Agentic Commerce Risks and Readiness

The real risks of agentic commerce fall into a handful of categories: confirming that an agent is genuinely authorized to act for a customer, fraud and unauthorized purchases, the still-unsettled question of liability when an agent-made purchase goes wrong, privacy and data, and the strategic risk of being disintermediated from your own customer. None of these is a reason to stay out. Each is a reason to enter deliberately, with the right safeguards and a clear view of who carries the risk. This guide maps the risks, shows how the emerging standards address each, and ends with a readiness checklist. It is the companion to what agentic commerce means for your business, which covers the strategic decision; this page covers what to watch out for.

The risk landscape in one paragraph

When the buyer is software, two things change. The trust that a payment system normally places in a present, authenticating human has to be reconstructed for an agent, and the accountability that normally has a clear owner becomes contested. Most of the technical work in agentic commerce is really about rebuilding that trust, and most of the open questions are really about who is accountable when something fails. Hold those two themes in mind and the specific risks below are easier to reason about.

Agent authenticity and impersonation

The first question a merchant faces is whether the agent at the door is a legitimate agent acting for a real customer, or a bot pretending to be one. This is the agent-authenticity problem, and several efforts target it directly. Visa’s Trusted Agent Protocol, published in October 2025 and developed with Cloudflare, gives merchants a cryptographic way to recognize a trusted agent with commerce intent and separate it from malicious automation and rogue bots. One caveat matters for planning: Visa states that the initial specifications apply to the Visa network in this phase, with alignment to bodies such as the IETF, the OpenID Foundation, and EMVCo as an intention rather than a finished cross-network standard.

The card networks’ agent programs, Visa Intelligent Commerce and Mastercard Agent Pay, are built on registering and verifying agents before they transact rather than letting any piece of software present a card, and American Express describes the same pattern in its ACE Developer Kit, where agent registration is listed as a service still in development. The risk to manage is treating an unverified agent as trusted; the mitigation is to rely on these verification layers rather than rolling your own.

Authorization and unauthorized purchases

Even a legitimate agent raises a harder question: did the user approve this specific purchase, or just delegate a general goal? This is what AP2 exists to answer. It uses cryptographically signed mandates, expressed as verifiable digital credentials, that record what the user authorized and can be presented as proof of consent. AP2 v0.2 defines two: a Checkout Mandate covering what is being bought, verified by the merchant, and a Payment Mandate covering how it is paid for, verified by the credential provider, the network, and the merchant’s payment processor. Each can be open, where the user approves a set of constraints an agent may act within later, or closed, where the user approves a specific finalized checkout. That is the distinction between a purchase a human is actively approving and one an agent completes later within pre-set limits. On the payment side, the Shared Payment Token design limits the blast radius of any single authorization: a token is scoped to one merchant and one cart total and cannot be reused for a different amount or seller. The risk is an agent spending beyond what the user actually intended; the mitigations are scoped mandates, scoped tokens, and clear spending limits set at the point of delegation.

Liability, chargebacks, and disputes

This is the least settled part of agentic commerce, and the one a leader should watch most closely. There is not yet a finalized, cross-network rulebook for how disputes on agent-initiated transactions are handled, which means the answer to “who pays when it goes wrong” is still being worked out. Trade and legal commentary widely expects much of the risk to land on merchants, on the logic that the card networks, issuers, and AI providers are each positioned to avoid absorbing it. The composition of disputes is also expected to shift, with fewer classic fraud claims and more “I did not authorize that” and “not as described” claims, for example when an agent misreads a user’s intent and buys the wrong item.

Be clear about one thing that is often stated the wrong way round: none of the agentic commerce protocols allocates liability. AP2 is the closest thing the ecosystem has to a dispute-evidence standard, and it says so itself. Its executive summary states that a primary objective is “to provide supporting evidence that helps payment networks establish accountability and liability principles,” and it lists accountability, meaning who is responsible when a transaction is fraudulent or incorrect, among the open questions current systems cannot answer. The v0.2 specification puts dispute resolution itself out of scope: it describes how the mandates and receipts can be brought together as evidence, then states that the details of how that is used for dispute resolution, retention, and retrieval are outside the specification. Liability is settled by network rules, issuer policy, and your contracts, not by a protocol.

American Express has made the most explicit consumer-protection commitment so far, Amex Agent Purchase Protection, announced in April 2026 alongside its Agentic Commerce Experiences (ACE) Developer Kit. It stands out precisely because a settled industry-wide standard does not exist, but read the scope before planning around it. Amex describes it prospectively, saying that in the future, if a Card Member authorizes an agent and that agent sends Amex the customer’s authenticated purchase intent, Amex will protect eligible customers from charges related to AI agent error. The announcement carries a forward-looking-statements caveat, the agent registration and cart context services it leans on are marked as in development, and terms and conditions are noted as applying. It protects cardholders, not merchants, and it does not tell a merchant who absorbs a disputed agent-initiated sale.

On regulation, the honest position is that no jurisdiction has published rules written specifically for agent-initiated disputes. The existing consumer-payment and chargeback regimes were drafted on the assumption that a human initiated the payment, and how they map onto delegated agent purchases is being argued rather than decided. Track it; do not assume it, and do not accept a vendor’s assurance that it is settled.

The practical defense, regardless of how the rules settle, is evidence, and it is worth being precise about what evidence means. AP2’s dispute procedure needs both halves of each pair: the Checkout Mandate and the Checkout Receipt the merchant returns, and the Payment Mandate and the Payment Receipt the processor returns, with the hashes binding them independently recomputed at the time of dispute. A log of mandates alone will not verify. Capture the user’s authorization, the cart the merchant signed, and the receipts, continuously, rather than trying to reconstruct consent after a dispute.

Privacy and data

Agent transactions create new data flows. An agent may share a user’s intent, constraints, and context with merchants and networks, and the question of what is shared, with whose consent, and who retains it is unsettled. For a business, this is both a compliance obligation and a strategic asset: the customer data and consent you hold, and handle responsibly, is part of what keeps the relationship yours rather than the agent platform’s. Treat agent-channel data with the same care as any other customer data, and be deliberate about what you expose to an agent surface.

Channel disintermediation

The largest strategic risk is not fraud but position. If an agent surface becomes the place customers shop, it can sit between you and the buyer, own the discovery moment, and commoditize your catalog against competitors who are one comparison away. This is not a reason to be absent, being absent only means being represented badly or not at all, but it is a reason to compete on the things an agent cannot strip away: owning your first-party relationships and data, and keeping your product information richer and more accurate than rivals so that when an agent compares options, you are surfaced and described well.

Operational and accuracy risks

A quieter risk is simply being wrong in a way agents cannot tolerate. Agents read machine-readable data and transact against it programmatically. If the price or availability an agent reads does not match your live store, an agent-initiated checkout can fail outright, or complete at terms you did not intend. And if an agent misinterprets a user’s request and orders the wrong item, the merchant is often the one left with the return and the dispute. The mitigation is unglamorous and high-value: keep your product data complete, structured, and accurate to the cent against what is live, and make your checkout API-driven so agents see real, current terms.

A readiness checklist

Use this as a starting point, not a finish line. A printable, downloadable version is on the resources page.

Governance: assign a clear owner for agentic commerce, and brief leadership on the two contested points, the unsettled liability picture and which checkout standard you will support. On the second, note that the standards question is increasingly answered for you by whoever you already buy from: Google has said that partners including Commerce Inc, Salesforce, and Stripe will implement UCP on their platforms, so for many merchants this is a question to put to a provider rather than an independent build decision. Data: audit your product feed for completeness, structure, and exact agreement with your live site, and fix mismatches. Payments and verification: rely on the networks’ agent-verification and scoped-token mechanisms rather than building your own trust layer, and read the terms of any program you join, including its consumer-protection and liability provisions, remembering that a consumer-protection pledge is not a merchant liability shift. Evidence and monitoring: log agent authorization and behavior continuously across the transaction, and keep the receipts as well as the mandates, so you can defend a dispute with a complete record rather than a reconstruction. Privacy: handle agent-channel data to the same standard as the rest of your customer data, and decide deliberately what you expose. Strategy: protect your first-party relationships and keep your product information better than competitors’, so an agent surface complements your channel rather than replacing it.

The bottom line

Agentic commerce is safe to enter, but not safe to enter carelessly. The authenticity and authorization problems are being solved by the standards, and you can lean on them. The liability picture is genuinely unsettled, and no protocol resolves it, so read the network and vendor terms and keep your evidence, receipts included. And the strategic risk, losing the customer relationship, is the one most within your own control. For the decision of whether and how to act, see what agentic commerce means for your business; for how the money and trust mechanics work, see how AI agents pay.

FAQ

Who is liable when an AI agent makes a purchase that goes wrong? There is not yet a finalized, cross-network rulebook for agent-initiated disputes, so this is the least settled part of agentic commerce. No protocol allocates it: AP2’s executive summary says its objective is to provide supporting evidence that helps payment networks establish accountability and liability principles, and its specification puts dispute resolution out of scope. Trade and legal commentary widely expects much of the risk to fall on merchants. American Express has made the most explicit consumer-protection pledge so far, but it is scoped to agent error, protects cardholders rather than merchants, and is stated prospectively. The practical defense is to capture authorization, the agreed cart, and the receipts at the point of delegation, not after a dispute.

How do I know an agent is genuinely authorized? AP2 uses signed mandates, expressed as verifiable digital credentials, to prove a specific user approved a specific purchase. Visa’s Trusted Agent Protocol, developed with Cloudflare, gives merchants a cryptographic way to tell legitimate agents from bots, though Visa states its initial specifications apply to the Visa network in this phase. The networks’ agent programs are built on registering and verifying agents before they transact.

What is the biggest strategic risk? Channel disintermediation: an agent surface owning the customer and the discovery moment. The defenses are owning your first-party data and relationships and keeping your product information richer and more accurate than competitors’.

What is the single most useful thing to do now? Build an evidence and audit trail for agent transactions, and keep your product data accurate against your live site. Log the receipts as well as the mandates, because AP2’s dispute procedure needs both halves of each pair, and accurate data prevents the mismatches that can break an agent checkout.