AI governance for retail
In retail few use cases fall under Annex III, leading many companies to conclude the AI Act barely concerns them. That conclusion is wrong on two counts: workforce management sits among the high-risk cases, and price personalisation carries disclosure obligations coming from consumer law.
The regulatory framework
- AI Act, Annex III: workforce management systems, including shift planning and performance evaluation
- AI Act, Article 50, for conversational assistants and generated content
- GDPR, Article 22, on automated decisions that produce significant effects
- Consumer law on price personalisation based on automated decision-making
- Strict constraints on biometric systems in publicly accessible spaces
- GDPR for customer profiling and loyalty programmes, with Article 22 coming into play when an automated decision produces significant effects on the customer
Use cases and their risk level
| Use case | Classification | Note |
|---|---|---|
| Shift planning and workforce evaluation | High risk, Annex III | Worker management, often underestimated |
| Customer profiling and loyalty programmes | Minimal risk | GDPR obligations on legal basis and profiling |
| Prices personalised to individual customers | Limited risk with disclosure obligations | Consumers must be informed about personalisation |
| Product recommendation systems | Minimal risk | GDPR profiling obligations still apply |
| In-store video analytics with recognition | Strict constraints | A biometric area that must be assessed before installation |
| Demand forecasting and replenishment | Minimal risk | It should still be included in the inventory |
Where to start
- 1Start with systems that manage employees, because they carry the highest risk and are almost never classified as such
- 2Check whether and how price personalisation is communicated to customers, because the disclosure obligation exists independently of the AI Act
- 3Treat any in-store video analytics as a tightly constrained area before expanding it
- 4Measure the share of receipts linked to an identified customer, because every personalisation use case works only on that portion and in physical retail it is almost always a minority
What we do for the sector
The path is always the same and the content changes: it starts from the use case map, assesses impact before investing, validates with a prototype, and only then reaches production. Rapid prototyping runs through protot.ai, our validation unit.
Use case definition
The portfolio starts from systems that affect employees, because they carry the highest risk and are almost never classified as such, then moves to pricing, recommendation and demand forecasting. Each entry states its risk class and the disclosure obligations towards customers. The map also covers the franchise network, where staff don't belong to the chain and use tools the chain has chosen and distributed.
Impact assessment
We measure impact on margin, stock rotation and service, and separately assess impact on people for systems managing shifts and performance. For price personalisation the assessment covers how and when the customer is informed.
Prototyping and validation
With protot.ai we validate on a subset of stores or product categories before extending, because in retail the gap between a test result and a chain-wide result is almost always wider than expected.
Production and oversight
In production we support integration with point of sale, ERP and workforce planning systems, traceability of automated decisions, and oversight. For systems affecting employees, oversight includes engagement with worker representatives.