Can EU consumer law rules survive agent-to-agent API transactions?

Christoph Busch's CERRE issue paper, drawing on a May 2026 CERRE Regulatory Lab on Agentic AI and Consumer Protection, argues that EU consumer law's "design-based provisions" — rules written to govern a human clicking through a graphical user interface — become impossible to satisfy once agentic transactions move "from graphical interfaces to the protocol layer where agent-to-agent (A2A) communication via APIs will replace browser-based interaction." The paper names three concrete examples: the "buy now" button that operationalizes the Consumer Rights Directive's Article 8(2) requirement that consumers "explicitly acknowledge" a payment obligation, the Article 11a CRD right to withdraw from an online contract, and the Article 31(1) Digital Services Act "compliance by design" rule for online marketplaces. Once agents interact "directly through APIs using standardised communication protocols such as the Universal Commerce Protocol (UCP) or the Agentic Commerce Protocol (ACP)," Busch writes, "the agents never encounter buttons or prominently displayed disclosures," so "this will make compliance with GUI-based requirements structurally impossible."

The paper's reasoning splits agents into two types the current law treats identically but which pose different compliance realities: "web browsing agents" that "still mimic human click-through behaviour" can satisfy GUI rules by proxy, while protocol-native agents bypass the interface layer entirely. Busch's proposed fix preserves the substantive protection while changing its technical form: introduce "functionally equivalent obligations" at the protocol layer, such as a "withdrawal API" running alongside the mandatory withdrawal button, so the right survives even where "the interface itself changes." On sequencing, the paper argues an incremental approach is "the more sensible and politically realistic path" given that agentic commerce is still early and business models are unsettled — first clarifying how existing Unfair Commercial Practices Directive and CRD guidance already covers agentic transactions, then, once standards like UCP and ACP mature, translating the design-based rules into protocol-based ones.

This sharpens, rather than restates, the claim in Can EU consumer law protect AI agents as algorithmic buyers?: where that paper diagnoses the average-consumer test and disclosure-design rules as built for human cognition, Busch's paper locates the break at a narrower, more concrete point — the technical layer at which a transaction happens — and proposes a specific mechanism (parallel protocol-layer obligations) rather than a general call for doctrinal reform. The paper also names, in a single paragraph, the same incentive-alignment risk that Can traditional governance tools actually control AI agents? treats at length: an agent provider that "also sells or promotes its own products or those of paying partners" may be "structurally incentivised to steer purchasing decisions" away from the consumer's interest, though Busch does not develop a remedy beyond flagging it for the EU's Digital Fairness Act (DFA) update.

The paper is a policy issue paper synthesizing a regulatory workshop, not an empirical study or draft legislation: it does not test whether a "withdrawal API" is technically specifiable, estimate how many transactions already run protocol-native rather than browser-based, or resolve whether an AI agent can ever "meaningfully perform" the Article 8(2) payment acknowledgment on a consumer's behalf. The implication it supports is narrower than a general warning that law must adapt: a consumer-protection rule written around a GUI interaction point fails not through non-compliance but through the interaction point ceasing to exist, which ties regulatory timing to UCP/ACP protocol adoption rather than to agent capability generally.