About this series: This is the second article in a four-part series on agentic commerce and its legal implications. This article examines what agentic AI is, who is building the infrastructure, and why trust has become the central battleground. ← Read Part 1
History is marked by innovations that did not merely enhance existing systems — they fundamentally transformed the way people live and interact. In the world of commerce, a series of such turning points have continually redefined both consumer behavior and business operations velocity: the cash register modernized record-keeping, the barcode revolutionized supply chains and global logistics, and the emergence of the internet reduced our dependence on brick-and-mortar retail, as Matt Renner, President, Global Revenue, Google Cloud, noted.
Something significant happened in the payments industry in the span of a few months in 2025 and early 2026. Mastercard launched Agent Pay, a program designed to integrate with agentic AI and revolutionize commerce, promising smarter, more secure, and more personal payment experiences to consumers, merchants, and issuers. Visa and more than 10 partners introduced the Trusted Agent Protocol, an open framework designed on existing web infrastructure that enables safe agent-driven checkout by helping merchants distinguish between malicious bots and legitimate AI agents acting on behalf of consumers. Google announced the Agent Payments Protocol (AP2), an open protocol developed with leading payments and technology companies to securely initiate and transact agent-led payments across platforms. OpenAI partnered with Stripe to co-develop the Agentic Commerce Protocol (ACP), an open standard that enables merchants to transact through AI agents with a single integration, while retaining control over what is sold, how their brand appears, and how orders are fulfilled, already powering purchases inside ChatGPT.
These were not product updates. They were infrastructure moves — a coordinated, industry-wide race to prepare the global payments system for a new kind of buyer: one that is not human.
The shift from e-commerce to agentic commerce may represent one of the most significant transformations in digital commerce since the rise of online payments, as stated by Jack Forestell, Visa's Chief Product and Strategy Officer.
From Generative AI to Agentic AI
To understand agentic commerce, it helps to understand what makes agentic AI different from the AI most people already use.
Generative AI, which is the kind powering tools like ChatGPT in its basic form, generates content. You ask a question; it produces an answer based on your input. It responds, it assists, but it does not act.
Unlike generative AI, which helps us create, agentic AI takes the crucial step of acting on a person's or company's behalf. What sets e-commerce agents apart from bots is their capacity to act proactively, rather than simply responding to prompts. Unlike copilots and chatbots, which depend on human input and often fall short when faced with complex or multi-step tasks, e-commerce agents bring a far greater degree of sophistication to the table. They function independently, sourcing the relevant business data as needed, devising action plans for any given task, and carrying out those plans from start to finish; all without the need for human involvement at each step.
As Diana Stern and Dazza Greenwood explained, their defining capability lies in executing complex, multi-layered reasoning and acting on decisions independently, with no need for human oversight or sign-off. Consider a personal shopping agent that goes beyond simply locating products — it evaluates pricing across multiple retailers, assesses customer reviews, verifies stock availability, and completes the purchase, all within the boundaries of a user's predetermined budget and preferences.
What truly distinguishes transactional agents from conventional chatbots and other AI systems is their capacity to enter into binding commitments (payments included), as Stern and Greenwood argued.
Commerce Is Becoming Agentic
We have moved from face-to-face commerce, to e-commerce, to mobile commerce, and now on to agentic commerce, where agents transact on behalf of consumers and businesses. By 2030, agentic AI could drive up to $17.5 trillion in commerce, according to Deloitte estimates, making it a pivotal force in the future of payments and consumer engagement. According to another report from Deloitte, analysis projects that by 2030, 25% of global e-commerce sales will be enabled by AI agents, and that 55% of digital consumers will already begin product research using large language model platforms rather than traditional search engines.
Today's payment systems assume a human is directly clicking "buy" on a trusted website. When an autonomous agent initiates a payment, this core assumption is broken, leading to critical questions that current systems cannot answer: How can we verify that a user gave an agent specific authority for a particular purchase? How can a merchant be sure an agent's request accurately reflects the user's true intent, without errors or AI hallucinations? If a fraudulent or incorrect transaction occurs, who is accountable: the user, the agent's developer, the merchant, the issuer, or the intermediary platform? This ambiguity creates a crisis of trust that could significantly limit adoption.
These are not merely technical questions – these are also legal ones. Doctrines of agency law, contract formation, and tort liability have long governed how authority is delegated, how commitments and contracts are made, and who bears responsibility when things go wrong. But those frameworks are mostly built around human actors. When you add an AI layer into the equation, we start to realize that the legal infrastructure will be tested in ways it was never designed to handle.
Commerce is shifting from human-executed transactions to machine-mediated transactions, but the legal and operational infrastructure governing trust, authority, and accountability remains underdeveloped. The articles that follow examine who bears responsibility when an agent transacts without clear authority, why authentication breaks down in agentic systems, and what new trust infrastructure the industry is building.
New essays in your inbox, roughly monthly.
Legal analysis on the AI and privacy regulations that actually affect technology businesses. No noise, no boilerplate.
This article is for informational purposes only and does not constitute legal advice. Reading this essay does not create an attorney-client relationship.
