# Mapping the regulatory landscape for fashion AI
A shopper opens your app, points the camera at herself, and a body-scanning model estimates her measurements to recommend a size. In that single tap, you have just triggered three separate bodies of European law: rules on biometric data, rules on high-risk AI, and rules on how you personalize what she sees next. Most fashion teams deploy features like this without realizing how much regulation they just switched on.
This lesson maps that landscape. We focus on three AI use cases that dominate fashion right now: body-scanning try-ons, personalized pricing, and automated sustainability labels. For each, we name the law, the regulator, and the guardrail you run before launch.
Three regimes matter most for fashion AI in 2026.
The EU AI Act. The first comprehensive AI law in the world. It classifies AI systems by risk level: unacceptable (banned), high-risk (heavily regulated), limited-risk (transparency duties), and minimal. It entered into force in August 2024 and phases in over several years. Bans on certain practices applied first (from February 2025), with obligations for general-purpose and high-risk systems following on a staggered timeline. The official text is worth bookmarking: the EU AI Act explorer lets you search article by article.
GDPR (General Data Protection Regulation). The EU's data protection law, in force since 2018. It governs any processing of personal data, and it treats "biometric data" and profiling with special care. Enforced by national Data Protection Authorities (DPAs) such as France's CNIL or Ireland's DPC.
Green-claims rules.
The through-line: if your AI touches a body, a price, or a green claim, at least one of these applies.
A virtual try-on that maps clothing onto a live camera feed may only process image data transiently. But the moment you estimate measurements to identify or single out a person, you may be handling biometric data under GDPR.
Key distinction: GDPR restricts biometric data used "for the purpose of uniquely identifying a natural person." A model that estimates a size from body shape is a grey area. A model that recognizes *who* the person is crosses clearly into special-category biometric data, which needs a strong legal basis (usually explicit consent).
The AI Act adds a second layer. It bans real-time remote biometric *identification* in public spaces (with narrow law-enforcement exceptions) and restricts emotion recognition. A try-on mirror in your flagship store that guesses a shopper's mood to push product would sit in dangerous territory.
Guardrails before launch:
Showing different prices to different users based on inferred willingness to pay is legal in narrow forms but heavily constrained.
GDPR gives users the right not to be subject to decisions "based solely on automated processing" that significantly affect them, plus transparency duties: you must tell people that pricing is personalized and on what logic. The Consumer Rights Directive already requires disclosure when a price is personalized using automated decision-making.
The bigger trap is proxy discrimination. If your pricing model uses features that correlate with protected characteristics (postcode standing in for ethnicity, device type for income), you can produce discriminatory outcomes even without meaning to. That exposes you to anti-discrimination law, not just data law.
A simple check every team can run: audit price dispersion across protected groups.
# Fairness check: do price offers differ across a protected attribute?
import pandas as pd
df = offers[["user_id", "price_offered", "group"]] # group = proxy-free label
summary = df.groupby("group")["price_offered"].agg(["mean", "count"])
summary["gap_vs_baseline"] = summary["mean"] - summary["mean"].min()
print(summary)
# Flag any group whose gap exceeds a threshold you set (e.g. 3%) for review.This does not prove fairness on its own, but a persistent gap is a red flag that demands a documented explanation before you ship.
Say you train a model to generate a "sustainability score" for each product, then display it as a badge. This is where AI risk meets green-claims risk head-on.
If the model outputs "eco-friendly" or a leaf icon based on incomplete or unverifiable data, you have made a misleading environmental claim. Under the 2024 EU consumer directive, generic green claims without recognized proof are restricted, and sustainability labels must rest on a certification scheme or be set by public authorities.
Two AI-specific dangers:
Hallucinated justification. A generative model that writes label copy ("made from ocean-recovered fibers") without a verified data source is a compliance incident waiting to happen. Never let a language model assert a factual green claim it cannot trace to a source.
Model opacity. If a regulator or consumer asks "why does this dress score 8 out of 10," you must be able to answer. A score no one can explain is not defensible.
Guardrails:
Vérification des acquis
1. A fashion app uses a camera to scan a shopper's body and estimate her measurements. Why does this single feature trigger multiple bodies of law at once?
2. Under the EU AI Act's risk-based structure, what best distinguishes a 'high-risk' system from a 'limited-risk' one?
3. Why does GDPR treat the body-scan measurement feature with special care compared to, say, collecting a shopper's email address?
4. Select ALL correct answers about how green-claims regulation applies to automated sustainability labels in fashion.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about the enforcement and governance structure described for fashion AI.
Sélectionnez toutes les réponses correctes.
Regulation only protects you if it becomes a repeatable process. Fashion teams that ship AI well tend to run four checks in order.
Before building, ask: what risk tier does the AI Act assign this? Most fashion features (recommendations, try-ons, chatbots) are limited-risk, meaning transparency duties: tell users they are interacting with AI. Some (certain biometric uses) climb higher. Write the classification down.
List every personal data field the system touches. Flag biometric and special-category data. This drives whether you need a DPIA and explicit consent.
Fashion AI fails in recognizable ways:
Run the fairness check, a hold-out accuracy test, and a claim-tracing review before launch, and on a schedule after.
Name a human owner for each model. Under the AI Act, high-risk systems need human oversight by design, meaning a person who can intervene or stop the system. Even for lower-risk features, a named owner beats diffuse responsibility.
Enforcement is real. European DPAs have issued large GDPR fines, and consumer authorities across member states have opened greenwashing investigations against apparel brands. National market-surveillance authorities will police the AI Act. The pattern to expect: coordinated action, where one feature draws scrutiny from a data regulator and a consumer regulator at once. Your body-scanning try-on can attract a DPA; your green badge can attract a consumer authority. Same product, two front doors.
The US picture differs. There is no single federal AI law comparable to the EU AI Act as of early 2026. Instead you have the FTC (Federal Trade Commission) policing deceptive claims and unfair practices, plus state laws such as those in Illinois on biometric data and in California on privacy. If you sell across the Atlantic, the EU regime is usually the stricter bar, so building to it tends to cover you broadly.