Regulamentação do comércio por agentes em 2026: o que os “ Lojistas ” precisam saber

Agentic commerce regulation is the set of payments, consumer-protection, and AI rules that apply when an AI agent buys on a customer's behalf. As of October 2026, no payments or consumer-protection law in the US, EU, or UK is written specifically for agent-made purchases, so merchants operate under rules built for human checkouts.

Agentic commerce is the shift where software acts for customers to browse, compare, and complete purchases with little or no human involvement. That raises new questions about authorization, liability, and chargebacks. This page covers the rules and card network programs that apply today, the questions regulators have not answered, and a compliance checklist. For who pays when an agent purchase is disputed, see AI agent chargeback liability.

O que é o comércio agênico e por que ele precisa de regulamentação?

Agentic commerce runs on open protocols that let an agent find products, build a cart, and pay. The rules those protocols plug into were written for people. The Center for Data Innovation argued in March 2026 that regulation meant for humans will slow adoption down, and recommended that the CFPB update Regulation E to confirm that consumer-authorized agents do not waive error-resolution rights.

Como os agentes de IA já estão realizando compras

Agent-initiated checkout is still early. Visa reported in December 2025 that partners had completed hundreds of controlled, real-world agent-initiated transactions in pilots, and the card network programs that support them are covered below. Demand is the reason regulators are paying attention: a BCG study cited in the Consumer Bankers Association's January 2026 white paper on agentic AI payments found that 81% of consumers expect to use AI in their shopping and 42% would let AI shop entirely on their behalf in at least one product category, with $1.3 trillion of online commerce potentially affected.

A lacuna regulatória: por que as regras atuais não foram concebidas para agentes de IA

Payments rules assume a person decides to buy, enters a card, and confirms. When an agent acts instead, two questions follow. Did the consumer authorize this specific purchase, or only the act of shopping? And if the agent overspends or buys the wrong item, is that an unauthorized transaction? No US, EU, or UK rule answers either question directly. Federal Reserve Governor Christopher Waller said in a September 2026 speech that trust is the biggest barrier to scaling agent-delegated purchases, with authentication, liability, and fraud prevention as the open challenges.

O Regulamento E e o Problema da Autorização

Regulation E, which implements the Electronic Fund Transfer Act, covers debit card, prepaid, ACH, and similar transfers from consumer asset accounts. It does not cover credit card transactions. Those fall under Regulation Z, which implements the Truth in Lending Act. Chargeback rights also come from card network rules, which run separately from both statutes.

Neither regulation mentions AI agents. The CFPB's official interpretation of Regulation E says that when a consumer furnishes an access device and grants authority to a person who exceeds it, such as a family member or co-worker, the consumer is fully liable for those transfers unless the consumer has told the institution that person is no longer authorized. Whether an AI agent is treated like that person is unresolved. A Fenwick legal analysis from April 2026 and the Consumer Bankers Association white paper both flag the question for Regulation E, and the white paper flags Regulation Z's "apparent authority" test as equally uncertain.

For merchants, a cardholder who says an agent exceeded its instructions can still dispute the charge, and the outcome may turn on whether you can show what the consumer authorized. How those scenarios map to dispute reason codes is covered in agentic commerce chargeback liability.

A Lei da IA da UE e a conformidade transfronteiriça

The EU's AI Omnibus entered into force on 27 July 2026 and moved the AI Act's high-risk deadlines. Stand-alone high-risk systems (Annex III) now apply from 2 December 2027, and systems embedded in regulated products (Annex I) from 2 August 2028.

Annex III does not list consumer shopping or purchasing agents. Its financial category covers AI that evaluates the creditworthiness of natural persons or sets their credit score (fraud detection is excepted) and AI that prices life and health insurance. You are most likely to touch the high-risk rules if you run your own AI credit decisions for consumers, not by accepting orders from an agent.

The transparency duties in Article 50 were not delayed. Providers must make sure people know they are interacting with an AI system, and a law firm summary of the final text put the penalty for breaching these duties at up to EUR 15 million or 3% of global annual turnover. If you run an AI shopping assistant on your own storefront, confirm with its provider that it discloses itself as AI.

UK Payment Rules and the Treasury Consultation

UK payment law treats a payment as authorized when the payer consented in the agreed form and procedure (Payment Services Regulations 2017, regulation 67), and a payment can be initiated on the payer's behalf, so an agent does not need to be the legal payer. The open question is whether a given agent purchase fell inside the consent the customer gave. According to a UK payment-law analysis, providers generally bear the loss on unauthorized payments unless the payer acted fraudulently or with gross negligence.

HM Treasury published its Financial Services AI Adoption Plan and a Modernising Payment Services Regulation consultation on 14 July 2026. The consultation closed on 6 October 2026 and asks whether consent, authentication, and liability rules need updating for agentic payments, so any rule change is still ahead. The FCA's March 2026 payments priorities report lists agentic AI under innovation and says it is working with the Treasury on whether rules need to change, according to Linklaters.

Leis estaduais sobre IA e o problema da fragmentação

The US has no federal statute governing AI in commerce. A December 11, 2025 executive order directed the Justice Department to challenge state AI laws, and a March 2026 White House framework asked Congress to preempt them, but neither changes state law on its own, and no preemption bill had been enacted as of the March 2026 analysis. Check current status before relying on federal preemption.

Colorado replaced its 2024 AI Act with SB 26-189, signed on 14 May 2026 and effective 1 January 2027. The new law is disclosure-based: it covers automated decision-making technology used in consequential decisions such as lending, with notices at the point of interaction and explanations after an adverse outcome. It targets decisions about consumers, not shopping agents, so it matters to merchants mainly if you use automated tools to decide on financing or similar.

Card Network and Standards Programs for AI Agents

Visa, Mastercard, and EMVCo have each published agent programs. They identify the agent and record what the consumer authorized, which is the evidence base for any later dispute. None of the owner pages reviewed states a new dispute or liability rule.

Mastercard's agentic commerce rules of the road name three requirements for agent transactions: clear user intent, secure credentials, and verifiable agent identity. The page does not assign liability or set dispute procedures. Worldpay's analysis reaches the same place from the acquiring side: when agents authenticate through network frameworks, liability follows existing tokenized-transaction rules, while disputes over an agent that misunderstood an instruction or bought the wrong item have no settled network rules.

Como o comércio agentico está transformando o cenário do “ Chargeback ”

Every new transaction channel creates new dispute patterns. Agentic commerce chargebacks differ from traditional disputes because the evidence of authorization and intent is different. A human purchase leaves order confirmations, shipping records, and IP and device data. An agent purchase leaves agent logs and protocol records, and the consumer may say they never intended that specific purchase.

Agentic commerce fraud adds attack paths on top of broader ecommerce fraud prevention: stolen credentials tested through agent checkouts, account takeover fraud on accounts that agents use, and manipulated pricing logic. Agent checkouts are card-not-present transactions, so existing card-not-present controls still apply.

Novos tipos de disputas Lojistas que se deve esperar

As agentic commerce scales, expect dispute scenarios that do not fit neatly into existing reason codes:

• AI agent buys the wrong product: The consumer authorized the agent to shop but says the specific item was not what they wanted. This sits between "not as described" and buyer's remorse.
• AI agent exceeds spending authority: The consumer set a budget, the agent spent more, and the consumer disputes the amount as unauthorized.
• AI agent misses pricing errors: The agent buys at a price the consumer considers unfair, but you honored the listed price.
• Consumer claims "I didn't authorize that": A consumer who gave an agent general shopping permission disputes a specific transaction as unauthorized.

Each scenario reaches you as a chargeback, and you usually carry the burden of showing what the consumer authorized. When an AI shopping assistant rather than a delegated agent drives the purchase, the dispute drivers differ; see AI shopping chargebacks.

Por que os programas de monitoramento de cartões “ Rede ” ainda são válidos

Visa's VAMP program and Mastercard's ECM thresholds count disputes whatever initiated the order. VAMP's merchant "Excessive" threshold is a 1.5% ratio (effective April 2026), and Mastercard's Excessive Chargeback Merchant tier covers ratios of 1.5% to 2.99% with at least 100 chargebacks. If agent orders grow quickly and even a small share is disputed, your dispute ratio rises with them, and crossing a threshold brings fines, higher fees, and possible account termination.

Agent orders still pass through your checkout, so post-checkout screening applies to them. Chargeflow Prevent scans orders after checkout and before fulfillment, which lets you verify or cancel a risky order before it ships.

O que “ Lojistas ” deve fazer agora para se preparar

These steps do not depend on a regulator acting first. They build the records that disputes and audits will ask for.

Crie Sua pilha de prevenção de “ Disputa ”

Chargeflow Alerts notify you when a cardholder opens a dispute, through Verifi RDR, Ethoca, and Chargeflow's own network, and refund the order before it becomes a chargeback. Chargeflow Insights is a free dashboard for payment and chargeback data where you can watch ratio and reason-code trends. For disputes that still become chargebacks, Chargeflow Automation collects evidence and submits it for you, with a 4X ROI guarantee and a 25% fee only on recovered chargebacks.

Prepare sua documentação de autorização e sua trilha de evidências

The hard part of an agent dispute is showing what the consumer authorized. Open protocols record that inside the transaction. AP2 uses signed checkout and payment mandates that capture the user's constraints and the exact approved purchase, and Mastercard's Verifiable Intent links identity, intent, and action in a tamper-resistant record. A signed record gives you something verifiable to submit next to traditional order data.

• Confirm protocol support: Ask your payment provider which agent protocols (ACP, UCP, AP2) and network programs it supports, so agent orders arrive with authorization records attached.
• Log agent-initiated transactions separately: Tag purchases made by AI agents so you can track their dispute performance on their own.
• Build evidence packages that show consumer intent: Add agent authorization logs, protocol records, and any Verifiable Intent data to your compelling evidence workflow alongside order, delivery, and customer data.

For merchant-side verification and scoring signals on legitimate agent traffic, see preventing fraud and chargebacks in agentic commerce.

Agentic Commerce Compliance Checklist

Monitore sua relação “ Chargeback ” de forma proativa

A spike in agent orders followed by even a modest dispute rate can push you toward Visa VAMP or Mastercard ECM limits faster than you expect. Set alerts on your chargeback ratio, track it by channel so agent orders are separate from human ones, and learn how chargeback alerts work to understand early dispute interception. If one agent or protocol generates disproportionate disputes, you want to see that trend before it becomes a problem.

Get dispute protection in place before agent order volume grows. Start for free

Perguntas frequentes

O que é o comércio agênico?

Agentic commerce is the use of AI agents to browse, compare, and purchase products on behalf of consumers, often with minimal human oversight. Open protocols such as the Agentic Commerce Protocol (ACP), Universal Commerce Protocol (UCP), and Agent Payments Protocol (AP2) provide the technical standards that enable it.

O comércio por agente é regulamentado?

Not specifically. As of October 2026, no US, EU, or UK payments or consumer-protection law is written for agent-made purchases. Existing rules such as Regulation E, Regulation Z, the EU AI Act, and the UK Payment Services Regulations 2017 apply in part, and card network programs and industry standards fill some of the gaps.

Quem é responsável quando um agente de IA faz uma compra inadequada?

Liability is unsettled. Under the CFPB's Regulation E interpretation, a consumer who grants authority to someone who exceeds it is liable unless they told the institution that authority ended, and Regulation Z's test includes apparent authority, but neither has been applied to AI agents. When an agent authenticates through a network framework, liability follows existing tokenized-transaction rules, while disputes over agent misunderstandings have no settled network rule.

Does Regulation E Cover Credit Card Purchases Made by an AI Agent?

No. Regulation E covers debit, prepaid, ACH, and similar transfers from consumer asset accounts. Credit card transactions fall under Regulation Z, which limits cardholder liability for unauthorized use to $50 and sets billing error procedures.

Does the EU AI Act Classify Shopping Agents as High-Risk?

Not by category. Annex III covers areas such as credit scoring of natural persons and life and health insurance pricing, and it does not list consumer shopping agents. The Annex III high-risk rules apply from 2 December 2027, while Article 50 transparency duties, including disclosing AI interaction, already apply.

Como o comércio agentivo afetará o site Chargebacks?

Agentic commerce creates disputes over the scope of authorization, agent errors, and pricing. The evidence also changes from IP and device data to agent logs and protocol records, so merchants need stronger prevention and evidence collection.

How Can Merchants Stay Compliant When Enabling Agentic Payments?

Verify agent identity through network programs where available, store the mandate or intent record for each agent order, tag agent orders in your data, track their dispute ratio against VAMP and ECM thresholds, and confirm any AI assistant you run discloses itself as AI where the EU AI Act applies. Review your terms of sale with counsel as UK and US rules develop.

O que a Lojistas deve fazer para se preparar para o comércio agênico disputas?

Confirm which agent protocols your payment provider supports, set up chargeback alerts, monitor dispute ratios by channel, and build evidence packages that include authorization logs and any signed mandate or Verifiable Intent record.

How Do Merchants Verify an AI Agent's Identity at Checkout?

There is no single universal standard yet. Visa's Trusted Agent Protocol lets merchants verify cryptographic signatures that are merchant-specific and time-bound, and Mastercard Agent Pay restricts transactions to registered agents using network tokens. AP2 mandates and Verifiable Intent records add proof of what the consumer authorized. Treat any checkout that returns none of these records as higher dispute risk and route it through extra fraud screening.

Will AI Agents Be Able to Buy From My Online Store?

Yes, if your checkout supports an agent protocol or is reachable through a platform that does. ACP is open to any business that implements the specification, and UCP covers catalog, cart, and checkout across AI surfaces. Whether you accept agent orders is your decision, so set your policies on authorization records, returns, and dispute handling first.