Key points

• Agentic commerce, in which AI agents browse, negotiate and complete purchases for consumers or businesses, creates uncertainty about who is bound by an agent's actions.
• Electronic contracting laws in the United States and many other jurisdictions already recognize contracts formed by electronic agents, but they do not answer every question about mistakes, authority and consumer rights.
• Terms of service for agent platforms, merchants and payment providers should allocate responsibility for errors, unauthorized purchases and disputes clearly and consistently.
• Existing consumer protection, payments and privacy rules apply to agent-mediated transactions, and regulators are unlikely to accept that an agent's involvement dilutes a merchant's obligations.
• Merchants should decide now whether to welcome, restrict or authenticate agent traffic, and update contracts and fraud controls accordingly.

What is agentic commerce?

Agentic commerce describes transactions in which software agents powered by AI act for a person or business. A consumer might ask an assistant to find running shoes under a set budget, compare delivery options and complete the purchase. A procurement team might use an agent to source routine supplies. Several technology providers and payment networks are developing protocols that let agents identify themselves, receive credentials and complete payments within limits set by the user.

The commercial promise is convenience and efficiency. The legal challenge is that existing frameworks assume a human decision at the moment of purchase, and an agent can compress or replace that decision.

Can an agent form a contract?

In the United States, the Uniform Electronic Transactions Act and the federal E-SIGN Act recognize that a contract can be formed by the interaction of electronic agents, or between an electronic agent and an individual, even if no individual reviewed the specific action. Other jurisdictions have comparable principles in electronic commerce and contract law, although the detail differs.

These rules answer whether a contract exists, but not whether the person behind the agent is bound by an unexpected result. Questions arise where the agent misunderstood an instruction, was manipulated by content on a webpage, or exceeded its mandate. The outcome will turn on the terms under which the agent was deployed, how clearly the user's limits were defined and whether the merchant knew or should have known that the agent was acting outside them. Mistake and misrepresentation doctrines may also apply.

Authority and agency law

Because the word agent is used loosely, it is worth separating technology and law. An AI agent is not a legal person, so the question is whether the human or company that deployed it is the principal, and whether the agent's acts fall within actual or apparent authority. Platforms that offer agent services should consider whether their terms make the user the principal, define the scope of delegated authority and explain what the user must confirm before a purchase completes.

Merchants dealing with agents should think about how they will know that an agent is authorized. Authentication standards for agents are developing, and merchants will want terms that place the risk of fraudulent or unauthorized agents on the party best placed to control it.

Liability for errors and unauthorized purchases

When an agent makes the wrong purchase, there are several candidates for responsibility: the consumer, the agent developer, the underlying model provider, the merchant and the payment provider. Contracts between them should state how errors are handled, including refunds, chargebacks, indemnities and limits on liability. These terms should be consistent along the chain, because gaps lead to disputes in which each party points to another.

Payment rules will shape the outcome for consumers. In many jurisdictions, consumers have protections against unauthorized transactions and rights to dispute charges. Whether a purchase made by the consumer's own agent is authorized is likely to be tested, and providers should not assume that an agent's acts are automatically treated as the consumer's.

Consumer protection and transparency

Consumer protection rules continue to apply. Merchants must give required pre-contract information, honor cancellation and return rights and avoid unfair or deceptive practices. If an agent completes a purchase without the consumer seeing the full terms, the merchant must still consider how information is made available and whether the consumer can exercise statutory rights afterwards.

Equally, agent providers should avoid steering users toward particular merchants for commercial reasons without disclosure. Regulators in the United States, United Kingdom and European Union have shown concern about hidden influence and self-preferencing in online ranking, and agent recommendations will attract similar scrutiny.

Data, privacy and security

Agents need personal data, credentials and payment details to work. Privacy laws require a lawful basis, minimization and security safeguards, and the sharing of data among agent providers, merchants and payment services must be mapped and disclosed. Security is a distinct risk. Agents can be tricked by malicious instructions embedded in content, so contracts should address security testing, incident notification and responsibility for prompt manipulation losses.

Recommendations

Agent developers should define the scope of delegation, require confirmation for high-value or unusual purchases, keep logs that show what the user authorized, and offer a simple way to reverse mistakes. Merchants should decide their posture on agent traffic, update terms and fraud systems, and ensure that checkout flows work with consumer rights. Payment providers should clarify how authorization and dispute rules apply.

Corvane Ryle's AI and Consumer Protection teams advise on agentic commerce programs, from platform terms to merchant agreements and regulatory engagement.