Suggestions, not actions: bounding AI inside marketplace seller software

Marketplace seller software AI applications should begin as read-only decision support. For an England merchant, a model may help organise authorised evidence or propose an exception category. It should not receive authority to publish a listing, change a price, release stock, approve a refund or contact a customer merely because the output looks plausible.

No product or provider was tested for this article. The applications below are buyer scenarios, not verified features or forecasts.

Separate suggestions from actions

Buyer scenario: an assistant extracts proposed product attributes from approved records, maps them to a draft schema, or groups failed transmissions for review. The human product owner checks each source and decides whether to accept the suggestion.

Automated action: a system writes to the marketplace account, changes an offer, acts on an order or sends a message. That step has wider consequences and needs enforced permissions, predeclared conditions and a named decision owner. CMA guidance published on 9 March 2026 says businesses remain responsible when AI agents deal with customers. It does not approve a particular workflow.

Keep order states separate. A suggestion about an order placed cannot authorise payment capture, prove fulfilment, settle a refund or resolve a dispute.

Design one reversible evaluation

Use fictional or specifically authorised records. Include an approved product fact, an unsupported claim, a changed total price, a genuine optional choice, conflicting stock, a duplicate event, a late cancellation, a partial refund and revoked account access. Record the model or service version, prompt, retrieved sources, output, human decision and expected result.

The acceptance fields stay buyer-owned and blank until qualified reviewers set them. Test error detection, provenance, refusal, permission enforcement and rollback separately. A successful fixture does not establish accuracy across a catalogue, accessibility for every user, product safety, compliance or commercial value.

NCSC's secure AI system development guidelines, published in 2023, address secure design, development, deployment and operation. Its August 2026 interim agentic AI advice recommends sandboxing, oversight, monitoring and an emergency stop. The latter says formal guidance is still being developed, so its status must be rechecked.

Keep eight review gates independent

1. Source and IP: retain the authorised input, licence or permission, output provenance and human approval. Do not assume a model may reuse protected catalogue material.
2. Consumer presentation: verify product facts, total price, optional choices and correction behaviour. AI does not lower the evidence standard.
3. Product safety: route safety and traceability decisions to a qualified specialist. A model may flag missing evidence but cannot approve a product.
4. Privacy and PECR: map purposes, data roles, device storage or access, retention and deletion. The ICO's final 2026 guidance is the current tracking baseline.
5. Bias and accessibility: test defined staff and customer tasks with an accessibility practitioner. Do not infer protected traits or vulnerability.
6. Security: restrict accounts, tools, networks and data. Log attempted out-of-scope actions and protect the logs themselves.
7. Marketplace authority: verify the seller account, API permission and contract. A proposed mapping cannot grant access.
8. Recovery: preserve the last approved state, manual route, access-removal control, export and isolated restore evidence.

Decide whether autonomy is justified

The operational question is not whether AI is available. It is whether a narrowly specified task performs acceptably under authorised evidence and whether failure can be contained. Start in read-only mode. Stop if provenance disappears, the system crosses an authority boundary, a material error reaches a customer-facing draft, or rollback cannot reproduce the approved state.

Recheck the CMA, ICO and NCSC records before any pilot and on every service, model, permission or purpose change. Qualified consumer, safety, privacy, accessibility, security and IP reviewers must sign their own gates. Until then, production automation remains on HOLD.