The Mail-Order Rule, ROSCA, and Your Checkout: A 2026 Online-Store Playbook

Online retail feels like the safest possible place to put a helpful assistant. The transactions are small, the stakes seem low, and the whole job looks like deflecting support tickets. The catch is that four separate bodies of federal rule sit underneath an ordinary shopping conversation, and a general-purpose tool answers questions about all of them without knowing any of them exist. Every confident reply about shipping, refunds, subscriptions, or what a product does is a representation the store wears. The 2026 standard is about keeping the convenient assistant from quietly becoming the store’s compliance liability.

This guide is the companion to the threat piece. The threat side covers the ship-date and refund promises a store should never let its site make. This one covers the standard: what a compliant store assistant is allowed to say, what it routes to policy and people, and how to deploy one without binding the business to promises it cannot keep.

A Ship Date Is a Federal Promise

When a shopper asks whether an order arrives by Friday, the honest answer depends on fulfillment, stock, and carrier timing the website does not actually see. A generic bot answers anyway. The FTC’s Mail, Internet, or Telephone Order Merchandise Rule sets real obligations around shipment timing and what a seller must do when it cannot ship when promised, so an assistant that casually commits to a delivery date the operation cannot meet is not just disappointing a customer. It is putting the store crosswise with the rule that governs that exact promise.

Refunds work the same way. "Returns are free" and "you’ll get a full refund" are policy statements, and the second the assistant’s version drifts from the published policy, the store is caught between honoring a promise it never authorized and defending one its own site put in writing. The FTC’s authority over deceptive acts lives in precisely that gap. A compliant assistant states the published shipping and return policy and nothing more confident than that, and it sends order-specific timing to support and fulfillment.

Subscriptions and Product Claims Carry Their Own Rules

Anything sold on a recurring plan brings the negative-option requirements of the Restore Online Shoppers’ Confidence Act, which dictates how recurring charges have to be disclosed and how cancellation has to work. An assistant that explains a subscription loosely can undercut both. The standard is to describe the plan exactly as the checkout flow and terms describe it, and to route cancellation mechanics to the actual account tools rather than improvise them.

Product claims are the other trap. A tool that talks up what an item does, how fast it works, or how much a shopper will save is making a claim that carries a substantiation requirement, and the store answers for it no matter who on the page said it. The compliant line is that the assistant repeats the substantiated claims already on the product page and does not invent new ones to close a sale. The store approves its marketing; a widget does not get to write more on the fly.

What AI Compliance for Online Stores Adds Around the Conversation

Two more obligations attach to the assistant itself rather than to any single answer.

The first is email. A tool that offers to "sign you up for deals" or fires off follow-ups pulls the store into CAN-SPAM’s rules for commercial email, from accurate headers to a working opt-out. Consent and compliance there are the store’s responsibility even when an automated assistant set the messages in motion, so the standard is that the assistant does not enroll anyone in marketing it cannot properly consent and honor.

The second is pricing and data. A bot that does discount math and gets it wrong, or honors an expired promotion, leaves a confirmed price in a transcript the shopper relied on, and clawing it back after checkout reads as the deceptive practice the FTC polices. At volume the same wrong answer reaches everyone who asks, so one bad pricing reply is a flood of refund requests by morning. These conversations also collect emails, shipping addresses, and order histories, and a bolt-on widget pipes that data wherever it was wired, which makes "where did it go" a question the store has to answer. A compliant assistant does not confirm prices it cannot compute, and it handles customer data under controls the store can describe.

Why a Prompt Cannot Meet the Standard

The usual shortcut is to write the rules into the assistant’s instructions: never promise a ship date, never confirm a refund, never quote a price. Treat the boundary as set.

It is not set, because of how the model behaves. It follows an instruction when the request matches the wording it was warned about, and shoppers do not use that wording. You tell it never to promise delivery. The shopper does not ask for a promise. They write, "I need this for a birthday Saturday, that’s doable, right?" The model reads an anxious buyer who wants a yes and gives one, because being helpful is its default and a prompt is only a request to suppress that default. The rule was loaded the whole time. It just never recognized the sentence that crossed into a guarantee.

That is the gap between an instruction and a standard. An instruction asks the model to behave. It does not stop the model from speaking. A real boundary is enforced in the system and decides what the assistant may say before it answers, so a ship-date guarantee, a refund promise, or an invented price never reaches the shopper no matter how the question is phrased. "Will not" is a suggestion. "Cannot" is an architecture.

What a Compliant Deployment Looks Like

Meeting the standard does not mean pulling the assistant off the storefront. It means running one built to know which statements are regulated promises and to keep those tied to policy and people.

Fred is built that way. It answers from your own store content and published policies, captures the shopper’s question, and routes ship dates, refunds, subscription mechanics, and pricing to support and your actual checkout. It runs more than 50 industry guardrail packs, and the retail pack is built around the Mail-Order Rule, negative-option law, claim substantiation, and the commercial-email rules. Fred does not guarantee a delivery date or invent a discount. It cannot. It answers the everyday questions, logs every exchange, and hands the regulated promises to the systems and staff that can stand behind them.

The aim is not a chattier storefront. It is one that cannot bind the store to a promise it has no way to keep.

Frequently asked questions