AI Agents in Retail: Liability Frameworks, Algorithmic Hallucinations, and the Necessity of Human Oversight

The retail sector is undergoing a rapid transformation, transitioning from simple generative AI tools to sophisticated 'agentic' systems. With the AI market in Russia projected to reach $2.1 billion by 2025, retail and e-commerce now command approximately 15% of this ecosystem. While the strategic goal is clear—cost reduction and operational acceleration through the automation of pricing, inventory, and customer service—the legal landscape remains fraught with risk.

The Liability Gap: Who Pays for 'AI Hallucinations'?

As AI agents move from providing information to executing transactions, the risk of "hallucinations"—where the AI generates false but confident information—shifts from a technical glitch to a legal liability. From a consumer protection standpoint, the distinction between a human employee's error and an AI agent's mistake is irrelevant. If an AI agent, deployed on an official platform, promises a discount or confirms a price, that communication is legally attributed to the seller.

>
>
> If a store's AI agent promises a customer a non-existent discount, the defense that "the AI invented this" does not exempt the company from liability. — Artem Podshibyakin, Skolkovo Foundation expert, Head of Legal at LIME

Crucially, the legal doctrine treats AI agents as an extension of the company's client service, not as independent third parties. This was underscored in the landmark Moffatt v. Air Canada case, where the court rejected the airline's attempt to distance itself from its chatbot's erroneous information.

In the Russian jurisdiction, courts have consistently dismissed the "AI error" defense. For instance, in case № А12-32165/2024, a business owner was held liable for trademark infringement in product listings generated by AI, with the court ruling that the inherent risks of entrepreneurial activity necessitate a final human verification of all commercial materials.

Data Protection and the 'Black Box' Risk

Beyond consumer disputes, the integration of AI agents introduces severe Data Protection (DP) risks. Retailers acting as data operators are responsible for the processing activities of the AI developers they engage.

Key vulnerabilities include:
1. Uncontrolled Data Ingestion: The tendency for employees to upload sensitive client or staff data into AI services without a legal basis.
2. Contractual Asymmetry: AI providers typically include broad liability waivers, leaving the retailer to absorb the financial impact of data leaks or unauthorized cross-border transfers.
3. Algorithmic Manipulation: The thin line between "personalization" and "manipulation." AI agents can leverage behavioral data to create artificial scarcity or pressure customers, which may trigger ethical and regulatory scrutiny regarding consumer vulnerability.

Strategic Risk Mitigation

To navigate this environment, companies must move beyond simple disclaimers and implement a structural governance framework:

Regulatory Outlook

Currently, there is a consensus among experts that separate "AI-specific" legislation for retail is unnecessary. Existing frameworks—such as Consumer Protection laws, Advertising laws, and Data Protection regulations—are sufficient to cover the majority of risks. For dominant market players, anti-monopoly laws already regulate pricing transparency and non-discrimination in public contracts.

As autonomy grows, the focus will shift from legislative prohibitions to the development of internal management systems: defining who can launch an agent, what operations are permitted, and how the audit trail of AI decisions is preserved.