How Bloomreach uses AI

Bloomreach puts AI at the center of the commerce experience. It powers search that understands intent, conversations that feel personal, and marketing that adapts in real time. We build that AI with the same care you'd expect for your brand: transparent, well governed, and designed around the rules shaping AI worldwide, including the EU AI Act.

Our commitment

More than 1,400 brands trust Bloomreach to personalize experiences for millions of shoppers. That trust comes with responsibility. Our AI program rests on 4 principles:

Transparent by design. We explain where AI runs in our products, what it does, and when your customers are talking to an AI.
Human in control. You set the goals, guardrails, and approvals. Our AI works for your team and never replaces its judgment.
Built on responsible data. We process customer data under GDPR, UK GDPR, CCPA/CPRA, and our contractual commitments to you.
Governed end to end. Every AI feature goes through risk assessment, testing, and ongoing monitoring before and after launch.

Where AI powers Bloomreach

Ready for the EU AI Act, and what comes next

The EU AI Act is the world's first comprehensive AI law. We see it as a useful blueprint for building trustworthy AI everywhere, not only in Europe.

Here's how we approach it:

We map every AI feature. We inventory every AI system on our platform and assess each one against the Act's risk categories.
We're clear about roles. Bloomreach builds and provides the AI. You deploy it with your customers. We give you the documentation and controls to meet your own obligations.
We build in transparency. Where shoppers talk with an AI or see AI-generated content, our products support clear disclosure.
We invest in AI literacy. Bloomreach teams who build, sell, and support AI get training on responsible use.
We watch the horizon. AI regulation keeps changing in the EU, UK, US, and beyond. Our governance program adapts so your team doesn't have to start over.

How we govern AI

Risk assessments for every new AI feature, covering accuracy, bias, security, and privacy.
Third-party model oversight: we vet the AI model providers we work with and bind them to strict data-protection terms.
Security first: AI features inherit Bloomreach's enterprise security program. That program is independently validated through an annual SOC 2 Type II report and certification to ISO/IEC 27001, 27017, 27018, 9001, and 22301, plus annual third-party penetration testing of each product. For details, visit Trust Center.
Continuous monitoring of performance after launch, with clear channels to report issues.

You stay in control

Set approval workflows before AI-generated campaigns or content go live.
Configure business rules and guardrails for autonomous search and marketing.
Get documentation for your own AI Act, privacy, and procurement reviews.

FAQ

Is Bloomreach compliant with the EU AI Act?

The Act's obligations phase in over several years. We have a dedicated program to meet the requirements that apply to our products as each one takes effect, and we keep our customers informed along the way.

Which AI models does Bloomreach use?

We use a combination of proprietary models and carefully vetted third-party models. See our subprocessor page for details.

How do I tell my customers they're interacting with AI?

Our conversational features support built-in AI disclosure. Each product page explains the configuration options.

Where can I get documentation for my compliance review?

Visit our Trust Center or contact your account team.