Retail loss prevention and AI in the store: the vendor stack that actually works.

Retail loss prevention as a technology category was reshaped by two independent forces between 2023 and 2026. Self-checkout adoption crossed the point at which the shrink attributable to unattended lanes became a measurable line rather than a rounding error. The National Retail Federation's Impact of Retail Theft and Violence work has repeatedly placed retail shrink near a hundred billion dollars annually, with self-checkout losses reported to rise roughly 22 percent in the first year after introduction at grocery formats. Organized retail crime, meanwhile, professionalized to the point that store-perimeter tools alone stopped clearing, and cross-retailer intelligence became a discrete category. The 2026 vendor stack that actually works accepts the bifurcation. The one that fails treats LP as a single procurement.

Three shifts moved retail LP from EAS-and-guards to computer-vision-plus-integration.

The first shift is self-checkout. When self-checkout was 5 to 10 percent of transactions the shrink attributable to it was absorbed inside a general shrink number. At 40 to 60 percent of transactions in grocery and mass, it became a category that required its own control. Vision-AI at the register — Everseen, Malong Technologies, Cognite AI — moved from pilot to primary control. The second shift is organized retail crime. The professionalization of theft crews, resale through online marketplaces, and cross-jurisdictional movement rendered the store-perimeter view alone insufficient; Auror's intelligence-sharing network, ThinkLP's case-management-plus-analytics, and LP Innovations' investigative platform reflect the new center of gravity. The third shift is statutory. Between 2023 and 2025 more than a dozen states passed or amended ORC statutes with new thresholds, aggregation rules, and reporting requirements. LP technology now has to produce evidentiary output that clears each applicable state's rule, not a generic case file.

Store-perimeter versus register-AI: the budget split is driven by format, not preference.

The single most common budgeting mistake in mid-market LP is a 90-plus percent tilt to one tier and a starved second tier. The credible split is format-specific. Grocery and mass merchant formats with 40 percent or higher self-checkout share should be tilting the incremental LP technology budget 55 to 70 percent toward register-AI, with the balance to store-perimeter (EAS from Sensormatic, RFID from Checkpoint Systems, video from Milestone, Genetec, or Avigilon under a video-management-system contract) and intelligence-plus-case-management. Specialty retail with attended-checkout dominance — apparel, hardware, home — should be inverting that split, with 55 to 70 percent to store-perimeter and intelligence-plus-case-management, and the balance to register-AI where self-checkout is present. The failure pattern is buying either tier alone at 90 percent because the vendor was persuasive at the last conference, and then attributing the shrink that follows to the wrong cause.

Self-checkout risk scoring: three vendors with math that survives auditor scrutiny.

Everseen, Malong Technologies, and Cognite AI have each deployed at scale (Everseen reports operating across more than 150,000 checkouts at 11 of the top 20 global grocery retailers) and each publishes response-time and false-positive metrics that are auditable against customer references. The math should be examined at three specific points: the intervention rate on true-positive events (what share of confirmed non-scan or ticket-switch events are surfaced), the false-positive rate against a documented baseline (how often the system flags a legitimate transaction), and the nudge-versus-block ratio (Everseen's Evercheck, for example, is explicit that most interventions are nudges resolved before payment rather than blocks). Vendors that will not produce these three metrics on customer-reference calls should be scoped down; vendors that will produce them but under a heavy NDA should be treated with the seriousness the NDA suggests.

Organized retail crime technology and the state statute changes shaping deployment.

Between 2023 and 2025 more than a dozen states — California (AB 1613 and successor bills), New York, Illinois, Washington, Michigan, Ohio, Florida, Georgia — passed or amended ORC statutes with tightened thresholds, aggregation rules across time and locations, and expanded reporting obligations. The Combatting Organized Retail Crime Act has moved through federal committee cycles on multiple occasions without becoming law, so the state-by-state regime remains the operative one. The technology implication is that a case-management-and-intelligence system — Auror, ThinkLP, LP Innovations, Ontario Systems, or an equivalent — must be able to export evidentiary packages that satisfy each applicable state's specific rule. Auror's network is the most credible cross-retailer intelligence layer at mid-market volumes; ThinkLP is the most credible case-and-analytics platform on the same tier; LP Innovations remains the investigative-services option that many retailers pair with internal LP teams under 40. The generic case file no longer clears in every jurisdiction, and the vendor should be able to show the state-by-state export mapping in writing.

The integration surface is the difference between a working LP program and a shelfware one.

The load-bearing integrations for a working LP program are four. First, the POS transaction stream — register-AI must consume the same events the transaction hits, ideally on the same event bus, not through a nightly export. Second, the video-management system (Milestone XProtect, Genetec Security Center, Avigilon Alta) for the camera-side evidence that ties an LP event to a video segment. Third, the WMS or inventory system for shrink-by-SKU attribution — without this line the LP program cannot report on category-level effectiveness. Fourth, the case-management system as the system of record for investigations, evidence, and export. A vendor that requires a bespoke integration on any of these four should be scored down; the credible vendors publish reference architectures for the major POS (NCR Voyix, Toast for restaurant LP, Shift4, Fiserv Clover, Square), the major VMS, and the major WMS platforms.

Data retention and biometric privacy: BIPA and the state privacy stack change the deployment scope.

Illinois's Biometric Information Privacy Act remains the sharpest edge in LP deployment planning, and the state privacy law stack — California, Texas, Colorado, Virginia, Connecticut — increasingly treats biometric identifiers as sensitive data requiring separate consent and disclosure. LP video used for shrink review and event reconstruction, with no biometric identifier (face template, gait signature) extracted or persisted, is generally lower-risk. Any vendor that persists biometric templates — face-recognition-based known-offender alerting, for example — should be scoped against BIPA and the applicable state privacy law before deployment, with the DPA specifically covering the template lifecycle. This is not a reason to avoid the technology; it is a reason to scope it with the compliance function in the room from the beginning, and to preserve the option to disable the biometric layer if an applicable statute changes.

Vendor pricing normalization: five vectors and one anti-pattern.

LP vendor pricing should be normalized on five vectors: per-lane per-month for register-AI, per-door and per-antenna for EAS and RFID, per-store per-month for intelligence and case management, per-camera for video analytics tiers, and per-incident or per-report for optional professional services. Bundle discounts that obscure any of these five are the mechanism by which multi-year renewals ratchet up. Ask for standalone list pricing on every element before accepting a bundle. Ask for the volume-tier ladder — the price at 100, 250, 500, and 1,000 stores or lanes — before signature. Ask for the price-review trigger at each expansion. The vendors that will hold to these disciplines are the ones the mid-market retailer wants at renewal in year three; the vendors that will not are the ones that priced the year-one number against a five-year ratchet.

Where the ROI claims stop being credible.

Real LP technology deployments deliver 10 to 30 percent shrink reduction on the addressed category in year one, with declining marginal returns thereafter. Above roughly 40 percent shrink reduction on a category basis, or above 60 percent shrink reduction attributed to a single technology tier, the claim should be treated as a marketing artifact until site-level data with pre-baseline, deployment date, and a matched control set is on the table. The false-positive ceiling matters as much as the intervention rate: a system that surfaces 90 percent of true positives with a 20 percent false-positive rate creates more friction than it removes, and the store-team disenrollment that follows destroys the deployment inside twelve months. The credible vendors publish false-positive rates. The anchor for the Retail Analyst Note series is How mid-market retail operators should source technology contracts in 2026. The retail category coverage is at the Retail library.

Sources

• National Retail Federation, Organized Retail Crime policy hub. nrf.com
• National Retail Federation, Impact of Retail Theft & Violence. nrf.com
• NRF, National Retail Security Survey. nrf.com
• Everseen, Vision AI platform for retail. everseen.com
• Sensormatic Solutions (Johnson Controls). sensormatic.com
• Auror, retail crime intelligence platform. auror.co
• Checkpoint Systems (CCL Industries). checkpointsystems.com
• ThinkLP, loss and safety intelligence platform. thinklp.com
• LP Innovations. lpinnovations.com
• Malong Technologies, retail AI. malong.com
• Illinois General Assembly, Biometric Information Privacy Act (740 ILCS 14). ilga.gov
• California AB 1613 and California Organized Retail Theft resources, Office of the Attorney General. oag.ca.gov
• Milestone Systems, XProtect VMS. milestonesys.com
• Genetec Security Center. genetec.com

All linked sources were live at time of publish (September 2026). Verify before quoting in a procurement document.