Ecommerce platforms risk scenarios: a platform comparison

Ecommerce platforms risk scenarios help an England merchant rehearse decisions without pretending to know the future. The five branches below have no assigned likelihood, loss or performance outcome.

The case is one legal seller offering ordinary physical goods to UK adults. Each branch is editorial, not a reported incident.

How the five risks differ across ecommerce platforms

The comparison below identifies useful exercise priorities, not claims that a risk is more likely on one service. The five scenarios can apply to any seller; exact controls depend on the seller's setup and the platform's current services and terms.

What to take away

1. An AI output changes a customer decision

Driver: A supplier enables automated copy, recommendation, service or refund handling. Signposts: an unsupported product statement, wrong price, unsuitable ranking or inconsistent rights answer. Counter-signals: sampled outputs continue to match approved records and exceptions reach a competent person. Owner: consumer-journey lead. Response and rollback: disable the action, restore the manual route and correct affected content or cases. Recovery evidence: reviewed samples, source reconciliation, complaint check and authorised restart.

The CMA's AI-agent consumer guidance keeps responsibility with the business and calls for monitoring, human oversight and quick correction. For product descriptions, the Consumer Rights Act's goods-as-described requirement is relevant; this exercise does not certify a model or establish compliance.

For example, an England shop on Shopify or WooCommerce that uses an AI product-description app should treat a wrong size, material or price output as a signpost.

2. Order and money records diverge

Driver: A checkout, gateway or integration changes state mapping. Signposts: an authorisation, capture, refund, dispute or settlement has no matching order event. Counter-signals: the versioned reconciliation closes with explained exceptions. Owner: payments and finance lead. Response and rollback: pause the affected payable event, protect existing customer rights and move authorised cases to the fallback. Recovery evidence: matched state log, accountant review and technical restart approval.

The FCA asks businesses to consider whether their activity is a payment service. The Payment Services Regulations set the legal perimeter for regulated payment services; using a platform does not answer it. That perimeter requires specialist advice.

For example, an England seller taking card payments through Stripe, Worldpay or PayPal should reconcile each gateway event with the matching order record.

3. Tracking purpose or destination changes

Driver: A tag, pixel, script, AI service or subprocessor changes. Signposts: an unregistered device-access method, recipient, purpose or retention period. Counter-signals: the deployed inventory matches the approved data map. Owner: privacy lead. Response and rollback: block the release or disable the component, preserve logs and assess affected people. Recovery evidence: clean scan, updated assessment and notice, rights route and signed privacy approval.

The ICO's final storage and access guidance covers cookies and several other technologies. Applicability and any exception need a case-specific review of UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

For example, an England shop using Meta Pixel, Google Analytics 4 or Klaviyo should check each tag against its approved data map.

4. A product must be corrected or withdrawn

Driver: A safety notice, incident report or evidence gap affects an item. Signposts: absent traceability, changed warning or conflicting product record. Counter-signals: current technical evidence and channel listings remain reconciled. Owner: product-safety lead. Response and rollback: suppress the item on every route, stop fulfilment where authorised and follow the incident and customer-contact process. Recovery evidence: removal search, traceability record, regulator or specialist actions and controlled reapproval.

Current OPSS guidance describes record keeping, traceability and corrective action and distinguishes Great Britain from Northern Ireland. For applicable consumer goods, the General Product Safety Regulations are relevant; use the OPSS “Report a consumer product safety issue to the Office for Product Safety and Standards” route for product-safety reporting. It is not a product-specific safety finding.

For example, an England seller listing on Amazon UK, eBay UK or Etsy should check traceability, warnings and product records for each channel.

5. A critical supplier route becomes unavailable

Driver: A contract, API, account, support or security change affects a required journey. Signposts: failed export, lost privileged access, unannounced data location or an unrecoverable order state. Counter-signals: recent export, restore and access tests pass against current documentation. Owner: service-continuity lead. Response and rollback: freeze non-essential change, revoke unnecessary access, preserve evidence and invoke the approved alternative. Recovery evidence: restored catalogue and order data, reconciled permissions, incident record and service-owner sign-off.

NCSC supplier-assurance questions cover privileged access, remote connections, data protection and offshoring. They structure due diligence but do not guarantee supplier security.

For example, a courier route with Royal Mail, Evri or DPD, or a marketplace account with Amazon UK, can fail and require the approved alternative.

Exercise cadence, record template and worked example

Suggested cadence: review the branch set at least twice a year, and re-run a branch after a material change. Material changes include a new gateway, marketplace policy update, supplier contract renewal, safety notice or privacy change.

Record for each exercise: driver, signpost, counter-signal, named role, trigger, probability, decision time, action, customer impact, evidence preserved and recovery result. Use synthetic or authorised data. Stop if an exercise could affect live orders, payments, personal data or safety controls.

Worked example record (illustrative, not a reported incident):

Before you run an exercise

Common questions

What must be recorded for each exercise?

Use the record template above. The worked example shows the fields from driver through recovery evidence.

When should a scenario branch be retired?

Retire when its driver disappears or evidence disproves its premise. Add a branch only for a verified change that creates a distinct decision.