Fines up to €15 million: how to document your AI compliance in your shop (AI register, change log, dossier)

Most shop owners we talk to right now have step one covered: they label their AI images and their chatbot. Step two is almost always missing – and that's the one that counts when things get serious. Because if an authority asks questions or a competitor sends a cease-and-desist letter, the label in your shop only takes you so far. You have to be able to prove that you label, how completely you do it, and since when. Without documentation, it's your word against the other side's claim.

In detail: solid AI documentation has four parts – an inventory of the AI systems you use (an AI register), proof of coverage (which content is labelled and which isn't), a complete change history (who set which label when, and where it came from), and regular snapshots as PDFs that freeze the state at a point in time. This article shows why you need that and how to handle it in practice without maintaining a spreadsheet. One note up front: we're developers, not lawyers – this is experience from real projects, not legal advice.

Which law applies here: The EU AI Act applies directly in every member state. The record-keeping described here is not prescribed in this form by the regulation; it is the practical way to be able to demonstrate compliance if a supervisory authority asks.

Why labelling alone isn't enough

Picture two scenarios. In the first, a cease-and-desist letter arrives claiming that your AI-generated lifestyle image on a category page wasn't labelled. You know the badge has been there for months – but do you know since exactly when? And how do you prove it when the other side produces a screenshot dated whenever they like?

In the second scenario, a large B2B customer or an authority asks: "Which AI systems do you use in your shop, and how do you make sure their outputs get labelled?" An honest "we're on top of it" sounds weak. An exported register plus a coverage report sounds confident.

That's the point: compliance isn't just a state in your frontend, it's a provable practice. We see the same pattern in project after project – the implementation is fine, the documentation is missing. And documentation is exactly the part that matters in a dispute.

What's at stake

The transparency obligations in Article 50 of the AI Act (Regulation (EU) 2024/1689) have applied since 2 August 2026. Deployers who breach them face fines of up to €15 million or 3% of global annual turnover under Art. 99(4) – whichever is higher. For a mid-sized shop that's a theoretical maximum, not a realistic expectation. But it tells you what weight class this topic sits in.

For most shops, unfair competition law is the more practical risk: a missing mandatory label can be treated as an unfair commercial practice, which means competitors and consumer or trade associations can act on it. In Germany that route works fast and without any authority getting involved. And those letters don't come with a warning – they come with a deadline.

Who can actually come asking

People underestimate how many routes lead to this topic. Realistically, these are the ones that matter:

• Market surveillance. In Germany, the "Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz" (KI-MIG) concentrates national AI supervision at the Bundesnetzagentur, which has been the market surveillance, contact and complaints body since late July 2026. Consumers can file complaints there too.
• Competitors and trade associations. The fastest and most common route. Whoever watches your niche sees your images exactly the way your customers do.
• Internal compliance and data protection officers. As soon as AI tools multiply inside a company, someone wants a list – often the very list an AI register asks for.
• The other side's lawyers. In any dispute about product presentation, advertising or returns, checking AI content is now standard practice.
• B2B customers and marketplaces. Compliance questionnaires are normal in supplier onboarding. A PDF you can simply attach saves you days there.

If you're at the very beginning and still wondering what needs labelling at all, start with our overview of the AI content labelling obligation for online stores. This article picks up where that one ends.

The four building blocks of solid AI documentation

You can maintain all four by hand, in theory. We've watched customers try: a spreadsheet of AI tools, a screenshot folder called "evidence", and a calendar reminder that gets ignored after two quarters. The problem isn't good intentions, it's half-life. As soon as the catalogue grows, the list drifts away from reality – and documentation that isn't accurate is worse in a dispute than none at all.

That's why we built this straight into our Shopware plugin EU AI Act Compliance: the evidence is created where the labelling happens – inside the shop system itself.

Block 1: the AI register – your inventory

The AI register is the simplest and most frequently skipped exercise: a maintained list of the AI tools in your day-to-day shop work. The image generator for lifestyle shots, the text tool for product descriptions, the chatbot, the translation tool.

In the plugin, the register lives under "Content → EU AI Act Compliance → AI register". You can add entries one by one or import them in bulk via CSV – handy when your company already keeps a tool list somewhere. For your files, export the register as CSV (to process further) or as PDF (to file and hand over).

The side effect is where the real value sits: if you record which tool produced an image, and you keep those same tools in the register, the whole picture becomes consistent. When someone asks, your inventory and your individual cases match up.

Block 2: measure coverage instead of hoping

"Are we labelling everything?" isn't a question you can answer by gut feeling – a media library is far too big for that. It is a question you can answer with a number.

The dashboard tells you how many media items are labelled and how many aren't, how the statuses are distributed, and how many product texts already carry an origin note. That turns "we should check that sometime" into a to-do list with a progress bar.

Two automatic safeguards keep that number stable afterwards:

• The coverage warning: if the share of unlabelled media crosses a threshold you define yourself, you get a notification in the admin area. You don't have to remember – the system reminds you.
• The warning when activating products whose AI-capable content isn't labelled yet. This is exactly where gaps appear in practice: a new product goes live, the badge is missing, nobody notices. The warning fires before a customer ever sees the image.

For how labelling images in Shopware actually works – including folder defaults for new uploads and the metadata scan – see labelling AI images in Shopware.

Block 3: the change history – your actual proof

This is the block that answers "since when?". The change log records who set or changed a label and when, plus where the change came from: manual, the automatic metadata scan, automatic adoption, a CSV import, or a bulk action.

Why the source matters: it shows there's a process behind your labelling rather than coincidence. That's exactly what you want to be able to show – not "we clicked something once", but "this is how we work, here's the history".

Two practical details that matter day to day: every change can be undone from the log – so if a bulk action mislabelled 200 images, that's one click instead of an afternoon of manual work. And the log maintains itself; older entries are cleaned up automatically after a while. No upkeep on your side.

Block 4: the compliance dossier as a snapshot

A dashboard only ever shows now. For evidence, though, you need the past. That's what the compliance dossier is for: a PDF that freezes your state at a point in time – with coverage, the AI register, the change history and an attestation of the current state, all in one document.

You generate it in the EU AI Act Compliance area via "Export dossier" and save the file. That's the whole procedure – two clicks.

The practical workflow: 20 minutes per quarter

Here's what this looks like for our customers day to day – deliberately lean, because nobody sticks to anything heavier:

1. Set up once: fill the AI register with every tool in use, set folder defaults for new uploads, enable the coverage warning with a threshold, switch on the warning when activating products.
2. Ongoing: new uploads get pre-set through the folder defaults, the metadata scan suggests candidates, the review queue collects the doubtful cases. You only decide the edge cases.
3. When a warning appears: open the dashboard, close the gaps. Usually it's a handful of images from a new product range.
4. End of quarter: export the dossier, file it, done. If your tool landscape changed, update the register first.

The fact that we deliberately built no heuristic AI detection fits that picture: software that "guesses" whether an image is AI-generated produces false positives and false negatives – and the responsibility still sits with you. We provide suggestions from real metadata (C2PA/IPTC) and a process that documents your decision. Traceable beats convenient.

Common mistakes we see

• Screenshots as evidence. A screenshot shows one moment and can be dated at will. A log with user, timestamp and source is a different level of quality.
• A register nobody maintains. Last year's list with three tools missing does more harm than good. That's why the register belongs in the same system as the labelling.
• Only looking at images. Product texts and the chatbot get forgotten easily. The chatbot disclosure is its own obligation – details in chatbot AI disclosure in your online store.
• Documentation outside the shop. Any documentation living in a separate tool drifts. Evidence should be created where the data lives.

Sources

Every legal statement in this article can be checked against the original (as of August 2026):

• Regulation (EU) 2024/1689 (EU AI Act), Art. 50 and Art. 99(4)
• Bundesnetzagentur: AI market surveillance (Germany)

Bottom line: being able to prove it is the difference

Labelling is the obligation – being able to prove it is self-protection. The effort stays manageable when the tools sit inside the shop system: a register you fill once, a dashboard that surfaces gaps, a log that runs along quietly, and four PDFs a year. That's all it takes to react calmly instead of nervously when someone asks.

That's exactly why we built our plugin EU AI Act Compliance: fully local, no external services, badge output in the storefront and the whole evidence side on top. It's prepared for the European Commission's July 2026 guidelines and is coming to the Shopware Store soon – if you want in earlier, just get in touch.

Want to know where your shop really stands on AI labelling and evidence? We'll take a look: which AI content you have, where labels are missing, what belongs in your register, and how to get to a quarterly dossier. And if your setup has special cases – custom theme, PIM integration, several sales channels – we solve those through our Shopware plugin development. Let's look at it together in a free initial consultation: honest, no strings attached, no sales pressure. It's no substitute for legal advice – but it tells you exactly where you stand technically.