Input data and information sources
Some models also use weather data, public holidays or supplier information. Store-level sales figures are not personal data, but loyalty card data and customer orders are.
Sales and demand forecasting
Also known as: Demand forecasting and automated replenishment
Retailers use a model to predict how much of each item each store will sell, then turn those forecasts into suggested orders or completed orders.
Understand the use case
What defines this use case?
The model learns from past sales and, depending on the system, factors in seasonality, weather, public holidays, promotions and shelf life. Metro and Edeka have announced plans to move forecasting and ordering to AI software from the same supplier.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Can act within applications
- Fields of use
- food retail
- Also known as
- Demand forecasting, automated replenishment, Demand planning
How it works, step by step
System design and data flows
Input data
Inputs include sales figures, stock levels and promotion plans, and sometimes weather and calendar data.
Some models also use weather data, public holidays or supplier information. Store-level sales figures are not personal data, but loyalty card data and customer orders are.
Processing
A model estimates demand for each item in each store over the coming days.
Processing combines historical sales data with the specified influencing factors to estimate demand for a defined period. Planning and ordering systems then use this forecast as a basis. Forecast values must be distinguished from orders actually to be placed.
Results
The system produces order quantities, either as suggestions or as completed orders.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
Orders reach distribution centres and stores, determining shelf availability, spoilage and storage costs.
Write or execution permissions allow the system to change a state within an application. Model responses, tool calls and changes actually executed must therefore be considered separately.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
9 review first7 clarify8 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 4 clarify
- 3 review first
- 3 review first
- 2 review first
In this system design: 9 to review first, 7 to clarify, 8 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
Baseline for every AI system
Third-party content: Depends on your system
AI model: Part of every AI system
Review first
- Misalignment Review priority
- Model Drift & Degradation Review priority
Provider service: Present
To clarify
Training and feedback: Present
Review first
Result: Part of every AI system
Baseline for every AI system
Business application or equipment: Present
Review first
- Excessive Agency Review priority
person: Part of every AI system
Baseline for every AI system
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Sets prices based on expected demand rather than deciding order quantities
Selects products for individual customers
Data and information
Processing and operating environment
Both Metro and Edeka rely on a supplier's software.
Storage and further use
The model learns from the retailer's own sales by item and store. Actual sales continually feed into subsequent forecasts.
Results and data sharing
With automated ordering, orders go to distribution centres or suppliers without someone approving each one. When the supplier hosts the software, sales and inventory data are held outside the organisation.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 6 typical
- 7 depending on the system
- 8 additional threats for every AI system
A total of 24 threats from the threat catalogue may be relevant to this use case.
Priority review points
If the system orders without approval, a forecasting error affects many stores at once. Fresh food then spoils in storage, or shelves remain empty.
If the software prioritises reducing waste, it orders sparingly and accepts empty shelves. Waste falls, but sales and customers are lost.
When weather, promotions or a new competitor change demand, the learned patterns no longer fit. Forecasts can be wrong for weeks before anyone notices.
6 further review candidates in the typical design
Other relevant threats
Your own training or operational feedback can introduce manipulated data into training datasets.
Listed because of these characteristics
- Learns from your own data
- Uses operational feedback
Targeted Poisoning / Label Poisoning
Falsified training labels can deliberately shift model outputs.
Listed because of this characteristic
- Uses operational feedback
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of these characteristics
- Learns from your own data
- Uses another provider's model
Targeted queries can recover some personal or protected training data from the model.
Listed because of this characteristic
- Processes confidential data
Sensitive Information Disclosure
Confidential content can appear in answers, supplied context or logs.
Listed because of this characteristic
- Processes confidential data
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
- Processes confidential data
Up to 7 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. One of these is particularly important here and is therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 7 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
How you operate the system
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Can people outside your organisation use the system, including without login?
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityExcessive Agency3 measures
Review priorityMisalignment3 measures
Review priorityModel Drift & Degradation3 measures
Training Data Poisoning2 measures
Targeted Poisoning / Label Poisoning3 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
Beyond AI literacy (Article 4), no other AI Act provision is relevant to this use case.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 16 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate its own text, such as answers, drafts or summaries?
If yes, add
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Can users give the system natural language tasks that it then performs?
The forecast uses sales figures and does not accept instructions in natural language.
If yes, add
Does the system search its own collection of documents or records for relevant content?
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Sources
- Report of a deployment
The report covers Metro's announcement that it will move fresh food demand forecasting and ordering to AI software.
- Report of a deployment
Supermarkt Inside, Empty shelves at Edeka: new forecasting software on the way, 30 March 2023
The report covers Edeka's announcement of a nationwide rollout of forecasting and ordering software.
- Specialist study
OECD, Framework for the Classification of AI Systems, 2022, Annex A
The framework lists demand forecasting as a main application of AI.
Related use cases
Also in the field of Manufacturing, retail and logistics
- Predictive maintenanceThe system detects impending machine or equipment failure from sensor and operational data so maintenance can be planned in time.
- Visual and acoustic quality inspectionCameras or microphones capture components and products on the production line; a model checks defects, completeness and correct variants.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured