EU:s AI-akt och algoritmisk styrning på online-marknadsplatser

In the digital corridors of the EU, regulators are sharpening their pencils—and their legal teeth. At the center of this regulatory wave is the EU Artificial Intelligence Act, the world’s first major legislation aimed at taming the wild west of artificial intelligence. And if you think this is just a matter for robot developers in labs, think again. Online marketplaces—yes, those slick platforms that serve you oddly perfect product recommendations and price suggestions—are front and center in this legal evolution.

The EU AI Act (AIA) aims to create a future where AI is safe, transparent, and respectful of fundamental rights. That’s a noble goal. But for platform operators, it translates to a host of new obligations, especially when algorithms make decisions that impact users, sellers, or markets. In this article, we explore what the AI Act means for online marketplaces, how it intersects with existing laws like the DSA and GDPR, and how to stay on the compliant—and competitive—side of this fast-evolving landscape.

What is the EU AI Act?

Den EU AI Act is a landmark piece of legislation proposed by the European Commission in 2021 and expected to enter into force soon. Its aim? To regulate AI systems based on their risk levels:

• Unacceptable risk AI systems (e.g., social scoring by governments) are banned.
• High-risk systems (e.g., credit scoring, CV screening) face strict requirements.
• Limited and minimal risk systems (e.g., spam filters, chatbots) must meet transparency standards.

Marketplaces that use AI to rank search results, match products to users, or detect fraud may fall into the limited or high-risk categories, depending on how deeply those systems influence users’ rights or livelihoods.

How AI Shows Up on Marketplaces

If your platform uses machine learning to:

• Suggest products based on past behavior
• Adjust prices dynamically
• Filter or demote low-quality listings
• Moderate reviews or detect fake accounts

Then congratulations: you’re using AI—and you may need to rethink how it’s governed. The more automated your decision-making process, the closer regulators will look.

AI governance doesn’t only apply to humanoid robots or self-driving cars. It also applies to the recommendation system that nudges users to buy one phone case over another or to the fraud detection tool that quietly suspends a seller’s account overnight.

Key Obligations for Online Marketplaces Under the AI Act

1. Risk Classification Platforms must assess whether their AI tools qualify as high-risk systems, especially if they impact consumers’ legal rights, financial stability, or access to economic opportunities. An AI that filters or blocks seller accounts based on automated behavioral patterns may very well qualify.
2. Transparency Requirements Even if an AI system is considered low risk, platforms must inform users that they’re interacting with or being affected by AI. This includes product recommendations, price changes, and ranking mechanisms. No more hiding the algorithm behind the curtain like it’s the Wizard of Oz.
3. Data Governance and Quality High-risk AI systems must be trained on high-quality, relevant, and bias-free datasets. That means platforms will need to audit their training data and eliminate patterns that could lead to discriminatory outcomes. If your product recommendation engine thinks women only want pink gadgets or assumes sellers from one country are more fraudulent, it’s time for a rethink.
4. Human Oversight Automated systems must include human checks—especially before making impactful decisions like delisting a seller, rejecting a listing, or flagging user behavior. Regulators are increasingly wary of “black box” systems that can’t be explained or challenged. You can’t just blame it on the algorithm anymore.
5. Robust Documentation Platforms using high-risk AI systems must maintain detailed technical documentation, risk assessments, and logs of system performance. Think of it as a user manual for regulators—and yes, it better be more helpful than the one that came with your Wi-Fi router.

The Intersection with DSA and GDPR

If you’re thinking, “Wait, we already have to comply with the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR)—now this too?” You’re not alone. But the key is understanding how these three frameworks interact.

• GDPR governs the processing of personal data, including profiling.
• DSA governs platform accountability, including algorithmic transparency and content moderation.
• AI Act governs the design, deployment, and risk management of AI systems.

In practice, a single algorithm may trigger all three laws. A recommendation system, for instance, might:

• Samla in beteendedata (GDPR)
• Ranka innehåll som påverkar synlighet (DSA)
• Fatta högriskbeslut som kräver transparens och tillsyn (AI-akten)

Det är en laglig trippelmacka.

Vad sägs om AI från tredje part?

Många plattformar integrerar AI-tjänster från tredje part – till exempel API:er för bedrägeribekämpning eller personaliseringsmotorer som byggts av leverantörer. AI-förordningen håller plattformar ansvariga inte bara för vad de bygger, utan även för vad de använd. Om ditt tredjepartsverktyg beter sig illa är det också ditt problem vad gäller efterlevnad.

Det innebär att plattformar måste:

• Veterinärleverantörer noggrant
• Granska deras dokumentation
• Avtalsmässigt säkerställa efterlevnad och revisionsrättigheter

Bara för att du inte skrev algoritmen betyder det inte att du kan se åt andra hållet.

Hur man förbereder sig: En praktisk checklista

• Kartera dina AI-system: Identifiera varje plats där AI används, direkt eller via tredje part.
• Klassificera risken: Använd AI-lagens kategorier för att förstå din efterlevnadsbörda.
• Granska din data: Eliminera partiskhet, kontrollera kvalitet och dokumentera källor.
• Lägg till transparensmeddelanden: Låt användare veta när de påverkas av algoritmer.
• Designa processer med människan i loopen: Tillåt överklaganden, manuell granskning och åsidosättanden.
• För loggar och dokumentation: Om tillsynsmyndigheter knackar på dörren, var beredd att förklara hur ditt system fungerar.

Slutgiltiga tankar

EU:s AI-akt är en game-changer för online-marknadsplatser. Den kräver inte bara efterlevnad, utan ett kulturellt skifte – från att endast optimera för engagemang och konverteringar till att designa system som är förklarliga, rättvisa och ansvarstagande. Detta innebär inte att plattformar måste överge AI. Men det betyder att de måste behandla det inte som en svart låda av magi, utan som ett reglerat verktyg med verkliga konsekvenser.

Så om din algoritm avgör vem som ser vad, vem som säljs till eller vem som blir bannlyst, är det dags att kliva fram från bakom gardinen. Framtiden för pålitlig AI beror inte bara på smartare kod – utan på smartare styrning.