# UK ecommerce brand: AI ops that keeps you as the approver | BYOM blog

URL: https://byom.co/blog/uk-ecommerce-ai-ops-approver  
Markdown: https://byom.co/blog/uk-ecommerce-ai-ops-approver.md  
Last updated: 2026-10-02

> A plain reading of the UK rules that matter when AI touches a store: automated decisions, processor contracts, data transfers, CMA fines and VAT.

By Kina (Checked by the BYOM team). Published 2026-10-16. 9 minute read. Series: In control.

## Key takeaways

- Section 80 of the Data (Use and Access) Act 2025 defines a solely automated decision as one with no meaningful human involvement, so a real review matters.
- The CMA can fine up to £300,000 or 10% of turnover, whichever is higher, for consumer law infringements, including drip pricing and fake reviews.
- Before connecting any tool to your store, check the processor contract, where the data goes and the vendor's entry on Companies House.

If you run a UK ecommerce brand and are thinking about letting software draft some of your admin, the legal questions are narrower than they sound. This post goes through the UK rules that matter most when an AI system touches a store: what the Data (Use and Access) Act 2025 changed about automated decisions, who counts as controller and processor, what the rules say on sending data abroad, what the Competition and Markets Authority can now do directly, and the VAT threshold that still shapes many small brands. It is a plain reading of public sources, not legal advice, and where we are interpreting we say so.

UK law mostly cares about who decides and who is accountable. A draft that a named person reviews and approves sits in a different place from a decision a system takes alone.

## How big UK online retail is

The Office for National Statistics publishes online retail figures each month as part of its retail sales release. In the release of 18 September 2026, online sales were 28.8% of total retail sales in August 2026, up from 28.4% in July 2026. Spending online rose by 2.5% over the month, and was 8.9% higher than in August 2025. The ONS also reports that online spending rose by 1.9% in the three months to August 2026 compared with the three months to May 2026, and by 10.1% on the three months to August 2025. The next release is due on 23 October 2026.

Those are shares of all retail, measured by the ONS, and they say nothing about any one store. They do show that online selling is now a standing part of UK retail.

- **28.8%** online share of total UK retail sales in August 2026 (Office for National Statistics, retail sales, released 18 September 2026)
- **10%** of turnover, or £300,000 if higher, is the CMA's maximum fine for a consumer law infringement (Digital Markets, Competition and Consumers Act 2024, section 182(6))
- **£90,000** taxable turnover above which you must register for VAT (GOV.UK, VAT registration)

## Automated decisions after the 2025 Act

Article 22 of the UK GDPR used to give people a right not to be subject to a decision based solely on automated processing where it had legal or similarly significant effects. Section 80 of the Data (Use and Access) Act 2025 replaces that article with new Articles 22A to 22D. The text defines a decision as solely automated when there is no meaningful human involvement in taking it, and a significant decision as one that produces a legal effect for the person or has a similarly significant effect.

The new framework keeps a tight rule for the most sensitive data. Significant decisions based entirely on special category data, such as health data, are not allowed unless the person has given explicit consent, or the decision is necessary for a contract and authorised by law. Where a significant decision is made by solely automated processing, the controller has to put safeguards in place: give information about the decision, let the person make representations, allow human intervention by the controller, and let the person contest it. The Secretary of State may also make regulations about what counts as meaningful human involvement.

The Information Commissioner's Office updated its guidance on automated decision making and profiling on 31 March 2026. The page states that the guidance is a draft that reflects the 2025 Act, adds a section on the safeguards you must put in place and the rights people have, and includes a section titled What is human intervention. Because it is a draft, check the current version before you rely on a particular sentence.

What does this mean for a store? Our reading, not the ICO's, is that most of what a store asks an assistant to do is outside the definition. Rewriting a product description, tidying tags or drafting a stock reply does not produce a legal or similarly significant effect on a person. The line gets closer when software decides things about identifiable customers on its own: refusing a refund, closing an account, holding or cancelling an order for suspected fraud. A system that proposes such a decision, and a person who reads the facts and decides, falls on the other side of the definition from one that acts alone. The word in the statute is meaningful, so a button pressed without looking is unlikely to count, and you would be wise to keep a record of what the approver saw.

## Controller or processor, and why the contract matters

When a tool reads your customers' orders, names and messages, you remain the controller of that data. The tool's vendor is usually a processor acting on your behalf. The ICO's guidance on contracts and liabilities between controllers and processors says a contract must make the processor act only on the controller's documented instructions, include a duty of confidence and appropriate security measures, deal with the use of sub processors, require help with people's rights requests, and allow audits and inspections.

The same guidance says controllers keep responsibility for making sure the processor complies through proper contractual terms and oversight, while processors can be held liable if they fail to meet their own responsibilities or break the contract. In practice, before you connect a tool to your store or helpdesk, ask for the data processing terms and check four things: what data it reads, whether it keeps it, who its sub processors are, and where they are.

## Sending data outside the UK

Many tools run on infrastructure outside the UK, so the rules on restricted transfers apply. The ICO's guide says every restricted transfer must be covered by one of three routes: UK adequacy regulations, appropriate safeguards, or an exception under article 49 of the UK GDPR. The safeguards it names include the International Data Transfer Agreement, the International Data Transfer Addendum and UK Binding Corporate Rules.

If you rely on a safeguard, the ICO says you must also complete a transfer risk assessment, to check that the standard of protection for people's information is not materially lower after the transfer. Its rule is direct: you must not make a restricted transfer if there are no UK adequacy regulations, you cannot use appropriate safeguards and you cannot rely on an exception. A reputable vendor will tell you which route it uses. If yours cannot, ask again before you connect anything.

A short note on what a useful approval record holds, since the Act turns on meaningful involvement and the ICO's draft asks what human intervention is. This is our suggestion, not a rule from the guidance. Keep who approved, when, what the approver was shown, and what the original draft said, so that you can show the person had the facts in front of them and could have said no. A log of clicks alone does not show that.

## What the CMA can now do to you directly

Since 6 April 2025, Part 4 of the Digital Markets, Competition and Consumers Act 2024 has regulated unfair commercial practices towards consumers, replacing the 2008 regulations. Trading Standards' Business Companion guide says the Act prohibits misleading actions and omissions, aggressive practices and acting without professional diligence, and that two practices are banned outright whatever their effect on shoppers, one of them omitting material information from an invitation to purchase, which includes drip pricing. Fake reviews are covered by banned practices in Schedule 20. The guide is written for traders in England, Scotland and Wales of any size, and says that misleading, aggressive or careless practices breach the Act only where they are likely to cause the average consumer to take a transactional decision they would not have taken otherwise. The two banned outright practices do not need that test, which is why drip pricing is the one to treat as a bright line.

For an online store, the drip pricing point is the one to check at checkout. Section 230 of the Act sets out the information an invitation to purchase must contain, including the total price, defined to include any fees, taxes, charges or other payments the consumer will necessarily incur. Where charges cannot be worked out in advance, the trader must say how the price will be calculated. Optional extras such as delivery that the shopper may choose are treated separately, but you must still say that they may be payable.

The enforcement changed too. Under section 182 of the Act, when the CMA issues a final infringement notice it can impose a monetary penalty of a fixed amount not exceeding £300,000 or, if higher, 10% of the total value of the respondent's turnover. That applies to practices the CMA confirms are happening or have happened. The CMA does not need to go to court first. For a small brand the practical meaning is that product pages, price displays and review practices that were once a matter of reputation are now matters of a direct fine, and any tool that drafts customer facing copy should be checked against them before an approval.

| Rule | What it asks of a store | Where to read it |
| --- | --- | --- |
| Automated decisions | Safeguards and real human involvement where a significant decision about a person is made automatically | Data (Use and Access) Act 2025, section 80, and ICO guidance |
| Processor contract | Documented instructions, security, sub processor terms and audit rights | ICO controller and processor guidance |
| International transfers | Adequacy, safeguards with a risk assessment, or an exception | ICO guide to international transfers |
| Pricing and reviews | Total price up front, no fake or hidden incentivised reviews | DMCC Act 2024, section 230 and Schedule 20 |
| Fines | Up to £300,000 or 10% of turnover, whichever is higher | DMCC Act 2024, section 182 |

Two things follow for anyone using a tool to write customer facing copy. First, a draft that mentions price, delivery or reviews is a commercial practice the moment it is published, whoever or whatever wrote it, and the responsibility sits with the trader. Second, a tool that writes product copy fluently can also state a delivery time you cannot meet or an offer you do not run. A reviewer who reads those lines before they go live is your protection, and the approval step is where that happens.

## Smaller practical checks

VAT is the oldest threshold and still the one that catches growing brands. GOV.UK says you must register if your taxable turnover for the last 12 months goes over £90,000, and also if you expect it to go over that figure in the next 30 days alone. In the first case the effective date is the first day of the second month after you cross the threshold. In the second it is the date you realised it would happen. Check the current threshold on GOV.UK before relying on a number in a blog.

Companies House is the other free tool worth using. GOV.UK says its register holds company information such as the registered address and date of incorporation, current and resigned officers, document images, previous company names and insolvency information. Before you hand a supplier access to your store or your customers' data, look it up. A vendor with no registered entity, a recent incorporation and no accounts is something to ask about before you sign.

Taken together, the checklist is short. Know whether your assistant ever decides something about a person on its own. Have a processor contract and know where the data goes. Check every customer facing price, delivery and review practice against the Act. Keep a record of who approved what. None of that is exotic, and a draft and approve workflow makes most of it easier, because the approval step is where a named person takes responsibility for what goes out under your brand.

## Where BYOM fits

Kina is the AI operator in BYOM. It reads your Shopify catalogue and stock, and the helpdesk you connect, and drafts the work. A named person approves every change, BYOM writes it once, and every change is recorded. BYOM Ltd is a UK software company, registered in England and Wales.

Related: [About BYOM](https://byom.co/about), [See approvals](https://byom.co/approvals), [What BYOM is](https://byom.co/blog/what-byom-is).

## Sources

- [Office for National Statistics, retail sales online data, August 2026](https://www.ons.gov.uk/businessindustryandtrade/retailindustry/bulletins/retailsales/latest)
- [Data (Use and Access) Act 2025, section 80, automated decision making](https://www.legislation.gov.uk/ukpga/2025/18/section/80)
- [ICO, automated decision making and profiling guidance, draft updated 31 March 2026](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/automated-decision-making-and-profiling/)
- [ICO, contracts and liabilities between controllers and processors](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/)
- [ICO, international transfers guide](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/)
- [Digital Markets, Competition and Consumers Act 2024, section 182, final infringement notice](https://www.legislation.gov.uk/ukpga/2024/13/section/182)
- [Digital Markets, Competition and Consumers Act 2024, section 230, invitation to purchase](https://www.legislation.gov.uk/ukpga/2024/13/section/230)
- [Business Companion, unfair commercial practices introduction](https://www.businesscompanion.info/focus/unfair-commercial-practices/introduction)
- [GOV.UK, when to register for VAT](https://www.gov.uk/vat-registration/when-to-register)
- [GOV.UK, get information about a company](https://www.gov.uk/get-information-about-a-company)