The EU AI Act's main compliance deadline was on 2 August 2026. If you sell into the EU on Magento Open Source or Adobe Commerce, this is your guide to what actually applies, where Hyvä sits in the picture, and the practical steps to get ahead of the deadline.
A quick reframe on the question
The question we've been getting: "Is my Magento store AI Act compliant?"
The honest answer starts one step earlier. The AI Act doesn't apply to your Magento store. It applies to AI systems, and to the organisations that provide or deploy them. Your store is the environment those AI systems run inside.
So the real question is: "Which AI systems are running in your store, and who's on the hook for what?" That's where practical work sits.
AI Act, GDPR, and why they stack
Most Magento and Adobe Commerce merchants already handle GDPR. It's tempting to assume the AI Act is more of the same, or a superset of GDPR. It isn't.
GDPR governs how you process personal data. The AI Act governs how AI systems are built, deployed, and disclosed. If your AI touches customer data – and most e-commerce AI does – you need to comply with both frameworks at the same time. Same store, two rulebooks. They don't replace each other; they stack.
Where Hyvä sits
Since we're on the topic: Hyvä products aren't AI systems, so they're not inside the AI Act's scope in the first place.
Hyvä Commerce, Hyvä Enterprise, Hyvä Theme, Hyvä Checkout, Hyvä UI, Hyvä POS, are all deterministic. No models, no automated decision-making, no algorithmic personalisation baked in. Hyvä is the frontend and infrastructure layer beneath your stack. It doesn't add an AI compliance surface.
One clarification worth making: if you use Hyvä Enterprise with Adobe Sensei, Sensei is Adobe's AI. The same rules apply to it as to any other AI in your stack.
The compliance surface lives with whatever AI you layer on top of Hyvä – or on top of default Magento, for that matter:
chatbots, product recommendations,
AI-generated copy,
dynamic pricing,
background-removed imagery,
fraud detection.
Those are the places to focus.
The four steps to take
Now the practical work. Here's what to do, in order.
Step 1: Audit the AI already running in your store
You can't comply with what you haven't mapped. Start by walking your stack.
Look for:
Chatbots and virtual assistants (LiveChat, custom LLM widgets)
Search and product recommendations (Adobe Sensei, Algolia, Klevu, native Magento tools)
AI-generated product copy (OpenAI or Claude via API, marketplace extensions)
AI imagery (background removal, synthetic models, upscalers)
Dynamic pricing and BNPL credit scoring
Fraud detection and automated moderation
Admin-side AI (product enrichment, catalogue automation, translation)
Auditing your AI stack takes more than a browse. Some AI announces itself and some doesn't. Fraud detection, admin-side classifiers, and backend recommendation engines often run invisibly, with nothing surfacing to a user or a merchant walking through the site. The reliable path is to ask, module by module: your agency, your hosting partner, and each of your extension vendors. Get their answers in writing.
Example: A typical mid-sized retailer might run Klevu for search, Doofinder for support chat, an OpenAI-powered extension for meta descriptions, and background removal in their DAM. That's four AI systems in one store. All four go on the map.
Step 2: Match each AI to its risk category
The AI Act sorts AI systems by risk level. For e-commerce, most fall into two buckets:
Limited risk. Chatbots, AI-generated content, AI imagery. The main obligation is transparency: users must know they're interacting with AI, and AI-generated content must be labelled.
Minimal risk. Product recommendations, standard search personalisation. Few strict obligations, though general consumer protection law still applies.
One important exception: dynamic pricing and BNPL credit scoring can be high-risk if they profile consumers to alter financial terms or assess creditworthiness. If that's in your stack, treat it separately and get legal advice.
Example: a chatbot answering pre-sales questions is limited risk. A recommendation algorithm suggesting related products is minimal risk. A pricing engine that quietly raises prices for logged-in customers who abandon carts is potentially high-risk, and needs a different level of care.
Step 3: Make disclosure visible where it happens
Article 50 is the transparency article. It's not satisfied by burying a note in your T&Cs. Disclosure has to be visible at the point of interaction:
AI chat widgets need a clear label before substantive interaction begins
AI-generated product copy needs an "AI-assisted" tag (when using the Hyvä CMS, content created using artificial intelligence will be automatically tagged)
Synthetic imagery and video need machine-readable markers as well as visible labels
Deepfakes must be clearly identified as artificial
This is a frontend job, not a legal one. It's design and copywriting more than paperwork. Which is good news, because it's cheaper to fix than most compliance work.
A simple test: could a first-time visitor to your site notice the disclosure, understand it, and act on it within the first thirty seconds of the AI interaction? If not, redesign.
A brand-side reason to take this seriously. There's a second reason to keep humans in the loop on AI-generated content, beyond compliance. It is AI slop – the mediocre output you get when AI generates copy or content without meaningful human review. Ship AI slop once and it's embarrassing. Ship it at scale and it's damaging. Compliance gets you a disclosure label. Editorial oversight keeps the quality up.
Step 4: Pin down your vendors
If you use a third-party AI extension or SaaS tool, you're the legal deployer but the vendor is the provider, and they carry compliance obligations of their own. They should be helping you meet yours.
Ask them for:
Their conformity assessment or self-declaration
Documentation on how the AI system was trained
Content moderation and safety policies
Compliance logs and audit trails
A named contact for regulatory questions
A five-question version if you want to move fast: Where is the model hosted? What was it trained on? What happens to our customer data when it passes through your system? Do you have an EU representative for AI Act queries? Can you show us your conformity documentation?
The answers should be quick and clear. If a vendor can't produce them, or gets defensive when asked, that's a signal. The AI Act shifts risk toward vendors that can't demonstrate compliance. You don't want to inherit it.
Bonus step: train the humans
The Act includes an AI literacy provision. Anyone in your business who deploys or oversees AI systems – customer service managers running AI chat, marketers using AI-generated copy tools, catalogue managers using AI product enrichment – needs baseline training in what the tools do, where they fail, and how to spot problems.
This is easier than it sounds. A one-hour internal session per team, refreshed annually, is usually enough. Document that it happened.
How Hyvä thinks about AI
Because it comes up: here's how we approach AI as a company, and what that means for merchants building on us.
We don't ship AI features because the market expects them. We've watched other platforms invest heavily in AI features that few merchants use, then sunset them a year later. Our default is to add AI to a product only when it clearly helps you, your customers, or your team.
We're making Hyvä understood by AI, not the other way round. Our documentation, code patterns, and admin architecture are being tuned so that when your agency uses AI-assisted development, the model has good source material to work from. In practice, that means shorter project timelines, lower development costs, and less AI slop finding its way into your codebase.
We're giving you a neutral AI layer, not a locked-in one. We've built an open-source AI module for the Magento admin – one universal way to integrate AI services, so extension vendors don't each have to ship their own API-key config panel. Our CMS lets you pick which AI agent to use, rather than tying you to one provider. In the Hyvä CMS, AI assisted content creation will be soon automatically tagged to keep your store compliant.
The stakes, briefly
Fines under the AI Act run up to €15 million or 3% of global annual turnover, whichever is higher. That's the ceiling for the most serious violations.
For most Magento and Adobe Commerce merchants, the more immediate risk isn't a fine – it's a customer complaint or a regulator query that surfaces gaps you didn't know you had. A few hours of internal review now is much cheaper than either.
The short version
The AI Act sounds daunting because it's new, broad, and comes with big fine numbers. In practice, for most e-commerce merchants, it's a mapping exercise, a frontend job, and a vendor conversation. None of those are new skills.
Hyvä sits underneath all of it – deterministic and unopinionated – as the layer that doesn't add to your compliance load. Whatever you decide to build on top is where the work is.
One thing to hold onto: the AI Act is still settling. Its Codes of Practice, enforcement guidance, and our own product roadmap will keep evolving. If any of that changes what applies to Hyvä products – or what you need to do about it to stay compliant — we'll flag it early enough that you can plan around it.
This guide is for orientation, not legal advice. If dynamic pricing, BNPL, or profiling sits in your stack, or if you're unsure whether an AI system in your store qualifies as high-risk, speak to a qualified data protection lawyer.
