on Green Data Centers in 2026, since EU infrastructure rules are moving on a similar "compliance follows the customer, not just the company" logic.

How This Gets Built: The Practical Development Work

None of the fixes here are exotic engineering, but they touch enough parts of a typical ecommerce stack that doing them piecemeal — a label added here, a note bolted on there — tends to create an inconsistent, easy-to-audit-and-fail experience. The more durable approach treats this as a proper front-end and architecture pass: auditing every AI-driven component, establishing one disclosure pattern used consistently across chat, recommendations, content, and pricing, and making sure the underlying system inventory is documented as part of the build rather than reconstructed later under pressure.

This is squarely the kind of work that falls under Web Development — not a one-off compliance patch, but a structural review of how AI features are surfaced, labeled, and documented across the storefront and any connected app. Ecommerce brands that treat this as routine site maintenance rather than a special compliance sprint tend to come out with a cleaner, more trustworthy customer experience regardless of what EU enforcement does next.

A Note on Timing

Waiting for a UK-specific enforcement notice before acting is a reasonable-sounding but risky strategy, because the exposure isn't hypothetical — it's tied to EU customers you may already have on your books today. The gap between "the rule technically applies to us" and "we've actually done anything about it" is exactly the gap enforcement activity targets. Brands that get ahead of it now are making a UI and documentation investment; brands that wait may be making that same investment under a deadline, with less room to get the design right.

Pricing Context: What This Kind of Work Typically Falls Under

Scope varies with how many AI touchpoints a storefront runs and how deep the documentation work goes, but most UK ecommerce brands land in one of three tiers:

Tier	Typical scope	Fits this project when...
Essential — $1,000	Single-touchpoint audit and disclosure UI (e.g., chat widget labeling)	You have one or two clear AI features and need a fast, contained fix
Growth — $2,000	Full site AI inventory, disclosure pattern design, and rollout across chat, recommendations, and content	Your storefront runs multiple AI features across the funnel and you want one consistent pattern
Enterprise — $4,000+	Full audit plus documentation system, geo-aware logic, and integration with app and backend pricing/fraud systems	You operate across web and app, with automated pricing or eligibility decisions in scope

These are starting reference points for the kind of engagement this work typically requires, not fixed quotes — actual scope depends on your current stack and how many systems need auditing.

Key Takeaways

• The EU AI Act's transparency rules apply based on where your customers are, not where your company is registered — UK ecommerce brands selling into the EU are in scope.
• August 2026 enforcement activity, per Deloitte UK's Tech Trends coverage, specifically targets non-EU operators serving EU customers, closing a gap many UK sellers assumed protected them.
• Chatbots, recommendation engines, AI-generated content, and automated pricing or eligibility decisions are the features most likely to trigger disclosure obligations.
• The fix is largely a front-end and documentation project: visible, plain-language AI disclosures at the point of interaction, plus a maintained inventory of which systems are AI-driven.
• Building one consistent disclosure pattern site-wide is generally cheaper and safer than forking behavior by customer region.
• Treating this as routine site maintenance now avoids a rushed, deadline-driven rebuild later if UK-specific enforcement follows.

Getting the audit and disclosure design right the first time saves you from redoing it under pressure later — if you want help mapping your AI touchpoints and figuring out where to start, book a meeting with our team.

Frequently Asked Questions

What is the EU AI Act, in plain terms?

It's an EU regulation that classifies AI systems by risk level and imposes different obligations depending on that tier, ranging from outright bans on the highest-risk uses to lighter transparency duties for systems that interact with or make decisions about people. Ecommerce features like chatbots and recommendation engines generally sit in the transparency tier rather than the high-risk tier.

Does the EU AI Act apply to UK companies after Brexit?

Yes, when a UK company serves customers located in the EU. The Act's reach is based on where the affected person is, not where the company is incorporated, which is the same extraterritorial logic GDPR uses.

Why is this suddenly a bigger issue in August 2026?

Deloitte UK's Tech Trends coverage flagged that EU enforcement activity is now actively reaching non-EU companies serving EU customers, rather than the rule sitting unenforced against foreign operators. Enforcement reach, not new legal text, is what shifted.

Does my UK ecommerce site need to comply if I only ship to the UK?

If you have no EU customers at all, the Act's transparency obligations toward EU persons don't apply to those interactions. The exposure is specifically tied to serving customers located in EU member states.

What counts as an "AI system" under these transparency rules for a storefront?

Chatbots and virtual assistants, recommendation and personalization engines, AI-generated or AI-assisted content, and automated decision systems like dynamic pricing or fraud/eligibility scoring are the categories most relevant to ecommerce.

Do I need to disclose every single AI feature, even minor ones?

The threshold generally centers on whether a customer could reasonably mistake the system for a human, or whether the system materially affects what they see or the outcome of their interaction. A minor internal-only AI tool with no customer-facing effect is a different case than a customer-facing chatbot.

What does a compliant chatbot disclosure actually look like?

A clear, visible label at the point of interaction — something as simple as "You're chatting with our AI assistant" displayed prominently, not buried in a linked policy page the customer never opens.

Do AI-written product descriptions need a label?

Where AI-generated or AI-assisted content is presented in a way that could be mistaken for editorial or human-authored content, disclosure is the safer position. Practices vary by content type, so treating clear labeling as the default reduces ambiguity.

What about AI-driven dynamic pricing?

Automated pricing decisions that materially affect what a customer pays fall into the disclosure and, in some cases, explainability territory — customers should be able to understand that pricing was automated and have a route to query or appeal it.

Is this the same as GDPR compliance?

No, though the two overlap in some ways and share the "reach follows the customer" logic. GDPR governs data handling and privacy; the AI Act's transparency rules govern disclosure of AI involvement in interactions and decisions. A site can be GDPR-compliant and still miss the AI Act's disclosure requirements.

How do I find out which parts of my site are actually AI-driven?

Start with an inventory: list every chat widget, recommendation module, content-generation tool, and pricing/fraud system in use, including third-party plugins added over time that may not have been fully vetted for what they do internally.

Can I just add a line to my privacy policy and call it done?

That's unlikely to satisfy the transparency intent, which is about disclosure at the point of interaction, not buried in a policy document most customers never read. Visible, in-context labeling is the safer standard.

What happens if a UK ecommerce brand doesn't comply?

Enforcement mechanics are still developing region by region, but the pattern from other extraterritorial regulations (GDPR being the clearest precedent) suggests penalties and reputational exposure scale with how clearly a company appears to have ignored a known, disclosed obligation rather than made a good-faith effort.

Is there a specific fine amount for ecommerce non-compliance?

A precise fine figure specific to ecommerce transparency violations isn't publicly established in a way that can be quoted reliably here; the safer approach is to treat the general pattern of escalating regulatory penalties for ignored disclosure obligations as the risk, rather than anchoring to any single number.

Does this apply to marketplaces and third-party sellers too, or just direct-to-consumer sites?

The transparency logic applies to whoever operates the AI system interacting with the EU customer, so both direct-to-consumer brands and marketplace operators running their own chat or recommendation systems are implicated, though the specifics of shared responsibility on marketplaces are still an evolving area.

How does this affect our mobile app, not just the website?

The same transparency logic applies to app-based AI features — in-app chat, push-notification personalization driven by AI, and app-based recommendation systems all carry the same disclosure expectations as their web equivalents.

We use a third-party chatbot vendor. Are they responsible, or are we?

As the operator presenting the AI system to your customers, your brand generally carries the disclosure responsibility even when the underlying technology is licensed from a vendor, so it's worth confirming your vendor's tooling supports the labeling you need rather than assuming they've handled it.

How long does it typically take to audit and fix AI disclosure gaps on a mid-sized ecommerce site?

It depends heavily on how many AI touchpoints exist and how tangled the current stack is, but a focused audit and disclosure rollout is typically a matter of weeks rather than months for a site with a handful of clearly identified AI features.

Will adding AI disclosures hurt conversion rates?

Well-designed, unobtrusive disclosure (a small label, a short note) is unlikely to meaningfully affect conversion — the goal is legibility, not a disruptive interruption to the shopping flow, and thoughtful UI design keeps it that way.

Should we remove AI features instead of disclosing them?

For most ecommerce brands, disclosure is far cheaper than losing the functional and competitive benefit of the AI features themselves. Removal is rarely the practical answer unless a specific feature carries disproportionate risk.

What's the difference between the AI Act's high-risk tier and the transparency tier?

High-risk systems (like those used in hiring or credit scoring) face much stricter obligations, including conformity assessments. Transparency-tier systems, which cover most ecommerce AI features, mainly need to be clearly disclosed to the people interacting with them.

Could UK-specific AI regulation eventually mirror the EU AI Act?

It's plausible given the UK's regulatory history of tracking EU frameworks in adapted form, but nothing specific to ecommerce has been confirmed as of this writing — building clean disclosure practices now positions a brand well regardless of which direction UK-specific rules take.

Does this affect B2B ecommerce as well as B2C?

The transparency logic centers on interactions with natural persons, so B2B platforms where AI interacts with individual buyers (procurement chat assistants, personalized B2B catalogs) are still in scope, even if the commercial relationship is business-to-business.

What's the first thing our team should actually do this week?

Compile a simple list of every AI-driven feature on your site and app, and note which ones EU customers are likely to encounter — that single inventory is the foundation for every other step.

Do we need a lawyer, a developer, or both?

Both roles matter, but the disclosure implementation itself — labeling, UI patterns, documentation of the system inventory — is development work. Legal input helps confirm what needs disclosing; development delivers the actual disclosure.

How do geo-aware disclosure rules interact with a site that doesn't currently detect customer location?

If your storefront has no location-detection logic today, you'd either need to add it to scope disclosures regionally, or take the simpler route of applying the same disclosure pattern to all customers regardless of region, which avoids the added engineering overhead of geo-targeting.

Is applying disclosures globally overkill if we only sell a little into the EU?

It depends on your risk tolerance and how much the EU segment is likely to grow, but many teams find that maintaining one global standard is less error-prone than maintaining two different customer experiences that need to stay in sync indefinitely.

What documentation should we keep on hand in case of an inquiry?

A maintained list of AI systems in use, what each one does, where in the customer journey it appears, and how the disclosure requirement is being met for each — essentially a living inventory rather than a one-time report.

Does this affect how we use AI internally, like for inventory forecasting?

Internal-only AI systems that don't interact with or make decisions directly affecting customers generally fall outside the transparency obligations that target customer-facing interactions, though internal tools that feed customer-facing decisions (like fraud scoring) are a different case.

How does this connect to schema markup and structured data on our site?

Structured data and AI transparency disclosure are both, at their core, about making machine-driven processes legible — one to search engines and AI crawlers, the other to human customers. Sites that already think carefully about structured disclosure tend to adapt more easily to this kind of requirement.

Will AI search assistants and answer engines start caring about this transparency too?

It's a reasonable expectation that as AI-mediated discovery grows, platforms surfacing brands to consumers will increasingly weight clear, well-documented AI practices favorably, though no specific ranking or citation mechanism tied to this has been confirmed.

What's the risk of doing nothing right now?

The immediate risk is compliance exposure if an EU regulator or customer complaint triggers scrutiny; the longer-term risk is having to retrofit disclosure and documentation under time pressure rather than as a planned project.

Can this work be folded into a broader website redesign?

Yes, and for many brands that's the more efficient path — auditing AI touchpoints and building the disclosure pattern as part of a planned redesign avoids a separate, disconnected compliance project layered onto an unchanged site.

How do we handle AI-generated customer reviews summaries?

If a summary is AI-generated rather than a direct customer quote, a brief label clarifying that ("Summary generated from customer reviews") keeps the presentation honest and reduces ambiguity about what's a real quote versus a synthesized summary.

Does this apply to email marketing personalization too?

Email is a less direct case than on-site interaction, but where AI is materially shaping what offers or content a customer receives, applying the same disclosure principle in your broader marketing practice is a reasonable, low-cost precaution.

What if our recommendation engine is a standard ecommerce platform feature, not something we built ourselves?

The disclosure obligation attaches to how the system is presented to your customers, not to who built the underlying technology, so platform-native recommendation features still need to be accounted for in your inventory and disclosure plan.

How do smaller UK ecommerce brands without in-house legal teams approach this?

Start with the practical inventory and disclosure work, which doesn't require deep legal expertise to begin, and bring in outside legal or development help to review and finalize the approach once the groundwork is mapped.

Does the size of our EU customer base change how urgently we should act?

A larger EU customer base increases exposure, but even a small, growing segment is worth addressing early, since retrofitting disclosure later tends to cost more than building it in while the AI touchpoints are still relatively few.

What's a realistic first milestone for a Growth-tier engagement on this?

A completed AI touchpoint inventory and an approved disclosure pattern ready to roll out across chat, recommendations, and content is a reasonable first milestone before moving into full site-wide implementation.

Should disclosure language be different in different EU languages?

Yes — disclosure that's only in English on a site serving French or German customers undermines the purpose of clear communication, so localized disclosure copy matters as much as the underlying mechanism.

How does this interact with cookie consent banners we already have?

They're separate mechanisms serving separate rules (cookie consent relates to data collection, AI disclosure relates to system transparency), so one doesn't substitute for the other, though both should be designed to avoid overwhelming the customer with layered pop-ups.

Will this requirement get stricter over time?

Regulatory patterns in this space, including GDPR's own trajectory, suggest enforcement tends to tighten rather than loosen once a framework is established, which is a reasonable basis for treating early compliance as the more durable strategy.

What's the difference between disclosure and explainability?

Disclosure means telling the customer an AI system is involved; explainability means being able to describe, at least at a high level, how it reached a particular outcome. Ecommerce transparency rules lean more heavily on disclosure, with explainability mattering more for higher-stakes automated decisions like pricing or eligibility.

Do returns and refund AI systems need disclosure too?

If an AI system is making or materially influencing a returns or refund decision that affects the customer, disclosure and a path to human review are both worth building in, given how directly that touches customer trust and satisfaction.

How do we test whether our disclosure UI actually works for customers?

Basic usability testing — showing the labeled chat widget or recommendation note to a handful of real users and asking what they understood — is enough to confirm the disclosure is legible rather than just technically present.

Is this only relevant to large ecommerce brands, or does it affect smaller stores too?

It affects any UK ecommerce operation serving EU customers regardless of size; smaller stores are less likely to face early enforcement scrutiny but aren't exempt from the underlying obligation.

What's the relationship between this and the UK's own data and AI regulatory approach?

The UK has generally taken a more principles-based, less prescriptive approach to AI regulation than the EU, which is part of why UK brands can be caught off guard by EU rules reaching them despite no equivalent domestic requirement yet existing.

How do we keep this from becoming a one-time fix that goes stale?

Treat the AI system inventory as a living document reviewed whenever a new AI feature, plugin, or vendor tool is added to the site, rather than a report generated once and filed away.

What should we ask a development partner before starting this work?

Ask how they'll approach the initial AI touchpoint audit, whether they'll build one consistent disclosure pattern or region-fork the experience, and how the resulting documentation will be maintained after launch — those three answers tell you a lot about whether the engagement will hold up over time.

Where should we start if we're not sure how exposed we actually are?

A short conversation to map your current AI features against your EU customer footprint is the fastest way to find out — book a meeting and we can walk through your specific setup.