← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for e-commerce and shopping agents

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Product recommendations, search ranking, dynamic pricing and shopping assistants are not listed in Annex III, so the high-risk duties usually do not apply. Three things still do:

• Article 50 transparency, from 2 August 2026: a shopping assistant must make clear it is an AI unless that is obvious. Providers of generative systems must mark synthetic output in a machine-readable format, and deployers must disclose deepfakes, which can include generated images of real-looking people or places presented as authentic.
• Article 5 prohibitions, in force since 2 February 2025: manipulative or deceptive techniques, or exploitation of vulnerabilities such as age, that materially distort behaviour and cause significant harm. An agent tuned to push vulnerable users into purchases is where this line sits.
• Annex III point 5(b): if checkout includes buy-now-pay-later or instalment credit, the creditworthiness check on the shopper is high-risk.

The logging duties that follow

For the parts that are high-risk, such as a BNPL decision:

• Art. 12 (providers): automatic recording of events for the credit component.
• Art. 19 (providers) and Art. 26(6) (deployers): keep those logs for at least six months, with human oversight by the deployer (Art. 26(2)).

For everything else, no AI Act retention period applies, but consumer disputes do. See Art. 50 transparency.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

Agentic commerce adds a new dispute: an agent bought something on a customer's behalf, and the customer says they never asked for it. The evidence is the mandate, the spending rule and the order, in sequence.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"run.start","data":{"name":"reorder-agent","meta":{"user":"u_6621","mandate":"reorder coffee beans, max 40 EUR"}}}
{"seq":3,"type":"tool.result","data":{"name":"search_catalog","output":{"sku":"CB-1KG-ETH","price_eur":46.90}}}
{"seq":4,"type":"policy.decision","data":{"kind":"tool.call","action":"block","hits":[{"rule":"spend-cap","message":"46.90 > 40.00"}]}}
{"seq":5,"type":"tool.call","data":{"name":"ask_user","input":{"question":"Price is 46.90 EUR, confirm?"}}}

A hash chain shows the spend cap fired before any order, and that no confirmation was invented afterwards.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign runs where an agent spends money or makes a commitment on a customer's behalf, and keep the attestation with the order until the return and chargeback windows close.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the purchase was what the customer wanted. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. Langfuse, vs. LangSmith.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.