AI Agents Are Starting To Make Purchases On People’s Behalf – But What Happens If They Buy Something Illegal?

What happens when an AI agent buys something illegal, makes an unauthorised payment or purchases the wrong item without a human pressing the final checkout button? Well, retailers, banks and software companies may all end up arguing about whose responsibility and fault this really is.

With all of the conversations lately around agentic commerce, it might be worth opening this discussion up. Especially when research, such as The Payments Association’s findings, tell us that 58% of UK online merchants believe AI agents have already made purchases through their systems.

The report, titled Agentic commerce in UK retail: An unresolved liability question, examined AI systems that can search for products, choose sellers and complete purchases for consumers without human approval at every stage of the process.

Emma Banymandhub, CEO of The Payments Association, said, “Agentic commerce is arriving faster than many merchants expected. The Paypers’ Global Ecommerce Report 2026 projects that AI agents could drive 25–30% of all global online purchases by 2030, and Visa, Mastercard, Google, OpenAI and the FIDO Alliance have all moved this year to publish open protocols for agent-initiated checkout.

“The concern is that businesses are already processing AI-initiated transactions without the controls, liability clarity or transaction visibility needed to manage the risks properly, fraud engines built around human behavioural signals are misfiring on legitimate agent traffic, and the question of who carries the loss when an agent transacts incorrectly remains unresolved.”

The problem becomes way more serious when the transaction involves prohibited goods or fraud. Current payment systems were designed around human intent, and agentic commerce changes that assumption.

What Exactly Is Agentic Commerce?

The Competition and Markets Authority defines agentic AI as systems that can “sense, decide and act autonomously”. In shopping, that means software which compares options and completes purchases for consumers.

Traditional AI shopping tools only assist buyers whereas agentic systems transact on behalf of them.

McKinsey estimates agentic commerce could influence between $3 trillion and $5 trillion in global B2C retail revenue by 2030. Bain projects AI agents could account for 15% to 25% of US ecommerce sales during the same period.

That growth explains why payment companies are pushing so much lately – even Visa and Mastercard have both introduced frameworks for agentic commerce. The Payments Association said many of those protocols are still not widely available in the UK market, which leaves merchants unable to properly identify when AI agents are making purchases.

The uncertainty becomes especially obvious when merchants are asked who should take the fall if something goes wrong. Let’s say hypothetically, there’s a disputed £2,000 AI purchase, 24% of respondents said liability would depend on the circumstances and 21% supported shared liability. Only 18% believed the AI vendor should carry responsibility.

Only 41% of merchants said they felt very confident in current liability frameworks.

What Happens If The AI Buys Something Illegal?

So what happens in a case like this? An AI agent could buy age restricted goods, counterfeit products, prohibited substances or items purchased through stolen payment credentials. The software may have acted within the permissions given to it, but the transaction itself may still break the law or violate platform rules.

The legal difficulty comes from intent and authorisation. Human buyers can explain their decisions but AI agents cannot explain intent in the same way.

Monica Eaton, Founder and CEO of Chargebacks911, said, “Payments is being redesigned for AI agents, but disputes are still built for humans. That gap matters. Agentic commerce is forcing the payments industry to rethink what authorisation actually means. Intent is no longer captured at checkout but in the permissions granted beforehand. The industry’s focusing heavily on enabling AI-driven payments, but little attention is being paid to the evidence, consent, and dispute frameworks needed when transactions are later challenged.”

That is a tricky case for both retailers and regulators. Did the consumer approve the purchase because they activated the AI agent in the first place? Does responsibility fall on the merchant for failing to detect suspicious behaviour? Should the AI developer carry liability because the software acted incorrectly?

Well, UK regulators are already examining those questions.

The Competition and Markets Authority said existing consumer protection law applies whether decisions come from humans or AI systems. The Financial Conduct Authority also launched a review into the long term effect of AI in retail financial services under Sheldon Mills in January 2026.

HM Treasury has also identified Strong Customer Authentication reform and agentic AI payments as active policy workstreams.

Why Are Merchants Nervous Already?

Authentication, to date, is one of the biggest worries for retailers. Research from The Payments Association found that 32% of merchants identified authentication as a leading concern.

Current fraud systems were built around human behaviour such as location tracking, typing speed, browsing habits, and so on. AI agents behave differently and may come off suspicious even when acting legitimately.

Imogen Hussey, Senior Strategy Manager at Worldpay, said, “As commerce becomes faster and more automated, fraud is evolving just as quickly. Retailers must balance convenience with stronger, more intelligent fraud controls, using data and real-time insights to identify suspicious behaviour without adding friction for genuine shoppers.”

Consumer behaviour brings forward another complication, and research for Worldpay and research agency The Lantern found that 31% of UK shoppers would allow an AI agent to shop for them. That came up to 45% among people aged 18 to 34.

On consumer safety, Worldpay found that 68% of UK consumers want full control over what an AI agent purchases. 58% said the ability to cancel purchases within 24 hours was essential and fraud protection ranked as essential for 54% of respondents.

Bigger purchases create the biggest hesitation because consumers were most comfortable allowing AI agents to handle routine purchases under $100, such as cinema tickets and meal deliveries. Interest fell quite a bit for expensive items above $1,000.

The technology already exists for AI agents to spend money independently. Legal systems and payment networks now face the difficult task of deciding responsibility after those systems purchase illegal goods or complete unauthorised transactions.