Mastercard | Agentic Commerce

 

When Your AI Starts Spending Your Money

Agentic commerce is becoming a legal question

Artificial intelligence is beginning to move beyond answering questions and recommending products.

AI agents can increasingly search for products, compare offers, make selections and initiate or complete payments on behalf of consumers.

In March 2026, Santander and Mastercard announced a live end-to-end payment in Europe executed by an AI agent. A few months later, Worldline, ING and Mastercard demonstrated an agentic payment in a production environment.

The technological question is therefore rapidly changing from:

Can an AI agent make a payment?

to:

Under whose authority is it doing so?

From assistance to action

There is an important difference between an AI system recommending a hotel and an AI system booking and paying for that hotel.

The first provides information.

The second produces legal and financial consequences.

Suppose I tell an AI agent:

“Find me a hotel in Turin next weekend for no more than €500.”

The agent finds one, accepts the booking conditions and pays €420.

Did I merely authorise payment up to €500?

Did I also authorise the agent to enter into the accommodation contract?

What if the booking is non-refundable?

What if the agent accepts unusual terms and conditions?

What if it selects something that technically meets my instructions but clearly does not reflect what I intended?

A spending limit alone does not answer those questions.

Consent is not the same as unlimited authority

This is where agentic commerce becomes particularly interesting from a legal perspective.

The important issue is not simply whether the user clicked “yes”.

It is whether we can establish the scope of the user's authority and intention at the moment the AI acted.

Mastercard's developing framework for agentic commerce already recognises this problem. Concepts such as identity, intent, controls and verifiable authorisation are becoming part of the technical infrastructure surrounding AI-driven payments.

That technical audit trail may ultimately become extremely important evidence.

Because when a transaction is challenged, somebody needs to be able to reconstruct what happened.

What did the consumer instruct?

What did the agent understand?

What was the agent permitted to do?

What decision did it make?

And which party was responsible for ensuring that those boundaries were respected?

AI does not make existing law disappear

Agentic commerce does not operate in a legal vacuum.

Depending on the situation, existing rules on contract formation, consumer protection, payment services, data protection and liability may all become relevant.

The EU AI Act adds another regulatory layer. AI agents are not a separate legal category under the Act, but the European Commission has confirmed that they can fall within the existing definitions of AI systems and general-purpose AI models.

But regulation alone will not solve every practical question.

Many disputes will ultimately depend on something much more specific:

What authority did this particular human give this particular system to perform this particular transaction?

That makes system design, contractual drafting and evidence increasingly difficult to separate.

The next challenge is not payment. It is trust.

For decades, digital commerce has tried to remove friction from purchasing.

Agentic commerce may remove something even more fundamental:

the moment at which the human presses the final button.

That makes transactions easier.

It also makes governance more important.

If machines are going to act economically on our behalf, businesses will need more than secure payment infrastructure.

They will need clear boundaries around authority, consent, data use, accountability and dispute resolution.

The technology may be new.

The underlying legal principle is not.

Before someone acts on your behalf, we need to know what they were authorised to do.

The fact that “someone” is now software does not make that question less important.

It makes it more important.