ISO/IEC 42001 by industry
ISO 42001 for retail and e-commerce: recommendation engines, dynamic pricing, chatbots and the evidence an auditor samples
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
What changes when the organisation is a retailer or online business: which recommendation, pricing, forecasting, chatbot and platform AI systems belong in scope, where auditors sample, and how the AIMS sits beside privacy, payment security and the EU AI Act.
Key points
- A retailer's AI estate spans recommendation engines, dynamic pricing, demand forecasting, chatbots and the AI inside commerce and marketing platforms.
- The systems that shape what each shopper sees and pays carry the most weight: personalised offers and prices need an impact assessment, not only a performance test.
- Auditors follow customer data from consent to model: where clickstream and loyalty data came from, whether it could be used and how it was checked.
- Complaints about AI decisions, from a price a customer thinks unfair to a chatbot that refused a return, are evidence the AIMS must capture and trace to cause.
Why retailers and online businesses ask for ISO/IEC 42001
ISO/IEC 42001 sets requirements for an AI management system; the requirements guide explains the text. In retail the pressure comes from customers, partners and regulation, not tender clauses.
Shoppers meet AI at every step: the products ranked for them, the price shown, the loyalty offer and the assistant that answers returns questions. When one goes wrong, the complaint reaches social media before customer service. Boards want one view of which systems act on customers, who owns each and what risk is accepted. Brand partners and marketplace operators send questionnaires on AI governance, and an accredited certificate answers them consistently.
For EU sales, the EU AI Act requires people to be informed when they interact with an AI system unless that is obvious, and prohibits manipulative or deceptive techniques and the exploitation of vulnerabilities such as age or economic situation. The GDPR governs the personal data behind personalisation, including consent, objection and automated decision-making. A certificate does not discharge those duties, but shows the controls behind them operate.
What sits inside the scope for a retailer
Scope starts with an inventory. For a retailer it typically covers product recommendations and search ranking, dynamic and promotional pricing, demand forecasting and replenishment, customer service chatbots, personalised marketing and loyalty offers, fraud screening at checkout, returns decisions and generative AI for product content. For each system the scope records your role: developer of an in-house model, or user of AI inside a commerce, marketing or service desk platform.
Four scope mistakes recur. Scoping the data science team while merchandising, pricing and CRM, who act on the outputs, sit outside. Leaving out platform AI because it "came with the software", when the standard expects externally provided services to be controlled. Treating forecasting as back-office only, when stock-outs reach customers. And, for marketplace operators, forgetting the AI tools offered to third-party sellers, where responsibilities between operator and seller must be allocated. The method is in ISO/IEC 42001 scope: which AI systems and roles are in, and the mistakes that cost you.
Where the requirements bite in retail and e-commerce
| Requirement area | What it means for a retailer | Evidence the auditor samples |
|---|---|---|
| 6.1.2 and 6.1.3 AI risk assessment and treatment | Pricing, recommendation and chatbot risks judged on the same criteria, including consequences for shoppers and the brand | The risk register per system, the Statement of Applicability, the treatment plan and residual risk approved by designated management |
| 6.1.4 and 8.4 AI system impact assessment | What personalised prices, excluded offers or a wrong chatbot answer do to individuals and groups, including vulnerable customers | Dated impact assessments per customer-facing system, reassessment after retraining or a new data source, the link into the risk register |
| A.7 Data for AI systems | Clickstream, basket, purchase and loyalty data acquired and prepared under rules that respect consent and preferences | Data sourcing records, checks that consent or another lawful basis covers training use, provenance of training and test sets, quality checks |
| A.6 AI system life cycle | Experiments, pricing rules and model releases moved through one controlled path, with limits set before go-live | Requirements and design records, verification and validation before release, approval of price guardrails, monitoring, event logs of price changes and chatbot conversations |
| A.8 and A.10 Information and third parties | Customers told when they deal with AI and why they see an offer; platform vendors' and marketplace sellers' responsibilities written down | Chatbot disclosures and user information, complaint and incident records traced to the AI system, supplier agreements and seller terms allocating responsibilities |
All nine control groups are covered in ISO/IEC 42001 Annex A: the 38 controls explained.
Working alongside privacy, payments and AI regulation
Retailers already carry privacy and payment obligations, and the AIMS should use what exists. Where personalisation relies on profiling, a data protection impact assessment may cover part of the ground; the AI system impact assessment adds fairness, choice and trust, and the two should reference each other. See GDPR for e-commerce and marketing and ISO/IEC 27701 for e-commerce and digital marketing.
Checkout fraud screening may already have its data flows and suppliers documented for payment security; see PCI DSS for e-commerce and retail. For EU sales, ISO/IEC 42001 certification gives no presumption of conformity with the EU AI Act; see ISO/IEC 42001 and the EU AI Act: what the certificate does not give. Where an ISO/IEC 27001 system already runs, the AIMS extends it; see ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS.
What a retail engagement looks like
Duration depends on the number of AI systems, how many sit inside vendor platforms, whether an ISO/IEC 27001 system runs, peak trading change freezes and the certification body's calendar. E-commerce, pricing, CRM, customer service, marketplace operations, data science, privacy, information security and procurement must be involved, with an executive sponsor. With Design™, Sterling guides your teams to own the assessments and records; with Drive™, Sterling carries more of the inventory, documentation and readiness testing.
How Sterling works with retailers and online businesses
One inventory of the AI your customers meet, one evidence base for the board, partners and the auditor.
Our expert and experienced consultants build the inventory with your commercial, customer and data teams, run the risk and impact assessments and keep the evidence in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 42001 for retail: questions buyers ask
Does ISO/IEC 42001 cover a recommendation engine built into our e-commerce platform?
Yes, as a system you use. You assess its risks and impacts, control it as an externally provided service and agree responsibilities with the platform vendor, even though the vendor builds and maintains the model.
Is dynamic pricing in scope for ISO/IEC 42001?
Yes, when an AI system sets or recommends prices. Its assessments should cover how prices vary between customers, the limits set before release and how price complaints are handled.
Do we have to tell customers they are talking to a chatbot?
Under the EU AI Act, yes, unless it is obvious from the context. ISO/IEC 42001's controls on information for users make the disclosure designed and checked, not left to the vendor's default.
Should AI tools we offer to marketplace sellers be in our ISO/IEC 42001 scope?
They should be considered, because you provide them. The AIMS records your role, the responsibilities you keep and those passed to sellers, and what sellers are told about intended use.
ISO/IEC 42001 by industry
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 42001 for banking and financial services
- ISO/IEC 42001 for BPO and shared services
- ISO/IEC 42001 for healthcare
- ISO/IEC 42001 for HR and staffing
- ISO 42001 nonconformities
- ISO/IEC 42001 for professional services
- ISO 42001 requirements explained
- ISO/IEC 42001 for retail and e-commerce
- ISO 42001 scope
- ISO 42001 certification in Singapore and South East Asia
- ISO 42001 Stage 1 and Stage 2 audit
- ISO/IEC 42001 for technology and software
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Plan an ISO/IEC 42001 programme that covers every AI system your customers meet.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice