Navigating AI Dynamic Pricing Compliance for Supply Chains

The AI dynamic pricing controversy supply chain leaders now face is no longer only about whether a retailer charged two shoppers different prices. By mid-2026, the harder problem is operational: one pricing engine may run across states that treat algorithmic pricing differently, pull from data sources that legal has never inventoried, and rely on vendor recommendations that procurement approved before anyone asked how the runtime decision could be explained.

That matters because pricing systems are rarely isolated tools. A supply chain pricing stack may combine inventory position, customer history, location signals, competitor benchmarks, freight costs, vendor feeds, channel constraints, and sales-team overrides. The compliance exposure sits in those connections: what data enters the model, who supplied it, whether competitors are indirectly sharing sensitive information through a common platform, whether price recommendations are automatically accepted, and whether customers receive legally adequate notice when personal data influences the price.

Fragmented United States map with supply chain network lines and regulatory warning icons

The Patchwork Is Now an Operating Constraint

New York, Maryland, California, and Connecticut are now part of the state-level algorithmic pricing map, while federal agencies have moved beyond speeches and into studies, investigations, and settlement terms. The laws do not impose one uniform duty. Some focus on disclosure. Some focus on sector-specific bans. Some sharpen antitrust exposure when common pricing algorithms coordinate market behavior. That makes a national pricing rollout more complicated than adding a legal footnote to a model governance policy.

New York’s Algorithmic Pricing Disclosure Act, effective November 2025, requires conspicuous disclosure when personal data is used to set algorithmic prices. The same Arnold & Porter advisory that summarizes the law also points to the New York attorney general’s Instacart inquiry as a practical warning: burying algorithmic pricing language in fine print may not satisfy a “clear and conspicuous” disclosure standard.[1]

For a supply chain organization, that is not just a consumer-app issue. If a distributor, grocery supplier, marketplace, or direct-to-business portal uses personal data to adjust prices, rebates, fees, or offers, the disclosure review has to happen at the actual customer touchpoint. A clause in a master services agreement may not help if the legally relevant notice is supposed to be visible when the price is presented.

Maryland’s Protection from Predatory Pricing Act is narrower but still important. Effective October 2026, it is described as the first U.S. state law to ban personalized pricing outright in the grocery sector, with civil penalties of up to $10,000 per violation.[1] That does not mean every B2B manufacturer using revenue management software has suddenly entered a Maryland grocery pricing ban. It does mean grocery-linked supply chains should not assume a disclosure approach is always enough.

California’s AB 325, enacted in October 2025, takes the issue into antitrust territory. The law amended the Cartwright Act to make it unlawful to use or distribute a common pricing algorithm as part of a contract, combination, or conspiracy to restrain trade.[1] The risk here is less about a customer seeing a personalized price and more about whether competitors, knowingly or through a shared intermediary, are allowing a pricing system to coordinate market conduct.

Connecticut also belongs in the mid-2026 patchwork, though the public summaries available for this article do not support the same level of operational detail as New York, Maryland, or California. The practical point is still clear enough: a multi-state pricing program cannot be governed as if one generic algorithmic pricing policy answers every state trigger.

Notice, Data, and Intermediaries Are the Parts Regulators Keep Touching

The Federal Trade Commission’s January 2025 6(b) surveillance pricing study widened the lens from sellers to intermediaries. The FTC said intermediaries serving more than 250 clients, including Mastercard, Accenture, PROS, Bloomreach, Revionics, and McKinsey, can help determine individualized prices using granular data such as precise location, browser history, mouse movements, and unpurchased cart items.[2]

That finding should make procurement teams pause before treating a pricing vendor as a neutral software supplier. If the vendor enriches pricing decisions with behavioral data, benchmarking feeds, third-party identity data, or observed customer intent, the buyer needs to know exactly what is being processed and whether the organization could explain that use to regulators, customers, or counterparties.

Data streams for personal data, competitor benchmarks, vendor feeds, and inventory signals converging into an algorithm node

The FTC study is an interim report, not a final rule. It does not prove that every use of individualized pricing is unlawful. But it gives a useful map of what regulators consider worth investigating: intermediaries, hidden data flows, behavioral inference, and the gap between what a customer sees and what a pricing engine knows.

That gap appears in supply chains in less obvious forms. A parts supplier may not use mouse movements, but it may use quote history, contract tier, replenishment urgency, region, purchase frequency, competitive win-loss data, or distributor-submitted benchmarks. Some of those inputs are ordinary commercial facts. Some may be personal data. Some may be competitively sensitive. Some may be vendor-derived in ways the buyer has never reviewed.

RealPage Is the Clearest Warning for Shared Pricing Platforms

The RealPage consent decree is the most concrete compliance template in the mid-2026 record because it moves from general concern to operational restrictions. In May 2026, the Justice Department announced a consent decree requiring RealPage to operate under a three-year independent compliance monitor, prohibiting the use of nonpublic competitor data in runtime pricing, and barring auto-accept functionality.[3]

Those obligations are useful precisely because they are not abstract AI principles. They identify controls that can be tested: whether competitor data enters the live pricing process, whether a human must review a recommendation before adoption, and whether an independent monitor can verify compliance. For any supply chain platform that aggregates market information across competitors, those are the right questions to ask now.

The runtime point deserves special attention. Many vendors can say, truthfully, that their customers control inputs or remain responsible for final pricing decisions. That assurance is too thin if the system’s live recommendation is shaped by nonpublic competitor data, if the buyer cannot separate permissible benchmarks from prohibited inputs, or if sales teams are effectively expected to accept the recommendation by default.

Auto-accept is not just a product feature. It changes accountability. If a pricing system recommends a number and the platform automatically applies it unless someone intervenes, the organization needs evidence showing who approved that design, what guardrails applied, when exceptions were reviewed, and whether the system could be disabled by jurisdiction, product line, customer class, or data source.

RealPage is also a reminder that aggregated data can be more dangerous than it looks. A benchmark may feel anonymized from the business user’s chair. Regulators may ask a different question: whether competitors’ nonpublic information is being operationalized into pricing recommendations that restrain independent decision-making.

Where B2B Supply Chains Should Resist False Comfort

There is a real difference between consumer-facing individualized pricing and B2B supply chain pricing. Many supply chain prices are negotiated. They may be governed by long-term contracts, volume commitments, channel rules, distributor programs, freight terms, service-level obligations, and manual approvals. A statute aimed at grocery-sector personalized pricing may not directly govern an industrial supplier’s negotiated annual price list.

But that distinction should narrow the analysis, not end it. B2B pricing stacks can still ingest personal data, especially in portals, marketplaces, inside-sales tools, and quote engines tied to named buyers. They can still use competitor-sensitive information through benchmarks, market indices, win-loss feeds, or vendor-provided recommendations. They can still create disclosure problems if personal data affects a displayed price or offer. They can still create antitrust problems if a common pricing algorithm reduces independent competitive judgment.

Pricing-stack feature	Why it matters in mid-2026
Personal data used to set or adjust a price	May trigger disclosure obligations in states such as New York, depending on the facts and implementation.
Grocery-sector personalized pricing	May face a direct ban in Maryland once the law is effective, rather than a notice-based regime.
Common pricing algorithm used by competitors	Can raise antitrust exposure under California’s amended Cartwright Act when tied to a contract, combination, or conspiracy to restrain trade.
Vendor benchmarks or pooled market data	Requires review for nonpublic competitor information, especially if the data influences runtime pricing.
Auto-accept or default adoption of recommendations	Can weaken the argument that humans make independent pricing decisions unless approval and override evidence exists.
Buried disclosure language	May fail where a clear and conspicuous notice standard applies.

The common procurement failure is to review the vendor’s security posture and skip the pricing logic. A SOC report will not answer whether the platform pools competitor data, whether benchmark inputs are public or nonpublic, whether the model uses personal behavioral signals, or whether the customer can produce a decision log when a regulator asks why a price changed.

A Compliance Review Should Start With Inputs, Not the Model Demo

The first useful document is an input inventory. It should list the data fields that influence price, the source of each field, whether the field contains personal data, whether it includes competitor or market information, whether it is public or nonpublic, and whether it is used for model training, batch recommendations, or runtime pricing.

Runtime use should be separated from offline analytics. A vendor may use market data to produce a periodic planning report, while a different configuration uses that same category of data to set live price recommendations. Those two uses do not carry the same risk. The RealPage restrictions make that distinction impossible to ignore.

Identify every system that can recommend, rank, personalize, approve, or automatically apply a price, fee, discount, rebate, surcharge, or offer.
Map each input to its source: internal transaction data, customer-provided data, public market data, vendor feed, broker feed, competitor benchmark, behavioral signal, or third-party enrichment.
Mark whether the input is used at runtime, during model training, during periodic optimization, or only in reporting.
Confirm whether any input can identify or profile a person, even if the final price is presented to a business account.
Determine whether any benchmark or market feed contains nonpublic competitor data or is derived from customers that compete with one another.
Record who can approve, override, suspend, or localize the pricing recommendation by jurisdiction.

This inventory should not live only in a procurement folder. Legal, revenue management, sales operations, data governance, and IT need access to the same version because each group owns a different part of the risk. If the business cannot tell whether a data field is personal, if procurement cannot tell whether the vendor pools customer data, and if sales cannot tell when the recommendation can be overridden, the control is not operational.

Vendor Contracts Need More Than an AI Warranty

A generic warranty that the vendor will comply with applicable law is not enough for algorithmic pricing. The buyer needs terms that match the risk profile of the pricing stack: data-use limits, competitor-data restrictions, audit rights, configuration controls, disclosure support, change notices, and records that survive leadership turnover.

The contract should state whether the vendor may use customer data to improve recommendations for other customers, whether data from competitors can influence the buyer’s recommendations, whether the vendor supplies benchmark data, and whether those benchmarks are public, aggregated, anonymized, delayed, or derived from nonpublic customer submissions. Labels are not enough; the agreement should describe the operational effect of the data.

Prohibit nonpublic competitor data from influencing runtime pricing unless counsel has approved a specific, documented use case.
Require advance notice before the vendor changes data sources, model logic, benchmark methodology, or auto-accept settings.
Reserve audit rights for data provenance, benchmark construction, recommendation logs, and customer-specific configuration.
Require support for state-specific disclosures and the ability to disable features by jurisdiction or sector.
Define who owns records of recommendations, acceptances, overrides, suppressions, and manual approvals.
Require prompt cooperation if an attorney general, the FTC, the DOJ, or another authority asks how a price was generated.

The most important clause may be the least glamorous one: the right to turn features off. If a system cannot disable certain inputs, jurisdictions, sectors, customer groups, or auto-accept functions without breaking the commercial workflow, the organization has bought compliance rigidity along with optimization.

Disclosure Review Belongs in the Pricing Workflow

New York’s disclosure rule and the Instacart inquiry put notice design on the operating agenda. The legal question is not only whether the organization disclosed algorithmic pricing somewhere. It is whether the disclosure is conspicuous enough, timely enough, and placed where the affected customer can understand that personal data is being used to set the price.[1]

For supply chain teams, the first mistake is assuming that B2B customers never see individualized digital prices. Many do: through reorder portals, distributor marketplaces, electronic catalogs, configure-price-quote tools, punchout systems, and inside-sales screens that generate offers based on account behavior. If personal data affects those outputs, the notice question should be reviewed before the system goes live.

Disclosure review should include the screen where the price appears, the contract flow, the quote email, the customer portal, and any mobile or marketplace interface. It should also test whether the notice survives localization, white labeling, distributor resale, and embedded vendor tools. A disclosure approved for one channel may disappear in another.

Human Review Has to Leave Evidence

Human-in-the-loop language is easy to write and hard to prove. If the recommended price is accepted 99 times out of 100 because the workflow makes review impractical, the organization should not rely on a policy statement saying humans retain final authority. The question is what the system records.

Useful records include recommendation logs, the inputs or input categories used, confidence or constraint flags where available, the user who accepted or changed the recommendation, the reason code for an override, and the timing of approval. For high-risk products, jurisdictions, or customer classes, a second-level review may be appropriate before the price is released.

This is also where commercial discipline and compliance discipline meet. Pricing teams need room to respond to inventory, demand, and competitive context. Legal teams need records showing that the response was independent, explainable, and consistent with jurisdictional constraints. A system that only stores the final number leaves both teams exposed.

Do Not Wait for a Single Federal Rule

Freshfields’ 2026 enforcement analysis identifies algorithmic pricing as an enforcement priority across federal and state authorities.[4] That does not settle every legal question. It does, however, make delay harder to defend when basic governance work is available now.

BCG’s 2026 work on B2B AI pricing makes a related point from the implementation side: it attributes 70% of the effort to change management and trust-building, compared with 10% to algorithms and 20% to tools.[5] That split is a useful corrective. The hard part is not only whether the model can optimize. It is whether sales, pricing, legal, procurement, and data teams trust the process enough to use it and document it.

The mid-2026 operating position is therefore practical rather than dramatic. Audit the inputs. Separate runtime pricing from analytics. Restrict nonpublic competitor data. Review notices where personal data affects price. Renegotiate vendor obligations before renewal. Govern or disable automatic acceptance where the record cannot support independent decision-making. Build approval and override evidence while the organization still has room to design it deliberately.