AI in Fashion 

UK Legal and Compliance Considerations

From Zara’s digitally generated model imagery to H&M’s virtual clones, artificial intelligence (AI) is reshaping how fashion brands create, market and sell. However, with innovation comes risk, leaving fashion brands navigating the space between cutting-edge technology and evolving regulation.

The shift is already well underway. Zara has been reported to use AI to create images of real models in alternative outfits so speeding up the production process. Additionally, H&M announced that it would be exploring generative AI and launched a campaign featuring “digital twins”.

While the commercial benefits are clear, AI’s access to such large volumes of data creates significant legal exposure, particularly around data protection, consumer transparency and advertising standards.

This article examines the principal legal issues that fashion brands need to consider with the usage of AI in their operations and the necessary steps to ensure compliance with the law.

What are the AI regulations that apply to fashion brands?

What does the EU AI Act mean for fashion brands?

The EU AI Act 2024 is the first comprehensive AI legislation in the EU which imposes specific transparency obligations for AI-generated content. Article 50 outlines that providers of AI systems which interact directly with people, such as virtual assistants, must ensure users are informed that they are engaging with AI, as well as ensuring any manipulated image, video, and text are clearly labelled as artificially generated or altered.

The EU AI Act 2024 adopts a tiered penalty structure for non-compliance. Breaches of the act’s core obligations, including transparency requirements, can attract administrative fines of up to €15 million or 3% of global annual turnover.

How is AI regulated in the UK?

The UK has taken a different approach. Rather than introducing dedicated AI legislation, it relies on a principles-based framework set out in its AI Regulation White Paper which aims to ensure five core principles: safety, transparency, fairness, accountability, and contestability.

It also relies on its UK GDPR, the Data Protection Act 2018 (as amended), consumer protection law and the Equality Act 2010.

However, it is recognised that the challenges presented by AI technologies will eventually require legislative action once appreciation of the of risk has developed.

Does the EU AI Act apply to UK fashion businesses?

That said, the EU AI Act 2024 remains relevant for UK brands since its scope extends beyond the EU’s borders. Any UK business that sells products or services to EU customers, deploys AI systems that affect individuals in the EU or develops AI-generated outputs used within the EU may be required to comply with theaact.

As a landmark piece of AI legislation, the EU AI Act may serve as an influential reference point for the development of AI regulation in other jurisdictions.

What data protection rules apply to AI in fashion?

When can fashion brands use personal data for AI?

Fashion brands using AI systems that process personal data must comply with the UK GDPR and the Data Protection Act 2018 (as amended).

The fundamentals apply – any AI processing of personal data needs a valid lawful basis under Article 6, and purpose limitation remains critical meaning data collected for one purpose, such as placing an order, cannot simply be repurposed for AI model training.

Are AI virtual fitting rooms and try-on tools GDPR compliant?

When does virtual try-on technology use biometric data?

Virtual try-on features where consumers visualise clothing or cosmetics on themselves represent a high-risk use of AI applications from a data protection perspective. These tools process facial images, body shapes and potentially three-dimensional measurements that may constitute biometric data under the UK GDPR.

When processed to identify an individual, biometric data is classified as special category data, triggering Article 9 protections. The Information Commissioner’s Office (ICO) advises that explicit consent is typically required and that means consent that is clear, freely given, informed and specific, not merely assumed from a consumer’s use of the tool.

Zara has recently launched a virtual fitting room which allows users to submit a selfie and full-body photograph to generate an avatar that “tries-on” clothes. Outside of the fashion sector, L’Oreal has partnered with OpenAI to develop AI-powered tools for personalised beauty experiences, including virtual try-on technology that lets consumers visualise cosmetics on their own features.

These examples illustrate how brands across fashion and beauty are increasingly relying on facial and body data to deliver an immersive shopping experience.

When do fashion brands need a data protection impact assessment (DPIA)?

A DPIA is mandatory when data processing is likely to result in high risk to individuals’ rights and freedoms. Most AI applications in fashion will trigger this requirement since large amounts of sensitive data processing and profiling consumers are both red flags.

In-house teams should build DPIAs into the development lifecycle of any AI-powered feature.

Can AI tools transfer customer data outside the UK?

How do international data transfer rules apply to AI providers?

Brands using AI services must understand whether through use of any AI systems any international transfer of their data may take place and if this is the case consider the provisions under Chapter V of the UK GDPR rules.

Any transfer of personal data to another country needs appropriate safeguards typically UK International Data Transfer Agreements (IDTAs) or similar mechanisms. Without them, the processing is unlawful and the ICO can take enforcement action.

The ICO’s enforcement includes warnings, reprimands, enforcement notices requiring organisations to take corrective steps, and penalty notices carrying fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher.

The practical message is that in-house teams should map any data flows, understand where AI providers process data and ensure the right contractual provisions are in place.

Do fashion brands need to disclose AI-generated content?

When is AI disclosure required under UK consumer law?

Beyond the data protection considerations, fashion brands must also comply with existing consumer protection statutes, particularly the Digital Markets, Competition and Consumers Act 2024 (DMCCA) and the Consumer Rights Act 2015 (CRA). These prohibit misleading actions (providing false information or misleading information) and misleading omissions (hiding material information). Showing an AI-generated image as a genuine photograph, without disclosure, could breach both.

Can AI-generated fashion images mislead consumers?

The use of AI-generated imagery in fashion marketing raises particular concerns under consumer protection law. If AI portrays clothing or accessories with features that the product does not in fact possess, such as a higher-quality finish, additional embellishments, a different silhouette or more premium appearance, consumers may be misled about the nature or quality of the product they are purchasing.

Brands should therefore ensure that any AI-generated content accurately reflects the characteristics of the products being marketed and does not artificially enhance their appearance, quality or performance.

Similar concerns have arisen in the beauty sector. For example, the ASA upheld a complaint against an Instagram advertisement of tanning drops because the use of filters exaggerated the products effects and created a misleading impression of the results consumers could expect, eveon though the adidentified the filter used.

AI-generated imagery could raise similar concern where it enhances or alters a product’s appearance in a way that overstates its qualities or performance, particularly where the use of AI is not apparent to consumers.

Failing to disclose AI involvement could constitute a misleading omission under the DMCCA. However, even where AI use is disclosed, regulators may still scrutinise the ad if the overall impression remains misleading.

The stakes are high given that the Competition and Markets Authority, now has powers under the DMCCA to impose fines of up to 10% of global annual turnover for consumer protection breaches.

What are the advertising rules for AI-generated fashion marketing?

What does the ASA say about AI in advertising?

The ASA plays a vital role in policing AI transparency in fashion advertising. Under rules 3.1 and 3.3 of the CAP Code, marketing communications must not materially mislead or omit material information.

In May 2025, the ASA issued guidance clarifying that AI usage in advertising must be disclosed where it may mislead consumers about authenticity or performance, and encouraged “clear contextual language” such as identifying in captions or taglines clearly where AI has been used.

When should AI-generated marketing content be labelled?

Where AI changes what a consumer sees or understands, such as AI-generated models, changing a product fit or colour, disclosure is expected.

What should fashion brands do to stay compliant when using AI?

Fashion brands should adopt proactive disclosure practices for AI usage. This includes clear labelling on AI-generated images stating that such images have been created with AI assistance or the product has been enhanced by AI.

Brands should train marketing and creative teams to flag AI-generated content for legal review and establish workflows for AI-enhanced campaigns.

Brands using AI shopping assistants should also review their terms and conditions to address AI interactions and where appropriate limit liability. Additionally, where brands are using AI personalisation, virtual try-on tools or AI styling assistants, the terms of services should clearly indicate that AI has been used within the shopping experience, what data is collected and processed by the AI system, and how automated decisions are made.

Privacy notices should also be updated to reflect this, and consumers should be given the option to withdraw consent and to opt out of AI personalisation in a way to preserve their right to consent.

Key takeaways for fashion brands using AI

AI is transforming the fashion industry, bringing with it a range of legal and regulatory considerations. In the absence of dedicated UK AI legislation, fashion brands must comply with UK GDPR, the DMCCA, and the ASA’s advertising codes.

Whilet the precise obligations will depend on how AI is being used, businesses should assess compliance issues before deploying AI-powered marketing tools, personalisation technologies or customer-facing applications. Early consideration of data protection, transparency and governance requirements can help reduce risk, avoid costly remediation work and support the responsible adoption of AI.

Legal advice will be required to ensure that the appropriate checks and documents are in place, depending on the intended use of AI.

These could include:

• securing explicit consent for biometric processing in virtual try-on tools;
• disclosing AI imagery; brands should pay close attention to the AI systems they use and disclose AI-generated imagery clearly where it could influence a purchasing decision;
• conducting DPIAs for high-risk AI applications;
• mapping international data flows and ensuring appropriate transfer mechanisms; and
• ensuring correct contractual documents are in place acknowledging AI usage.

The brands that build compliance into their AI strategy now will not only mitigate the risk of any enforcement action, but they will be best placed to lead when UK legislation inevitably arrives.

This content is provided for general informational purposes only and does not constitute legal advice. It is not intended to address the circumstances of any individual or entity, nor should it be relied upon as a substitute for specific advice from a qualified solicitor. The information reflects the legal position as at the date specified and may be subject to change. If you require advice on a specific matter, please contact us directly.