When food companies advance AI from testing to full deployment, ensuring regulatory compliance becomes essential to prevent safety risks and enforcement consequences. Walker Morris’ Commercial Director Paul Armstrong notes that while AI can enhance demand predictions, streamline traceability processes, and automate customer interactions, businesses remain ultimately responsible if AI failures lead to compliance breaches or recalls.
Defining Clear AI Use Cases
Armstrong notes that many food businesses are using AI in various ways, including demand forecasting, inventory management, and camera-based shelf monitoring. However, he cautions that businesses must start with a defined operational problem and develop a clear idea of how AI can be used to improve it.
Focusing on specific use cases gives the pilot a clear goal, while agreeing on success metrics upfront ensures a strong technical demo isn’t mistaken for real operational gain. The organization needs proof that the benefits outweigh the system’s cost, complexity, and risk exposure.
Armstrong emphasizes the importance of bringing employees into the implementation process early and investing in training to ensure they understand the role they are being asked to play.
Establishing Governance and Oversight
Effective oversight depends on having a defined process, skilled personnel, and sufficient data to evaluate results critically. The FSA Science Council advises validating tools with actual operational data and understanding both their intended function and limitations. Armstrong warns against assuming AI will work smoothly just because it’s embedded in familiar software.
Related Post: Taste Test Finds Best Fast Food Fries
A central registry should include both standalone AI tools and AI features built into existing platforms, documenting each system’s purpose, owner, users, data sources, risk level, approved controls, and deployment status. Detailed logs must separate AI-generated outputs from final human decisions and record any overrides or challenges.
Managing Shadow AI Risks
Armstrong flags shadow AI as a major concern, where staff use unapproved tools on personal devices, leaving the company unaware of what data is being processed or why. Implementing an approved tool list, limiting sensitive data exposure, and creating a process for suggesting new uses can guide safe experimentation while maintaining oversight.
Existing responsibilities for food safety, traceability, labeling, authenticity, withdrawal, and recall continue to apply when AI is introduced. Armstrong emphasizes that the food business remains liable for any errors, even if an AI system is used, and that contracts with suppliers do not automatically transfer regulatory responsibility.
Handling UK and EU AI Regulations
The UK oversees AI through a patchwork of existing laws rather than a single dedicated framework. Depending on the use case, food safety, data privacy, consumer rights, product liability, and employment law may all apply. The EU takes a different path with its AI Act, using a risk-based model that assigns responsibilities based on whether an entity acts as a provider, deployer, importer, or distributor.
Before scaling an AI system beyond the pilot phase, a food company should clearly answer key questions: What specific problem is it solving? Has it been tested with real-world data? What happens if the system fails or gives incorrect results? Armstrong adds that companies must also decide which decisions should stay with a qualified human operator.
Related Post: Hidden costs of basic food safety training
By June 2026, the ONS reported that 29% of businesses were using AI, with adoption reaching 49% among firms with 250+ employees. The FSA Science Council’s June 2026 report looked at AI in manufactured food risk assessment, certification support, abattoir pathology detection, and port document checks, noting that many systems were repurposed from other sectors and may not be fully validated for food safety use.
Given the complexity of AI systems, food businesses must ensure that their contracts with suppliers provide the necessary information and support to operate the system safely. This includes explainability, access to operational records, and contractual support for governance and monitoring after deployment.
In the EU, the AI Act allocates duties according to whether an organization is acting as a provider, deployer, importer, or distributor, with an AI-literacy obligation that has applied since February 2025. Food businesses should examine AI used in employment, biometrics, or as a safety component of regulated machinery particularly carefully, establishing their own role under the Act instead of assuming every obligation rests with the vendor.
The Commission’s draft high-risk classification guidelines remain under consultation, with application dates set for December 2027 for certain stand-alone high-risk systems and August 2028 for AI embedded in regulated products. Businesses should continue monitoring the final legislative text and supporting guidance, as liability law adapts to digital products and emerging technologies.
The UK Law Commission plans to consult on possible product-liability reform during the second half of 2026, while the EU’s revised Product Liability Directive applies to products placed on the market or put into service from 9 December 2026, expressly encompassing software and AI systems. The directive’s requirements will need to be met by food businesses operating in the EU.