Agentic AI and Consumer Protection (CERRE Issue Paper)

Source: Christoph Busch; CERRE (Centre on Regulation in Europe) issue paper · 2026-07-16

Introduction. Online shopping is going through a profound transformation. According to a recent survey, an increasing number of consumers no longer start their customer journey with a search engine like Google or an online marketplace like Amazon, but rather with ChatGPT, Gemini, or Claude: 46% of consumers in the European Union already use artificial intelligence (AI) tools to discover new products; 63% use AI tools to compare offers and learn more about product features. But AI assistants that support shopping with recommendations are just the beginning of a more fundamental structural change affecting online commerce. The next stage of evolution is agentic AI. Unlike chatbots, AI agents can not only talk but also take action. They do more than just assist with product searches by providing purchase recommendations and product comparisons. AI agents can independently perform complex tasks, such as purchasing products from online stores, booking airline tickets, or switching electricity providers. In the near future, consumers could therefore be able to delegate more of their transactional decisions to AI agents. Even though this may still sound like science fiction, forecasts suggest that agentic shoppers will soon play an increasingly important role in digital markets. According to some estimates, between 10% and 20% of e-commerce transactions could be handled by an AI agent in 2030.3 Other forecasts suggest that agentic commerce could orchestrate USD 3 trillion to USD 5 trillion worth of transactions globally by 2030.4 Against this background, in May 2026, the Centre on Regulation in Europe (CERRE) organised a Regulatory Lab on Agentic AI and Consumer Protection. The event brought together stakeholders and policy makers to discuss whether EU consumer law is ready for the rise of AI agents and how consumer law should develop in order to enable innovative business models built on agentic AI while, at the same time, ensuring a high level of consumer protection.

Building on these conversations and earlier research, this note outlines some of the key issues that were discussed at the Regulatory Lab and develops further ideas on how consumer policy should respond to the challenges created by the ‘agentic turn’ in digital markets.

The note is structured into three parts. Following this introduction, the first part explores whether EU consumer law is agent-ready and explains how AI agents challenge the existing consumer protection framework. The second part looks ahead and offers some initial recommendations for building a consumer law rules that work for humans and machines. Finally, the third part outlines how to transition to the next generation of consumer law that is ready for the agentic economy.

Method. Before discussing whether EU consumer law is agent-ready, it is necessary to clarify what we talk about when referring to AI agents. There is not yet a generally agreed definition of AI agents. According to a leading textbook on AI, an agent is, in a very general sense, "anything that can be viewed as perceiving its environment through sensors and acting upon that environment through actuators". However, for the purposes of this note, which focuses on issues of consumer protection, this definition (which would include a thermostat) is too broad. A more suitable working definition can be borrowed from a recent report on AI regulation by the UK Department for Science, Innovation and Technology: AI agents are "autonomous AI systems that perform multiple sequential steps – sometimes including actions like browsing the internet, sending emails, or sending instructions to physical equipment—to try and complete a high-level task or goal."8 In order to understand why the rise of agentic AI challenges the very foundations of EU consumer law, it is necessary to recall a feature of EU consumer law that seems so self-evident that it is often not explicitly stated: EU consumer law in its current form is human-centric. It is designed with the needs and weaknesses of human consumers in mind. Put differently, the design of consumer law rules is based on the premise that purchasing decisions are made by humans. Therefore, EU consumer law aims to protect human consumers and ensure their autonomy.

However, this premise is challenged by AI in general and AI agents in particular. The agentic economy will be more complex and diverse than the old human-centric economy, for which the existing consumer laws were built. In the brave new world of AI-driven retail, human consumers will coexist with "augmented consumers" (who are assisted by AI tools such as ChatGPT or Claude) and AI agents acting autonomously as "algorithmic consumers" or "Custobots" on behalf of humans. Agentic AI and Consumer Protection

Discussion. Information disclosures and consent requirements In this sense, AI agents have the potential to address one of the most persistent criticisms of the "information paradigm" in consumer law, namely that the long lists of standardised pre-contractual disclosures mandated by EU directives tend to overwhelm human consumers rather than enabling informed decisions. Agents could also help reduce information asymmetries more broadly by drawing on a wider range of data sources than any human consumer could realistically consult, including customer reviews, user forums, product tests, and online media, thereby improving comparison shopping across brands and retailers.

Another question concerns consent requirements. Article 8(2) of the Consumer Rights Directive (CRD) requires that consumers "explicitly acknowledge" a payment obligation, typically via a button. But it remains unclear whether an AI agent can meaningfully perform this acknowledgement on the consumer's behalf, or whether a separate confirmation step involving the human is still required.

Today, many provisions of EU consumer law presuppose that a human consumer is clicking through a graphical user interface (GUI). Examples of design-based provisions include the above mentioned "buy now" button (Article 8(2) CRD), the recently introduced right for a consumer to withdraw from an online contract within a specified period (Article 11a CRD) or the "compliance by design" rule for online marketplaces (Article 31(1) of the Digital Services Act or DSA).

However, the assumption on which these rules are built no longer holds once agentic transactions move from graphical interfaces to the protocol layer where agent-to-agent (A2A) communication via APIs will replace browser-based interaction. While so-called ‘web browsing agents’ still mimic human click-through behaviour, other agents interact directly through APIs using standardised communication protocols such as the Universal Commerce Protocol (UCP) or the Agentic Commerce Protocol (ACP). In such a scenario, the agents never encounter buttons or prominently displayed disclosures. This will make compliance with GUI-based requirements structurally impossible.

This raises the question of whether functionally equivalent obligations — for instance a ‘withdrawal API’ alongside the mandatory withdrawal button — should be introduced to preserve the substantive protection these rules were meant to deliver, even where the interface itself changes. Taken together, these developments suggest that the existing EU consumer law requirements may need to be translated into agent-ready requirements that operate on the protocol layer rather than on graphical interfaces.

A further risk specific to the agentic economy concerns the alignment of incentives between consumers and the providers of AI agents. Possible conflicts of interest could arise where the provider of the AI agent has commercial interests that diverge from those of the consumer it is supposed to represent. More specifically, an agent operated by a business that also sells or promotes its own products or those of paying partners may be structurally incentivised to steer purchasing decisions accordingly rather than solely pursuing the consumer's actual interests.

Conclusion. The final section of this note addresses the question of how to manage the transition towards an agent-ready consumer law: is incremental change or a more revolutionary approach more desirable? What is the right timing for regulatory intervention? What are the right regulatory tools? What risks could flow from regulatory inaction?

As part of the update to EU consumer law, the DFA should also address the challenges described above that the rise of agentic commerce poses for consumer law. Since the transition towards agentic commerce is still in its early stages and the future development of business models is not yet clearly foreseeable, an incremental reform strategy appears the more sensible and politically realistic path.

As a first step, it should be clarified how existing regulations apply to agentic transactions. This could be done, for example, through an updated version of the guidance on the UCPD and the CRD. Such an approach would build on the technology-neutral wording already present in many provisions of the UCPD and CRD, extending established regulatory approaches to cover agentic transactions through interpretation and targeted clarification rather than fundamentally new categories of rules. At the same time, the most glaring gaps should be addressed to ensure that consumers retain control in agentic transactions. The DFA offers a good opportunity to do so, which should not be missed. In a second step, the existing regulatory framework should be further developed to ensure that consumer protection is also guaranteed at the protocol layer. To achieve this, it will be necessary to translate the existing design-based provisions into protocol-based rules. However, this can only be done effectively once there is more clarity regarding which communication standards will shape the future of agentic commerce.