Sector guide
The EU AI Act for retail, marketing and media
Little in retail is high-risk — recommendation and personalisation are not named in Annex III at all. What does bite here are the manipulation prohibitions and, from the 2026 amendment onward, the duty to mark synthetic content.
What the Act actually names in this sector
These are the provisions that reach retail, marketing and media, quoted from the Official Journal. Everything below follows from them.
an AI system that deploys subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques
Article 5(1)(a) →exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation
Article 5(1)(b) →Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated
Article 50(2) →
Common use cases, classified
Prohibited
Banned outright. There is no compliance route — the practice has to stop or change.
- Persuasion below conscious awareness
Subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause significant harm are prohibited.
Article 5(1)(a) → - Targeting based on age, disability or hardship
Exploiting vulnerabilities due to age, disability or a specific social or economic situation, so as to distort behaviour and cause significant harm, is prohibited.
Article 5(1)(b) → - Inferring sensitive traits from biometrics
Biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is prohibited.
Categorisation on other attributes is high-risk under Annex III point 1(b) rather than prohibited.
Article 5(1)(g) →
Transparency duty
Not high-risk, but people must be told. Disclosure and content-marking duties under Article 50.
- AI-generated marketing content
Providers of systems generating synthetic content must mark outputs in a machine-readable format detectable as artificially generated.
Article 50(2) →
No specific duty
Not named in the Act's risk tiers. The AI literacy duty in Article 4 still applies, as does law outside the Act.
- Product recommendation and personalisation
Recommendation is not named in Annex III and is not a safety component, so no high-risk obligation attaches under the Act.
Consumer, data protection and platform law still apply; this answers the AI Act question only.
Article 6 →
What gets misread here
Over-classification is the quieter failure: treating something as high-risk when the Act carves it out costs real money and never triggers a complaint, so nobody catches it.
“Personalisation is profiling, so it must be high-risk.”
Recommendation and personalisation are not named in Annex III. The AI Act imposes no high-risk obligation on them — though consumer, data protection and platform law still apply.
Annex III →“Persuasive design is just marketing.”
Where techniques are subliminal, purposefully manipulative or deceptive, materially distort behaviour and cause significant harm, they are prohibited outright.
Article 5(1)(a) →
Dates that matter in this sector
- 2 Feb 2025Prohibited practices and AI literacy apply — Since 2 February 2025 the first eight prohibited AI practices in Article 5 have been unlawful across the EU, and every provider and deployer has owed an AI literacy duty under Article 4. Two further prohibitions were added later and apply from 2 December 2026.
- 2 Aug 2026Transparency obligations and the general application date — From 2 August 2026 the Article 50 transparency rules apply: people must be told when they are interacting with an AI system, and synthetic audio, image, video and text must be marked in a machine-readable format.
Dates are as amended by the Digital Omnibus. See the full timeline for what each one covers.
What the Commission has said
These guidelines are not binding, but they are the Commission’s own reading of the provisions above, and they are the first place a supervisory authority will look. Where they and this guide differ, follow them.
- Guidelines on prohibited AI practices ↗European Commission, February 2025 — interprets Article 5
- Guidelines on the definition of an AI system ↗European Commission, February 2025 — interprets Article 3, Article 6
- Guidelines on transparency obligations for providers and deployers ↗European Commission, 2025 — interprets Article 50
What to do next
Screen your own systems with the scope finder, run a single system through the risk classifier, or work the obligations in order with the checklist.
This guide points you at the provisions that govern your sector. It is not legal advice, and whether a particular system meets a provision turns on facts about that system and on whether you hold it as provider or deployer — see Article 3 and Article 25.