Prioritise inventory, accountability, applicability, prompt/tool boundaries, supplier governance, personal-data protection, human review, auditability, incident readiness and continuity.
Analysis of public disclosures and authoritative standards informs context [T1-T2]. Technical research supports demonstrated classes [T2]; practitioner patterns and scenarios are contextual [T3-T4]. No proprietary retail telemetry was used.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Retail training, tuning and evaluation data often arrive from point-of-sale feeds, loyalty platforms, sellers, suppliers and franchise locations. Preserve source lineage, quarantine abnormal submissions and require approval before contaminated catalogue, fraud or demand data can influence a production model.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Recommendation, pricing and fraud APIs can expose commercially valuable decision logic through high-volume queries. Apply rate limits, behavioural detection, response minimisation and contractual controls to make systematic model replication detectable and costly.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Retail behaviour changes sharply during promotions, holidays, product launches and fraud campaigns. Monitor performance by channel, store cohort and affected population so seasonal change is distinguished from security manipulation or silent model degradation.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Where stores, franchisees or regional entities train locally, validate and bound each submitted update before aggregation. A compromised edge node must not be able to poison group-wide fraud, forecasting or recommendation behaviour.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Product search, visual search and retrieval systems depend on embedding similarity. Test whether adversarial images, seller text or catalogue attributes can move prohibited, counterfeit or irrelevant items into trusted result neighbourhoods.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Long-lived model artefacts, signed releases and warehouse or store-edge devices may outlive current cryptographic assumptions. Maintain crypto-agility and migration plans; do not represent post-quantum readiness as achieved unless the full signing and verification chain has been tested.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Low-rank adaptation and other adapters may be used to localise models for brands, regions or franchises. Verify adapter origin, hash, approved base-model compatibility and behaviour before loading it into production.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Retail teams may merge models or checkpoints to combine language, vision or fraud capabilities. Treat every merge as a new artefact requiring provenance, behavioural comparison and backdoor testing rather than inheriting trust from the source models.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Quantised models are common on cameras, kiosks and store-edge hardware. Re-test quantised builds because compression can expose or preserve behaviours that were not visible in the full-precision model.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Customer-service and shopping assistants must treat customer prompts as untrusted input. Separate instructions from customer content, constrain account actions and prevent a conversational request from bypassing refund, discount or identity controls.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Retail assistants ingest product pages, reviews, supplier documents and support content. Sanitise retrieved material and isolate tool instructions so hidden text in a listing or document cannot redirect the model or exfiltrate data.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Test retail assistants against attempts to produce prohibited product advice, reveal policies, create fraudulent discounts or evade age and account controls. Re-test after model, prompt, retrieval or tool changes.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Visual-search, receipt, shelf-image and voice systems can carry adversarial instructions outside ordinary text prompts. Validate each modality independently and at the point where modalities are fused.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Agents connected to refunds, inventory, customer records or campaigns must validate every function call against user identity, transaction state and approved limits. Model-generated arguments are not trusted authorisation.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: A retailer may reuse one model across customer, employee, seller and developer contexts. Enforce context separation so content or memory from one tenant, account or workflow cannot influence another.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Retail agents should receive only the tools and transaction authority required for the current task. A product assistant should not obtain refund, pricing or inventory-write capability merely because those tools exist in the same platform.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: When merchandising, inventory, fraud and customer-service agents exchange messages, authenticate the sender, validate message schemas and record delegated authority. Do not allow one agent to create authority for another through natural-language assertions.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Multi-step retail workflows can hide unsafe intent across individually benign prompts. Detect chains that progressively obtain customer data, alter promotions or prepare unauthorised transactions.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Warehouse robots, autonomous stores and AI-enabled handling equipment require bounded operating zones, tested safety interlocks and controlled behaviour when sensors, networks or models fail.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: For multi-agent retail operations, preserve an attested chain showing which agent, identity, model version and policy authorised each consequential action. Break the chain when any participant cannot be verified.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Persistent assistant memory may accumulate customer, employee, seller or source-code information. Prevent retrieval or export of memory outside the originating account and monitor bulk or unusual memory access.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Define retention, correction, deletion and re-indexing rules for conversational and agent memory. Account closure, employee departure and model retirement must trigger removal or controlled archival of associated memory.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Maintain an AI bill of materials for each retail service covering models, adapters, datasets, retrieval stores, prompts, agents, tools, libraries, providers and edge deployments. Link changes to release and incident records.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Scan downloaded models, adapters and serialized artefacts before use. Retail data-science teams must treat model files from public hubs, vendors and internal experiments as executable supply-chain content.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Approve model hubs and registries based on provenance, moderation, vulnerability response and licence controls. Prevent unreviewed models from moving directly from an analyst notebook into a customer or store workflow.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Model Context Protocol servers can expose inventory, customer relationship management and order systems to agents. Monitor server discovery, tool enumeration, read/write patterns and unexpected access to high-value retail data.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Assess external AI application programming interfaces for authentication, tenant isolation, data retention, training use, regional processing, model-change notice, rate limits and incident support before sending customer or commercial data.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Shadow AI commonly appears in marketing, buying, store and franchise teams using consumer tools for copy, images or analysis. Discover unsanctioned use through procurement, network, browser and data-loss signals, then provide an approved alternative and enforce data boundaries.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Software Composition Analysis for retail AI must include orchestration frameworks, vector databases, model loaders, plugins, computer-vision packages and agent tools, not only the conventional web application dependencies.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Block outputs that facilitate fraud, unsafe product use, harassment, prohibited goods or harmful employee/customer interactions. Calibrate controls to the channel and provide escalation instead of silently failing consequential requests.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Prevent customer, payment, loyalty, employee and supplier identifiers from appearing in prompts, retrieved context or outputs beyond the approved transaction. Test redaction and access boundaries with realistic retail records.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Product descriptions, advertising and generated imagery may reproduce protected material. Record source rights, detect suspicious similarity and route uncertain content for review before publication.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Where watermarks or provenance markers are used for retail media, test whether resizing, cropping, recompression and marketplace reposting remove them. Do not treat watermark presence as proof that content is authentic.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Verify privacy controls at design and release gates for loyalty profiling, retail media, biometrics, employee monitoring and conversational systems. Data minimisation and purpose boundaries must be visible in architecture and operating evidence.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Where federated learning, differential privacy, synthetic data or secure computation is claimed, test the privacy parameters and residual leakage against the retail use case. A technique label alone is not evidence of effective protection.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Require authorised human review before consequential actions such as account suspension, return denial, biometric intervention, hiring rejection, high-value refund or unsafe warehouse movement. Reviewers need the evidence and authority to reverse the model outcome.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Logs must reconstruct the customer or operational journey: identity, input, retrieved data, model and prompt version, output, tool call, override and final action. Logging only the final response is insufficient for disputes or incidents.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Retail model cards should state channel, population, data origin, decision authority, known failure modes, seasonal limits, supplier dependencies and prohibited uses. Generic vendor documentation does not replace a retailer-specific deployment record.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: AI incident plans should cover misleading product content, pricing errors, fraud-control failure, biometric misidentification, agent misuse, model compromise and provider outages. Preserve model and prompt versions before rollback.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: When retiring a model, remove endpoints, credentials, cached artefacts and dependent agent routes; archive required evidence; migrate open cases; and verify that stores or franchisees are not still using the superseded version.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Retail contracts should secure evidence access, data-use limits, change notice, incident cooperation, subcontractor transparency, continuity and exit support. Procurement approval without enforceable operating rights leaves a control gap.
Scope: Foundational - canonical D1-D8 scope
Priority: P1 - Start first
Retail interpretation [T3]: Define degraded modes for payment risk, inventory, checkout, customer service and physical operations. Test manual or rules-based fallback under peak demand rather than assuming the provider will remain available.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Simulate AI-generated phishing against store, finance, buying and supplier-management staff using realistic seasonal and invoice themes. Measure reporting and verification behaviour, not just click rates.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Train staff who approve payments, supplier changes or executive instructions to recognise deepfake voice and video indicators and to use an independent verification channel.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Changes to bank details, high-value refunds, privileged access and emergency supplier requests should be confirmed through a pre-registered channel independent of the initiating message or call.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Incident procedures must recognise AI-assisted impersonation, synthetic documents and coordinated social engineering. Preserve media and communications while validating the claimed identity through trusted records.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Tune email, identity, endpoint and fraud defences for AI-scaled reconnaissance, credential attacks and content variation. Retail peak periods require heightened monitoring because staffing and transaction volume reduce review time.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Map each retail AI use case to the European Union Artificial Intelligence Act role and risk analysis where the regulation applies. Do not classify an entire retailer once; assess hiring, biometrics, customer and operational systems separately.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Use an International Organization for Standardization/International Electrotechnical Commission 42001 gap analysis to compare management-system practices, but preserve GAISSF control-level evidence and do not claim equivalence between the instruments.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Where a general-purpose AI provider is in scope, verify that the technical documentation available to the retailer is sufficient for integration, risk assessment, monitoring and downstream instructions. Record unavailable evidence as a supplier limitation.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Digital Operational Resilience Act incident reporting is relevant only where the retail entity or service falls within its financial-sector scope. Record the applicability decision instead of presenting the control as universally required for retail.
Scope: Foundational - canonical D1-D8 scope
Priority: P2 - Risk-triggered / capability-specific
Retail interpretation [T3]: Apply National Institute of Standards and Technology Special Publication 800-218A practices to AI model and software development where relevant, including provenance, secure build, testing and release evidence. Document gaps for acquired services that the retailer cannot inspect.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: Set explicit physical limits for warehouse robots, automated handling, smart carts and autonomous store systems. Software optimisation must not permit speed, force, route or proximity beyond the approved safety boundary.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: On model, sensor, network or cloud failure, physical retail systems must enter a defined safe or controlled state without depending on continued model inference. Test degraded operation during realistic store and warehouse conditions.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: Warehouse robotics and autonomous store systems require accessible local emergency stops and authorised human override. Remote vendor commands or software updates must not disable the emergency function.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: Correlate cyber indicators with physical anomalies such as unexpected routes, repeated sensor disagreement, command bursts or safety-zone violations. Cyber monitoring alone may miss an emerging physical incident.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: Monitor camera position, sensor obstruction, lighting, floor layout, shelf movement and other environmental changes that can invalidate a physical AI system’s assumptions.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: Validate actuator commands against identity, authorised workflow, current sensor state and physical limits before execution. Reject stale, duplicated or out-of-sequence commands.
Scope: Conditional - physical AI in scope
Priority: P3 - Conditional physical AI
Retail interpretation [T3]: For physical incidents, preserve commands, sensor streams, model version, safety interlock state, operator actions and relevant video with synchronized time. Ordinary application logs are not sufficient for reconstruction.
No automatic compliance or certification conclusion; specialist review gates remain open.