AI is becoming an increasingly familiar part of the online shopping journey. A recent YouGov report shows that more than a third (34%) of likely Black Friday and Cyber Monday shoppers expect to use AI to help navigate the sales, while 40% would be comfortable using it to find the best price. Yet only 5% would currently be comfortable allowing AI to complete an approved purchase.

Agentic AI could change this dynamic. Unlike tools that simply respond to prompts, AI agents can make decisions, interact with other systems and automate more open-ended tasks. In the context of online shopping, the Information Commission’s Office (ICO) suggests that personal shopping agents could anticipate a consumer’s needs, search for products, monitor sales, check whether a purchase is within budget and even negotiate prices or identify tailored financing options.

As consumers begin delegating more of the shopping journey to AI, retailers may see an increase in automated interactions with their websites, platforms and payment systems. This brings cyber security, data protection and resilience into sharper focus.

Recent high-profile cyber incidents affecting the retail sector have provided a timely reminder of the importance of protecting customer data, digital platforms and the third-party systems on which businesses increasingly rely.

The National Cyber Security Centre (NCSC) has also warned that AI is changing the scale and speed of cyber attacks, with the potential to help attackers conduct activities such as vulnerability discovery and reconnaissance at greater scale and faster pace.

For in-house counsel, there are five areas worth considering to ensure your organisation's cyber security and resilience arrangements keep pace.

1. Are your organisational cyber security measures still appropriate?

Cyber security is not solely an IT issue. Where personal data is involved, it is also a legal and regulatory concern.

A key principle of the UK GDPR is that organisations must process personal data securely using "appropriate technical and organisational measures". The ICO says this requires organisations to consider areas including risk analysis, organisational policies and physical and technical measures.

For online retailers, organisational measures are therefore just as important as the technology itself.

Organisations should consider whether responsibility for cyber risk is clearly defined, security policies are regularly reviewed and implemented, employees understand their responsibilities and access to systems and information is appropriately governed.

Third-party risk should also be part of the conversation. Ecommerce businesses increasingly operate within interconnected digital ecosystems involving technology, communications, payment and other service providers. Understanding which third parties can access systems or customer information, and ensuring appropriate cyber security and incident response provisions are in place, should therefore form an important part of cyber risk management.

2. Do your technical controls reflect a changing threat?

Strong organisational measures need to be supported by appropriate technical controls.

The ICO identifies four overarching security outcomes: managing security risk, protecting personal data against cyber attack, detecting security events and minimising their impact. UK GDPR requirements also include data protection by design under Article 25 and security of processing under Article 32.

Crucially, cyber security should not be treated as a "set and forget" exercise.

The NCSC says AI is already helping attackers conduct elements of offensive cyber activity, such as vulnerability discovery and reconnaissance, at a greater scale and faster pace. It has also highlighted the continuing importance of addressing familiar weaknesses, including outdated or unsupported systems, delays in applying security updates, and weak controls over access to systems and data.

For retailers, the question is therefore not simply whether cyber security controls exist, but whether those controls remain appropriate as technology and the threat landscape evolve.

3. Are you giving payment security sufficient attention?

As new technology becomes embedded in the ecommerce journey, protecting payment environments remains fundamental.

The Payment Card Industry Data Security Standard (PCI DSS) sets out technical and operational security controls for protecting payment account data. Its requirements cover areas including network security, secure systems and software, access controls, authentication, logging and monitoring, security testing and incident-response programmes.

Payment security should form part of the wider conversation around ecommerce cyber resilience rather than being viewed as an isolated compliance exercise.

Organisations should understand which elements of their payment environment fall within the standard's scope and how responsibilities are allocated when third-party technology or payment providers are involved.

Legal, cyber security, IT and procurement teams can all play a role in developing a clear picture of where information travels, who has access to it and where contractual and operational responsibilities sit.

4. Do you know what happens when something goes wrong?

Even strong preventative controls cannot eliminate cyber risk entirely. Being prepared to respond effectively to an incident is therefore as important as trying to prevent one.

The ICO says appropriate security measures should enable organisations to restore the availability of and access to personal data in a timely manner following a physical or technical incident. Organisations should also have processes in place to regularly test the effectiveness of their security measures and undertake improvements where necessary.

This brings cyber resilience firmly into in-house counsel's remit.

Who makes key decisions during a cyber incident? How will the business determine whether legal, regulatory, insurance or contractual notifications are required? How will technical, legal, operational and communications teams work together? And how will the organisation manage affected suppliers and other third parties?

Incident response plans should not simply exist on paper. They need to be tested so that relevant teams understand their roles and organisations can identify weaknesses before a real incident occurs.

The middle of a cyber incident is not the time to establish who is responsible for what.

5. What if you are using AI to strengthen cyber security?

AI is not only changing the potential threat. It is also being explored as part of the defence.

The NCSC and Department for Science, Innovation and Technology are developing Cyber Shield, a blueprint for an approach to agentic cyber defence using frontier AI to identify, reduce and resolve national cyber risk.

However, deploying AI does not remove the need to get the cyber security fundamentals right.

Organisations considering AI within their cyber security environment should assess the technology alongside their existing controls and consider any additional risks it introduces.

Our recent article, AI agents: why governance, oversight and guardrails matter more than ever, highlights measures including security testing, access reviews, incident response planning, business continuity exercises and ongoing monitoring when organisations deploy AI agents.

As the use of AI in cyber defence develops, businesses should therefore resist viewing it as a substitute for established security and resilience measures.

Five cyber security questions in-house counsel should ask now

AI may change how consumers interact with online retailers, but the fundamentals of cyber resilience remain vital. In-house counsel should be asking:

  1. Are our organisational and technical security measures appropriate for our current cyber risk?
  2. Do we understand the cyber security of third parties with access to our systems or customer information?
  3. Are our ecommerce payment arrangements aligned with the PCI DSS requirements that apply to us?
  4. Have we tested our cyber incident response plan, including legal, regulatory and communications decision-making?
  5. If we use AI within our cyber security arrangements, have we assessed the additional risks and controls involved?

AI is changing both sides of the cyber equation. Consumers are beginning to use it as part of the ecommerce journey, while the NCSC has highlighted its potential to increase the speed and scale of cyber attacks and to play a role in cyber defence.

For in-house counsel, the response does not need to start with the technology. It starts with the fundamentals: understand the risk, implement appropriate controls, test those controls and know how the organisation will respond if something goes wrong.

As AI becomes more embedded in ecommerce, now is a good time to ask whether those foundations are strong enough for what comes next.

How we can help

Cyber threats and the technologies used to respond to them are evolving quickly. If you would like to discuss how your organisation can strengthen its cyber security and resilience, or any of the issues covered in this article, please get in touch with our Cyber Security & Resilience team.