Retail — AI Act: recommendation systems and in-store cameras.

What does the AI Act cover?

The AI Act strictly regulates biometrics and remote identification in publicly accessible spaces. Behavioural analysis and in-store recognition fall within this sensitive scope. Non-biometric recommendation falls under limited risk.

Biometrics is also sensitive data under GDPR.

Is the 'Distribution' sector concerned?

Distributors deploying recommendation systems and cameras are deployers; publishers are providers. Biometric devices call for the utmost caution.

E-commerce/in-store recommendation without biometrics is of limited risk.

Detailed obligations

Sanctions & risks

Up to €35M or 7% for prohibited practices, in addition to the GDPR risk on biometrics and profiling.

Application timeline

• 1Entry into force. 1 August 2024.
• 2Prohibitions. Biometric restrictions since February 2025.

Common mistakes in the sector

• 1Hazardous biometric analysis. Deploying in-store recognition without a framework.
• 2Confused recommendation. Conflating recommendation and biometrics.
• 3Absent transparency. Failing to disclose the use of video/AI.
• 4GDPR ignored. Overlook the sensitivity of biometric data.

Practical case

A retailer was considering behavioural analysis cameras to measure in-aisle attention. Given AI Act restrictions and GDPR requirements, it abandoned biometric analysis in favour of aggregated, anonymous measurements.

Compliance roadmap

1. 1

   Inventory. Inventorying recommendation systems and cameras.

2. 2

   Qualify. Distinguish risk levels.

3. 3

   Exclude. Prohibiting unauthorised biometrics.

4. 4

   Inform. Ensure transparency.

5. 5

   Articulate. Handle biometrics under GDPR.

Frequently asked questions