Agentic Commerce Regulation in 2026: What Merchants Need To Know

Dan Moshkovich

TL;DR:

• Agentic commerce regulation is still catching up to AI agent purchases.
• Regulation E does not clearly resolve whether agent authorization counts as consumer consent.
• The EU AI Act's high-risk rules were just delayed to December 2027.
• Merchants should build dispute prevention and real-time monitoring now.

What Is Agentic Commerce and Why Does It Need Regulation?

Three major protocols are driving agentic commerce forward. These agentic commerce protocols are setting the technical standards, but as the Center for Data Innovation has argued, regulation meant for humans will slow adoption down.

How AI Agents Are Already Making Purchases

This is not a future scenario. AI agents are making real purchases right now.

ChatGPT's Instant Checkout uses the Agentic Commerce Protocol to let users buy products directly inside a conversation. Google AI Mode shopping uses the Universal Checkout Protocol to handle product discovery and purchase in search.

On the payment side, Mastercard Agent Pay and Visa's Trusted Agent Framework provide the rails for agentic payments. Mastercard has already published its agentic commerce rules of the road, outlining how these systems let AI agents authenticate, authorize, and complete transactions using existing card networks.

Major retailers are already participating, giving AI agents access to their catalogs and checkout flows.

The numbers back this up: a BCG study cited in the Consumer Bankers Association's white paper on agentic AI payments found that 81% of consumers expect to use AI in their shopping, and 42% would let AI shop entirely on their behalf in at least one product category. If that plays out, the same study estimates $1.3 trillion of online commerce could be impacted by agentic commerce tools.

The Regulatory Gap: Why Current Rules Were Not Built for AI Agents

Here is the core problem: every major regulation governing electronic payments assumes a human is on the other side of the transaction. A person decides to buy, enters their card, and clicks "confirm."

Agentic commerce regulation in 2026 is still catching up to a reality where none of that is true.

When an AI agent acts on a consumer's behalf, the legal questions multiply. Did the consumer authorize this specific purchase, or just the general act of shopping? If the agent overspends or buys the wrong item, is that an "unauthorized transaction" under existing law? No regulation answers these questions clearly today.

Regulation E and the Authorization Problem

Regulation E, part of the Electronic Fund Transfer Act, is the federal law that protects consumers when electronic payments go wrong. It gives consumers the right to dispute unauthorized transactions and limits their liability. This is the legal foundation for most chargeback rights in the United States. Under Regulation E, a consumer's liability for an unauthorized electronic transfer is capped at $50 if they report it within two business days, or $500 if they report it later but within 60 days.

The gap is straightforward. Regulation E defines "authorization" as the consumer granting permission for a transfer.

But if a consumer tells an AI agent to "find and buy the best deal on running shoes," and the agent buys a pair the consumer did not want, it is unclear whether that counts as an authorized or unauthorized transaction. The consumer did give the agent permission to shop, but they may not have approved that specific purchase.

Legal experts have raised open questions about whether AI agents qualify as consumer "representatives" under existing rules. A legal analysis from Fenwick asks whether 2026 is the year agentic payments finally force regulatory action, noting that it remains unresolved whether AI agent authorization satisfies Regulation E requirements. Until there is clarity, merchants face an awkward reality.

A consumer who uses an AI agent to buy your product can still dispute the transaction under Regulation E, and you may have limited tools to prove the purchase was truly authorized.

The EU AI Act and Cross-Border Compliance

The EU AI Act's requirements for high-risk AI systems, originally due in August 2026, were delayed to December 2027 under the EU's AI Omnibus agreement. This is still the most comprehensive AI regulation in the world, and it has direct implications for agentic commerce.

AI systems that make autonomous financial decisions, including purchasing decisions, could be classified as high-risk under the Act. That means transparency requirements, human oversight mandates, and documentation obligations.

If you sell to EU customers and AI agents are completing those purchases, you may need to demonstrate compliance with these requirements.

For merchants operating internationally, this creates a new layer of cross-border compliance. Your AI-initiated transactions to EU consumers are subject to different rules than the same transactions in the United States, and the penalties for non-compliance are significant.

State AI Laws and the Patchwork Problem

In the United States, there is no single federal law governing AI in commerce. Instead, individual states are passing their own AI regulations, creating a patchwork of requirements that vary by jurisdiction.

The current administration has pushed for a federal framework to simplify this, but legislation moves slowly. In the meantime, merchants operating across multiple states face overlapping and sometimes contradictory rules around AI-driven transactions, consumer disclosure, and automated decision-making.

How Agentic Commerce Changes the Chargeback Landscape

This is where agentic commerce hits merchants hardest. Every new transaction channel creates new dispute patterns, and AI-initiated purchases are no exception. Agentic commerce chargebacks will look different from traditional disputes because the nature of authorization and intent is fundamentally different.

When a human buys something and files a chargeback, the dispute framework is well-established. The merchant can point to order confirmations, shipping records, and IP addresses.

But when an AI agent makes the purchase, the evidence trail changes. The consumer may argue they never intended that specific purchase, even though they authorized the agent to shop on their behalf.

Agentic commerce fraud, a form of broader ecommerce fraud, also introduces new vectors. Bad actors can exploit AI agents to make rapid purchases, test stolen payment credentials, or manipulate pricing algorithms. The speed and scale at which AI agents operate makes these risks harder to catch in real time.

New Types of Disputes Merchants Should Expect

As agentic commerce scales, expect to see dispute scenarios that do not fit neatly into existing chargeback reason codes. Here are the patterns to watch for:

• AI agent buys the wrong product: The consumer authorized the agent to shop but claims the specific item was not what they wanted. This falls in a gray area between "not as described" and buyer's remorse.
• AI agent exceeds spending authority: The consumer set a budget, but the agent spent more. The consumer files a dispute claiming the amount was unauthorized.
• AI agent misses pricing errors: The agent completes a purchase at a price the consumer considers unfair, but the merchant honored the listed price. The consumer disputes the charge.
• Consumer claims "I didn't authorize that": The broadest risk. A consumer who gave an AI agent general shopping permission disputes a specific transaction as unauthorized.

Each of these scenarios creates a chargeback that lands on the merchant. And under current rules, the burden of proving authorization still falls on you.

Why Card Network Monitoring Programs Still Apply

Here is a critical point many merchants overlook: Visa's VAMP program and Mastercard's ECM thresholds do not change just because an AI agent initiated the transaction. Your dispute ratio is your dispute ratio, regardless of how the purchase was made.

If agentic commerce drives a spike in transaction volume, and even a small percentage of those AI-initiated purchases result in disputes, your chargeback ratio can climb quickly. Cross a monitoring threshold and you face fines, increased fees, and potential account termination.

This makes proactive chargeback prevention more important than ever. You need visibility into which transactions are AI-initiated, how they perform compared to human-initiated purchases, and whether they are driving your dispute ratio toward dangerous territory.

What Merchants Should Do Now To Prepare

You do not need to wait for regulators to act. The steps you take now to strengthen your dispute prevention, evidence collection, and monitoring will protect your business whether agentic commerce regulation arrives next quarter or next year. Here is your action plan.

Build Your Dispute Prevention Stack

Prevention is your first line of defense. When AI agents increase the volume and velocity of transactions hitting your store, stopping disputes before they become chargebacks is essential.

Start with chargeback deflection alerts. Alert services notify you when a customer initiates a dispute, giving you a window to resolve it before it becomes a chargeback. This is table stakes for any merchant, but it becomes critical as agentic commerce scales. The Consumer Bankers Association has also published a white paper on agentic AI payments that outlines how financial institutions are preparing for these shifts.

Layer on real-time monitoring of your dispute ratios. You need to know the moment your ratios start trending upward, not after you have already crossed a threshold. Chargeback analytics and insights give you that visibility in a single dashboard.

Automated evidence collection also matters. When disputes do come in, having a system that gathers and organizes evidence automatically saves time and improves your win rate.

Prepare Your Authorization and Evidence Trail

The biggest challenge with agentic commerce disputes is proving that the consumer authorized the specific transaction. New protocols are building solutions for this.

Emerging payment standards are building cryptographic proof of consumer authorization into the transaction itself. AP2 uses signed "mandates" that record exactly what the consumer approved, while Mastercard's Verifiable Intent framework creates an auditable trail of consumer consent. Together, these approaches are a game-changer for dispute evidence. If you can show a signed, verifiable record of consumer intent, your position in a chargeback dispute is dramatically stronger.

Here is what you should do now to prepare:

• Adopt supported payment protocols: Make sure your payment stack supports ACP, UCP, or AP2 so you can accept AI-initiated transactions with proper authorization records.
• Log agent-initiated transactions separately: Tag and track purchases made by AI agents so you can monitor their dispute performance independently.
• Build evidence packages that demonstrate consumer intent: Prepare your compelling evidence workflow to include agent authorization logs, protocol records, and any Verifiable Intent data alongside traditional order information.

Monitor Your Chargeback Ratio Proactively

As AI agents increase transaction velocity, your dispute ratios become more volatile. A spike in AI-initiated transactions followed by even a modest dispute rate can push your ratio past monitoring thresholds faster than you expect.

Set alerts on your chargeback ratio so you get notified before you approach Visa VAMP or Mastercard ECM limits. Track your ratios by channel, separating AI-initiated transactions from human-initiated ones. Learn how chargeback alerts work to understand the mechanics behind early dispute interception.

Use analytics to spot patterns early. If AI-driven transactions from a specific agent or protocol are generating disproportionate disputes, you want to catch that trend before it becomes a problem.

The merchants who thrive in agentic commerce will be the ones who treat dispute management as a core operational function, not an afterthought. Get your prevention, automation, and monitoring in place now, and you will be ready for whatever regulation and transaction patterns come next.

Chargebacks from AI agents are already happening. Protect your revenue and stay ahead of the curve.

Prepare Your Evidence Trail Before Regulation Forces Your Hand

Agentic commerce is not a trend to watch from the sidelines. Regulators are still working out the rules, but the transactions, and the disputes they cause, are already here. The merchants who put prevention, evidence collection, and ratio monitoring in place now will be the ones ready when enforcement catches up.

FAQ

What Is Agentic Commerce?

Agentic commerce is the use of AI agents to browse, compare, and purchase products on behalf of consumers, often with minimal human oversight. Major protocols like ACP, UCP, and AP2 provide the technical standards that enable this.

Is Agentic Commerce Regulated?

Not specifically. Existing laws like Regulation E and the EU AI Act apply in part, but there are significant gaps around authorization and liability, which industry standards and card network rules are working to fill.

Who Is Liable When an AI Agent Makes a Bad Purchase?

This is currently unclear. If the consumer authorized the agent, the transaction may be considered "authorized" under Regulation E, meaning the consumer could have limited dispute rights while card network rules and emerging protocols work to clarify liability.

How Will Agentic Commerce Affect Chargebacks?

Agentic commerce creates new types of disputes around authorization scope, AI agent errors, and pricing exploits. Merchants need stronger prevention and evidence-collection processes to handle these new scenarios.

What Should Merchants Do To Prepare for Agentic Commerce Disputes?

Adopt supported payment protocols like AP2, ACP, and UCP, set up chargeback alerts, and monitor dispute ratios proactively. Automate evidence collection to demonstrate consumer intent for every AI-initiated transaction.

How Do Merchants Verify an AI Agent's Identity at Checkout?

There is no single universal standard yet, but the leading payment protocols are building verification directly into the transaction. AP2 uses signed "mandates" that cryptographically record what the consumer authorized the agent to do, and Mastercard's Verifiable Intent framework and Visa's Trusted Agent Framework create a similar auditable trail of consumer consent tied to the agent making the purchase. Until adoption is universal, treat any checkout that doesn't return one of these verifiable records as higher dispute risk and route it through extra fraud screening.