AI Agents Can Now Shop and Pay; Regulators Race to Catch Up  

In the most basic version, an AI chatbot helps you compare prices and fills your cart, but you still hit the final “purchase” button. More advanced systems go further. You set a budget or a goal, and the AI executes the transaction the moment conditions are met. Some agents are already managing the full shopping cycle, from search to checkout to returns, with little or no human involvement along the way.

Agentic commerce could save consumers time, surface better deals, and streamline routine purchases like groceries or household essentials. For businesses, it opens up new channels and could reduce friction at checkout. But as a new analysis from law firm Sheppard Mullin Richter & Hampton points out, the legal scaffolding around online payments was built for a world where a human being is always on the other end of a transaction. That assumption is starting to break down.

We’d love to be your preferred source for news.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

Add as Preferred Source

The firm’s attorneys flagged several pressure points. Authentication is one. Before a transaction goes through, someone needs to verify that the AI agent is legitimate and actually tied to a real user. Authorization is another. Even if the agent is real, is it allowed to make this specific purchase, at this price, at this frequency? Companies will need auditable records that show exactly what the agent was permitted to do and what it actually did.

Read more: Financial Firms Embrace AI Tools and Face New Compliance Tests 

Then there’s consent. When you visit a new website, you typically agree to terms of service. If an AI visits that site on your behalf and clicks “I agree,” is that binding? Sheppard Mullin suggests merchants may want to use tools like CAPTCHA to confirm a human is on the other end, or require users to explicitly authorize their agent to accept terms for them.

Fraud is perhaps the sharpest concern. As Sheppard Mullin put it, “the threat model shifts from stolen credit cards to stolen or manipulated agents.” A compromised AI agent could follow its programmed rules perfectly and still make purchases the user never intended because the rules themselves were tampered with.

Disputes are likely to get complicated too. If an AI buys a pricier product because it misread your preferences, you might call the charge unauthorized. The bank might call it a valid transaction. Sorting that out will require new approaches to refund policies and customer support and systems that can explain why the AI made the purchase in the first place.

Subscription traps are another area of concern. Regulators at both the federal and state level are already cracking down on dark patterns and negative option practices. An AI that signs you up for a recurring charge adds another layer of complexity to an area already under heavy scrutiny.

Regulators haven’t weighed in with formal guidance yet, but the direction of travel is clear. Expect the Consumer Financial Protection Bureau, the Federal Trade Commission, and state attorneys general to start asking hard questions about where the human ends and the algorithm begins.