Mapping the regulatory landscape for fashion AI

The through-line: if your AI touches a body, a price, or a green claim, at least one of these applies.

Use case 1: body-scanning try-ons

A virtual try-on that maps clothing onto a live camera feed may only process image data transiently. But the moment you estimate measurements to identify or single out a person, you may be handling biometric data under GDPR.

Key distinction: GDPR restricts biometric data used "for the purpose of uniquely identifying a natural person." A model that estimates a size from body shape is a grey area. A model that recognizes *who* the person is crosses clearly into special-category biometric data, which needs a strong legal basis (usually explicit consent).

The AI Act adds a second layer. It bans real-time remote biometric *identification* in public spaces (with narrow law-enforcement exceptions) and restricts emotion recognition. A try-on mirror in your flagship store that guesses a shopper's mood to push product would sit in dangerous territory.

Guardrails before launch:

• Process on-device where possible, so raw body images never hit your servers.
• Get explicit, unbundled consent for the scan. A pre-ticked box is not consent under GDPR.
• Run a DPIA (Data Protection Impact Assessment), a documented risk analysis GDPR requires for high-risk processing like biometrics.
• Set short retention. Delete scan data after the session unless the user saves a profile.

Use case 2: personalized pricing

Showing different prices to different users based on inferred willingness to pay is legal in narrow forms but heavily constrained.

GDPR gives users the right not to be subject to decisions "based solely on automated processing" that significantly affect them, plus transparency duties: you must tell people that pricing is personalized and on what logic. The Consumer Rights Directive already requires disclosure when a price is personalized using automated decision-making.

The bigger trap is proxy discrimination. If your pricing model uses features that correlate with protected characteristics (postcode standing in for ethnicity, device type for income), you can produce discriminatory outcomes even without meaning to. That exposes you to anti-discrimination law, not just data law.

A simple check every team can run: audit price dispersion across protected groups.

This does not prove fairness on its own, but a persistent gap is a red flag that demands a documented explanation before you ship.

Use case 3: automated sustainability labels

Say you train a model to generate a "sustainability score" for each product, then display it as a badge. This is where AI risk meets green-claims risk head-on.

If the model outputs "eco-friendly" or a leaf icon based on incomplete or unverifiable data, you have made a misleading environmental claim. Under the 2024 EU consumer directive, generic green claims without recognized proof are restricted, and sustainability labels must rest on a certification scheme or be set by public authorities.

Two AI-specific dangers:

Hallucinated justification. A generative model that writes label copy ("made from ocean-recovered fibers") without a verified data source is a compliance incident waiting to happen. Never let a language model assert a factual green claim it cannot trace to a source.

Model opacity. If a regulator or consumer asks "why does this dress score 8 out of 10," you must be able to answer. A score no one can explain is not defensible.

Guardrails:

• Bind every claim to a data source. If the source is missing, the model outputs "insufficient data," not a guess.
• Keep a claim-to-evidence log for each SKU.
• Have a human review new claim *types* before they appear in the storefront.

Turning laws into a governance workflow

Regulation only protects you if it becomes a repeatable process. Fashion teams that ship AI well tend to run four checks in order.

1. Classify the system

Before building, ask: what risk tier does the AI Act assign this? Most fashion features (recommendations, try-ons, chatbots) are limited-risk, meaning transparency duties: tell users they are interacting with AI. Some (certain biometric uses) climb higher. Write the classification down.

2. MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → the data

List every personal data field the system touches. Flag biometric and special-category data. This drives whether you need a DPIA and explicit consent.

3. Test for the main AI risks

Fashion AI fails in recognizable ways:

• Bias: sizing models trained mostly on one body type recommend poorly for others.
• Drift: a demand model tuned on last season degrades as trends move.
• HallucinationHallucinationA hallucination is when an AI model generates output that is fluent and confident but factually wrong, fabricated, or unsupported by its source data.View full definition →: generative copy invents materials or certifications.
• Opacity: no one can explain a price or a score.

Run the fairness check, a hold-out accuracy test, and a claim-tracing review before launch, and on a schedule after.

4. Assign accountability

Name a human owner for each model. Under the AI Act, high-risk systems need human oversight by design, meaning a person who can intervene or stop the system. Even for lower-risk features, a named owner beats diffuse responsibility.

The balance of power

Enforcement is real. European DPAs have issued large GDPR fines, and consumer authorities across member states have opened greenwashing investigations against apparel brands. National market-surveillance authorities will police the AI Act. The pattern to expect: coordinated action, where one feature draws scrutiny from a data regulator and a consumer regulator at once. Your body-scanning try-on can attract a DPA; your green badge can attract a consumer authority. Same product, two front doors.

The US picture differs. There is no single federal AI law comparable to the EU AI Act as of early 2026. Instead you have the FTC (Federal Trade Commission) policing deceptive claims and unfair practices, plus state laws such as those in Illinois on biometric data and in California on privacy. If you sell across the Atlantic, the EU regime is usually the stricter bar, so building to it tends to cover you broadly.

Key Takeaways

• One feature, multiple laws. A body scan can trigger the EU AI Act and GDPR at once; a green badge can trigger AI rules and green-claims rules. MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → all of them before launch, not after.
• Biometric and pricing features carry the highest exposure. Get explicit consent, run a DPIA, keep retention short, and audit prices for proxy discrimination.
• Never let a model assert an unsourced green claim. Bind every sustainability statement to verifiable evidence, or output "insufficient data."
• Governance is a workflow: classify, map data, test for bias/drift/hallucination/opacity, assign a human owner. Repeat on a schedule, not just at launch.
• Build to the EU bar. It is generally stricter than current US rules, so meeting it tends to cover both markets.