AI in retail: pricing, recommendations and profiling

Short answer: AI in retail rarely falls under the high-risk regime, but it sits squarely at the crossroads of three frameworks. The AI Act bans manipulative systems and requires transparency for chatbots and generated content; the GDPR governs when you may profile and decide automatically; the DSA sets requirements for recommender and advertising systems on platforms. Looking only at the AI Act misses most of the obligations.

Dynamic pricing

Dynamic pricing — prices that move with demand, stock or competition — is permitted in itself. The line lies at personalised pricing based on individual behaviour or profiles. Under the GDPR that requires a valid legal basis and transparency; the consumer must know a price has been tailored to them. The AI Act (prohibited practices) further bans pricing systems that exploit vulnerabilities — for example using financial distress or age to push someone into a purchase.

Recommendations and profiling

Recommender systems run on profiling: the system infers preferences from behaviour. That is processing of personal data and falls under the GDPR, including the rights to information and to object. On large online platforms the DSA requires that the main parameters of the recommender system are explained in the terms, and that very large platforms offer at least one option without profiling. Targeting ads on the basis of special-category data (health, religion) is prohibited under the DSA, as is targeted advertising to minors.

Manipulation and transparency

The AI Act draws a hard line at manipulation. Systems that use subliminal or deceptive techniques to materially distort behaviour and can cause harm are prohibited. In practice this means: no AI-driven fake scarcity or misleading urgency, and no exploitation of vulnerable groups. In addition, Article 50 transparency applies: customers must know they are talking to a chatbot and that product images or text are AI-generated.

Overlap with other rules

Alongside these three, consumer law (unfair commercial practices), the Omnibus Directive (price transparency) and sectoral rules also apply. The common thread: the same application is hit by several regimes at once. A recommender engine is processing for the GDPR, a recommender system for the DSA and possibly a transparency duty for the AI Act. Related applications recur in AI in legal services and AI in housing allocation.

What to do

• Map your applications and test each against the AI Act, GDPR and DSA — not one regime at a time.
• Document the legal basis for profiling and personalised pricing, and offer an opt-out.
• Avoid manipulation: no AI-driven deception, no exploitation of vulnerabilities.
• Be transparent that customers are dealing with AI (chatbots, generated content).
• Check platform duties under the DSA if you operate an online platform.

AI in retail is rarely "prohibited" or "high-risk", but almost always subject to a stack of transparency and data rules.