The increasing development of Artificial Intelligence (AI) in the retail and consumer sector presents opportunities to businesses for progression and development using information and data about their consumers. Simultaneously, AI presents evolving and new risks, including legal, reputation-focussed, regulatory and ethical challenges. 

The purpose of this article is to provide an insight into the key challenges for in-house lawyers working within the area and guidance on how to enable businesses to benefit from the wide-ranging opportunities AI presents. 

What is AI? 

AI means technologies that learn over time as they are exposed to data. The more data the technologies are exposed to typically means the AI will learn more and become more sophisticated. The overall result is that humans are able to work with AI in new and unprecedented ways to create value using the data captured relating to consumers. 

AI in practice in the Retail and Consumer Sector

AI is able to help businesses to make better decisions by carrying out independent and automated decision making. AI in the retail and consumer sector encourages innovation and creates opportunities for businesses to transform information and data about their consumers into value. 

The online consumer experience

AI focussed on personalising and evolving the experience of consumers online.

Examples include: 

Tailored product recommendations

This uses algorithms that are able to learn from each individual consumer's unique preferences, actions and behaviours. Using this information, businesses can tailor each individual's customer journey. 

Chatbots and voice assistants

Chatbots and voice assistants can significantly reduce the business cost of dealing with routine queries. In theory, they should be sufficiently 'intelligent' to be able to determine when human interaction is needed.  

Preference scoring

This uses algorithms in a similar way to bespoke product recommendations to predict what consumers are likely to do next. For example, will a consumer proceed with a purchase or search for a discount/ coupon code online? Using this information, businesses are able to effectively target customers. 

Business efficiency 

AI focussed on prediction of future sales and trends, enabling the business to optimise pricing and maximise turnover and profits. Examples include: 

Enhancing advertising spend

Not only can AI create advertising content based on individual business goals, but AI can also review and analyse data surrounding how consumers interact with advertising. Using this knowledge, businesses can determine how adverts are performing and which adverts to make more of and what changes to make in future. 

Targeting the 'right' consumers

AI is able to monitor online presence and activity, enabling businesses to pinpoint consumers that are ready to buy, reducing time spent targeting customers who are not. 

Predicting customer churn

Businesses can use AI to understand when consumers may be considering leaving and/ or moving to a different provider. This enables businesses to intervene and offer the consumer a potential discount and/ or incentive to lengthen the relationship and maximise the revenue per consumer. This will most likely provide the best competitive advantage for those businesses that offer subscription services, such as mobile app development companies, telecoms companies and gyms.

The use of stores 

While AI is usually only referred to in an online/ virtual context, we are seeing an increase in businesses using insights to shape their stores, meaning stores have the opportunity to have new and diverse functionalities:  

Enhanced in-store consumer experience

Consumers are typically able to access entire ranges of products online. This means there is less need to provide a full range of items and/ or services in physical stores. As a result in this shift in pressure, we are seeing a change in the purpose of stores, which can now draw on insights gained from AI to provide the ideal consumer experience, enabling businesses to vary stores, depending on location and time of year, for example, offering a varied experience.  

Omni-channel experience

There is a continuing focus on delivering a seamless experience for consumers that will inevitably mean the lines will become blurred between in-store and online shopping. 

Challenges of AI in the Retail and Consumer Sector

AI also presents risks for businesses, including legal, reputation-focussed, regulatory and ethical challenges. 

Cyber security 

AI is developing at an unprecedented rate, meaning businesses are working with new and in some cases untested technologies. This increases businesses' exposure to hackers, who are able to identify and exploit weaknesses in new systems and software. This can cause a number of issues, ranging from GDPR compliance and increased risk to consumer privacy to everyday operational issues if an attack has affected the functionality of the core business systems. Consideration should be given to how a business may respond to an incident, including whether it has appropriate response policies and procedures and cyber risk insurance in place.

GDPR compliance and transparency 

There is a growing concern that consumers are unaware of how advertising technology works. The reality is that explaining complex systems, algorithms and programs to consumers is unlikely to be straightforward. This is a challenge that is only likely to increase as technologies continue to increase in complexity and develop.

There is additionally the wider need for businesses to ensure they are relying on the correct lawful basis for processing personal data, particularly where sensitive personal data is being collected and analysed using AI. Consumer-facing policies should therefore be reviewed to ensure:

  • The correct legal basis is being relied on and properly explained to consumers.
  • The AI functionalities are explained in a simple and transparent way, removing any scope for confusion by consumers as to how their data is being processed and used.

The risk to consumer privacy

A review of any due diligence that has been undertaken prior to engaging with new AI technology providers should be carried out to ensure the due diligence has been thorough and properly addresses the need for consumer data to be kept secure. 

In terms of new marketing strategies and campaigns, marketing teams should appreciate the need to involve in-house lawyers from step 1 of the implementation process, to ensure legal considerations are built into any new strategies from the outset. The benefit of adopting this approach is twofold:

  • First and foremost, this should reduce the risk of new advertising campaigns being implemented that are potentially unlawful
  • This should also streamline the internal implementation process for new campaigns, avoiding unnecessary delays at later stages in the processes due to legal compliance reviews. 

There is also a need to ensure complaint handling functions are adapted to deal with any concerns raised regarding consumer privacy generally, as well as how AI may impact on consumer privacy. 

Changes in advertising technology ("adtech") on the horizon 

There are a number of complicated advertising technologies being used in the retail and consumer sector. One example is the process referred to as 'real-time bidding'. This personalises adverts for viewers, sometimes using personal information. The type of information used can vary from basic personal data, such as the individual's name, to something more detailed, based on those websites the individual has visited or what the AI technology perceives the individual's interests to be. This could include information about a particular health condition, such as a recently discovered pregnancy.  

It is evident that there is a real concern that, if individuals truly understood how their personal information was being used by advertising technologies, they would not only be surprised but also unhappy. The ICO has confirmed in the recent speech from the Executive Director for Technology Policy and Innovation that "It's complicated" is no longer an excuse and that "many real-time bidding practices are unlawful". 

In light of the above, the ICO is undertaking a review of the adtech industry and has confirmed that it expects action to be taken. In our view, this is likely to include the development of new good practices and business models to address these concerns raised by the ICO. 

In terms of practical steps to address these concerns: 

  • Where sensitive personal data is being used in real-time bidding, ensure that explicit consent is being captured from consumers. It is also vital to have a clear and documented process in place for recording explicit consent and making any changes for the process through which consent is captured
  • Early engagement with any third party AI technology providers should be made as soon as possible to ensure they are taking a proactive approach in responding to the ICO's concerns. 

Compliance with the Network and Information Systems (NIS) Regulations 

One of the purposes of the NIS Regulations is to improve levels of security of network and information systems that are critical for the provision of digital services, including online marketplaces, online search engines and cloud computing services.  As discussed above, AI increases exposure to hackers, meaning there is a higher risk of security issues arising. These security issues could potentially result in non-compliance with the NIS Regulations. 

Where AI technologies are being used and there is a potential for the NIS Regulations to be engaged, careful consideration should be given as to how the use of AI may impact on the business' compliance with the NIS Regulations. 

Compliance with the Privacy and Electronic Communications (PECR) and the new ePrivacy Regulation 

PECR is due to be replaced later this year by the new ePrivacy Regulation, both of which focus on the protection of privacy where data is being communicated electronically. Again, increased exposure to security issues could result in non-compliance with the existing PECR or future ePrivacy Regulation.  

Supplier disputes 

Where AI is being supplied by third parties, there is a risk of potential supplier disputes, which could involve determining who is liable for a particular issue, for example where a hack has extended beyond the AI technology into the businesses own systems causing damage. Alternatively, there may simply be an issue generally surrounding business satisfaction and whether the technology delivered meets the contractual standards agreed between the parties. 

Intellectual property rights

Existing IP laws were not drafted specifically with AI creations in mind, which is very much reflected in the fact that IP can only arise where there is a 'human' creator. The starting point and most pragmatic approach appears to be for ownership to remain with the business/ individual that commissioned the creation but this is not clear-cut in practice. 

The current regulation for AI creations is very much in the early stages, meaning there is a lack of guidance and certainty.  As such, where there are concerns surrounding IP rights in the end-creation, we would recommend specific legal advice be taken. 

Employment considerations 

AI has the potential to displace workers and alter and/ or replace certain roles, meaning a risk of employment issues being engaged. This is only likely to increase as we see AI technologies progress.  

Ethical considerations 

There is a growing discussion surrounding whether the use of AI is ethical. Examples of this are the potential for AI to unfairly discriminate against certain groups of individuals, or the wider social consequences of AI efficiencies risking increasing unemployment rates.