📊 Full opportunity report: The rails. Why European agentic commerce is co-defined by two converging regimes. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European agentic commerce is being co-defined by two regulatory regimes—PSD3/PSR rebuilding payment rails and the AI Act establishing AI guardrails—creating a complex, statutory foundation that differs from the US’s commercial approach. This impacts the speed and durability of market development.
European regulatory regimes are simultaneously constructing the infrastructure and guardrails for agentic commerce, fundamentally shaping how AI-powered payment agents will operate in Europe. This convergence of two legal frameworks—PSD3/PSR and the AI Act—means the future of agentic finance depends on statutory, not technological, decisions.
The core issue is that, unlike the US, where private infrastructure like Mastercard’s Agent Pay and Visa’s Intelligent Commerce facilitates agent payments, Europe’s payment rails are defined by law. Under PSD2, strong customer authentication requires human approval for online payments, preventing AI agents from acting as payers without legal authorization. The upcoming PSD3 and Payment Services Regulation (PSR), scheduled for 2026-2028, will rebuild these rails with mandatory API parity, compelling banks to expose interfaces comparable to their consumer apps. Meanwhile, the EU AI Act, also set to take effect around 2026, classifies AI systems involved in credit scoring, fraud detection, and similar functions as high-risk, requiring conformity assessments, human oversight, and registration. These two regimes were developed independently, leading to a fragmented system where the ability of an AI agent to pay or assess depends on different legal instruments and timelines. This structural separation means the European approach to agentic commerce is slower but potentially more durable, as the statutory infrastructure is built into law and not controlled by private firms, unlike the US’s faster, private-led model.RAILS
AGENTIC COMMERCE · 04
EUROPE / RAILS
Essay · European-Infrastructure Forensic · 2026-06-04
The rails.
Why European agentic
commerce is co-defined by
two converging regimes.
An agent that can shop cannot pay. The gap at the center of European agentic commerce isn’t a technology gap — it’s a legal one.
The AI can compare, choose, and fill the cart — but at payment, European law requires a human, not a machine, to authorize, and there’s no mechanism to treat an agent as a legal payer. In the US, agentic payments run on commercial rails (Mastercard Agent Pay, Visa Intelligent Commerce, Plaid) a few firms own and extend by decision. In Europe the rails are statutory — defined by regulation, and being rebuilt right now: PSD3/PSR (agreed Nov 2025, publishing summer 2026) with mandatory API parity, and the AI Act classifying credit scoring as high-risk. The structural argument: European agentic commerce isn’t a product shipped onto existing rails — it’s a system co-defined by two converging regulatory regimes, so the constraint isn’t the agent’s capability but the legal architecture it must run on, and that architecture is statutory, fragmented, and different in kind from the US commercial one.
can’t pay
An agent can shop but can’t pay ·
SCA needs a human payer
SCA needs a human payer
API parity
PSD3 forces banks to expose
first-class third-party interfaces
first-class third-party interfaces
Aug 2 ’26
AI Act high-risk deadline ·
(Omnibus may slip it to 2027)
(Omnibus may slip it to 2027)
~2028
PSD3 full applicability ·
the clock agentic commerce runs on
the clock agentic commerce runs on
THE RAILS·
AN AGENT THAT CAN SHOP CANNOT PAY·
THE CONSTRAINT IS LEGAL, NOT TECHNOLOGICAL·
SCA REQUIRES A HUMAN PAYER · NO MECHANISM FOR AGENTS·
US COMMERCIAL RAILS · EXTENDED BY DECISION · FAST, CONCENTRATED·
EU STATUTORY RAILS · DEFINED BY LAW · SLOW, OPEN·
PSD3/PSR AGREED NOV 27 2025 · PUBLISHING SUMMER 2026·
MANDATORY API PARITY · NO MORE DEGRADED INTERFACES·
DIRECT PAYMENT-SYSTEM ACCESS FOR NONBANKS · NO SPONSOR-BANK VETO·
AI ACT · CREDIT SCORING IS HIGH-RISK·
FOUR INSTRUMENTS · PSR / FIDA / PSD3 / AI ACT · ONE AGENT·
THE FRICTION IS INTER-REGIME, NOT INTRA-REGIME·
THE MANDATE BRIDGE · AUTHORIZE ONCE, DELEGATE BOUNDED ACTION·
WHICH FOUNDATION AN AGENT ECONOMY PREFERS IS THE OPEN QUESTION·
THE RAILS·
AN AGENT THAT CAN SHOP CANNOT PAY·
THE CONSTRAINT IS LEGAL, NOT TECHNOLOGICAL·
SCA REQUIRES A HUMAN PAYER · NO MECHANISM FOR AGENTS·
US COMMERCIAL RAILS · EXTENDED BY DECISION · FAST, CONCENTRATED·
EU STATUTORY RAILS · DEFINED BY LAW · SLOW, OPEN·
PSD3/PSR AGREED NOV 27 2025 · PUBLISHING SUMMER 2026·
MANDATORY API PARITY · NO MORE DEGRADED INTERFACES·
DIRECT PAYMENT-SYSTEM ACCESS FOR NONBANKS · NO SPONSOR-BANK VETO·
AI ACT · CREDIT SCORING IS HIGH-RISK·
FOUR INSTRUMENTS · PSR / FIDA / PSD3 / AI ACT · ONE AGENT·
THE FRICTION IS INTER-REGIME, NOT INTRA-REGIME·
THE MANDATE BRIDGE · AUTHORIZE ONCE, DELEGATE BOUNDED ACTION·
WHICH FOUNDATION AN AGENT ECONOMY PREFERS IS THE OPEN QUESTION·
FIG. 01 — THE GAP · AN AGENT THAT SHOPS CANNOT PAY
The defining constraint on European agentic commerce is legal, not technical
The capability is present; the authority is absent
shop ✓
Compare, evaluate, fill the cart,
choose the best deal — capability is here
choose the best deal — capability is here
SCA
human
authentication
required
authentication
required
pay ✗
No mechanism to treat an agent
as the equivalent of a human payer
as the equivalent of a human payer
Strong Customer Authentication requires two of three factors — something the payer is (biometric), knows (password), possesses (a device). Each presumes a human; an autonomous agent has none in the SCA sense. Europe’s agentic-commerce bottleneck is its own payment law — a constraint that cannot be engineered around, only legislated through. The barrier is not a missing feature; it is the regime itself.
FIG. 02 — STATUTORY VS COMMERCIAL RAILS · WHY THE US PLAYBOOK DOESN’T PORT
Two foundations, different in kind
The US playbook assumes the rail’s owner sets the rule; in Europe the legislature does
US · commercial rails
Owned by networks, extended by decision
- Mastercard Agent Pay, Visa Intelligent Commerce, Plaid
- The rail’s owner sets the rule — extend to agents by product decision
- Fast — moves at product speed
- Concentrated — a few firms control access
EU · statutory rails
Defined by regulation, no owner
- PSD2/PSD3, PSR, SCA, FIDA
- The legislature sets the rule — no network can grant payer status
- Slow — moves at legislative speed
- Open — mandatory API parity, public data substrate
A US firm cannot bring Agent Pay to Europe and switch agents on — it must wait for the European regime to define how an agent authenticates, accesses data, and pays. The playbook’s central move (extend the rail by decision) is unavailable, because the rule is set by regulation. The same property that makes the EU stack slow — statutory rails — is the property that makes it open: no agent economy built on Visa’s permission is as open as one built on mandatory API parity.
FIG. 03 — THE PSD3/PSR REBUILD · THE NEW PAYMENT RAILS
The most consequential payments reform since PSD2 introduced open banking
The clock European agentic commerce runs on
Nov 27 2025
Parliament + Council reach provisional political agreement on PSD3 and the PSR
Summer 2026
Final texts expected in the Official Journal
+20 days
PSR (directly applicable) takes effect — mandatory API parity, nonbank payment-system access
~2028
PSD3 fully applicable after ~18-month transposition · the SCA rewrite lives in the PSR
Mandatory API parity means an agent gets a first-class bank interface by law — the difference between an agent that works and one quietly throttled by the bank whose customer it acts for. Direct payment-system access ends the sponsor-bank veto over fintech models. But the SCA accommodation that would let an agent pay is not yet written — it must live in the PSR, within a framework built to fight a $400B fraud problem.
FIG. 04 — THE AI ACT GUARDRAILS · THE MODEL REGIME
Running on the rails is necessary but not sufficient
The rails govern whether the agent can pay; the guardrails govern whether it can decide
The classification
Credit scoring = high-risk
Annex III loads it with conformity assessment, human oversight, registration, post-market monitoring. The heaviest tier.
The deadline
Aug 2 2026 — maybe
The May 2026 “Omnibus” proposes slipping high-risk to 2027 — not yet adopted; treat Aug 2026 as operative.
The reach
Extraterritorial
A US lab’s agent scoring a European user is in scope even if hosted offshore. The Brussels Effect, applied to agents.
The AI Act’s human-oversight requirement intersects directly with the payment regime’s human-authentication requirement: both regimes, from different directions, insist a human stay in the loop — the AI Act for the decision, the PSR for the payment. Non-compliance reaches up to 7% of global revenue. The guardrail shapes what an agent can do beyond paying — and because it reaches any system serving EU users, it shapes agentic finance globally.
FIG. 05 — THE MANDATE BRIDGE · HOW THE GAP GETS CROSSED
Not as an autonomous payer — as a bounded delegate of a human who authorized it once
The design that threads both regimes’ insistence on a human in the loop
The human · up front
Authorizes the mandate
Sets spending limits, allowed merchants, use cases — and authenticates once (satisfies SCA).
→
delegated,
within
limits
within
limits
The agent · within bounds
Transacts inside the mandate
Acts without re-authenticating each payment — the boundaries satisfy AI Act oversight.
The mandate satisfies the payment regime’s human-authentication requirement (the human authorizes the mandate) and the AI Act’s human-oversight requirement (the human sets and can revoke the boundaries) simultaneously. For it to scale, the regimes must formalize it — the PSR’s SCA rewrite is where the legal basis would live, the AI Act’s oversight rules are where the boundary requirements would. This is the permission-and-boundary model the European approach favors over autonomous action.
Europe is betting that durable, open, publicly-owned rails produce a better agentic-commerce market than fast, concentrated, privately-owned ones — even at the cost of arriving later. Which foundation an agent economy actually prefers is the genuine open question.Thorsten Meyer · The Rails · Agentic Commerce 04
Why the European Regulatory Framework Shapes Agentic Commerce
The European approach, by embedding agentic commerce within statutory frameworks, creates a more stable but slower environment. This limits quick deployment of AI payment agents but ensures long-term legal clarity and open access, potentially fostering a more inclusive market. Conversely, the US’s private infrastructure enables rapid innovation but concentrates control among a few firms. The choice of foundational architecture will influence which model proves more effective for future AI-driven financial services and consumer trust.
The Scaling Era: An Oral History of AI, 2019–2025
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Regulatory Developments and Their Impact
European regulators are simultaneously advancing two major legislative initiatives—PSD3/PSR and the AI Act—that will fundamentally alter the infrastructure and guardrails for AI-enabled payments and assessments. PSD3/PSR, expected to be enacted by 2028, aims to rebuild payment rails with API parity, exposing banking interfaces to third-party developers and AI agents. The AI Act, with high-risk classifications scheduled for 2026, imposes conformity assessments and human oversight on AI systems involved in financial decision-making. These initiatives were developed separately, leading to a complex landscape where the legal authority and technical capabilities intersect. Historically, Europe’s payment system has been tightly regulated, emphasizing security and consumer protection, but this has slowed the deployment of autonomous, AI-driven payment agents compared to the US, where private networks and decision-making dominate. The convergence of these regimes now creates a unified but intricate legal environment for agentic commerce, with the potential to influence global standards.“The question ‘can an AI agent pay for things in Europe’ has no technological answer, only a regulatory one.”
— Thorsten Meyer
Remaining Uncertainties in European Agentic Commerce
It is still unclear how quickly the regulations will be implemented and how effectively they will be enforced. The timelines for PSD3/PSR and the AI Act may shift, and the interaction between the two regimes remains complex. Additionally, the actual impact on market innovation and competitiveness has yet to be fully observed, as the legal frameworks are still being finalized and tested in real-world scenarios.
Next Steps in Regulatory Implementation and Market Adaptation
European regulators are expected to finalize the PSD3/PSR regulations by 2026, with full implementation targeted for 2028. The AI Act’s high-risk provisions are also slated for 2026, with possible delays. Industry stakeholders are preparing for compliance, and pilot programs may emerge to test the new infrastructure. Monitoring how these frameworks influence the deployment of AI agents in finance will be crucial, alongside ongoing legislative adjustments and international coordination efforts.
Key Questions
How will European regulations affect AI payment agents?
They will determine whether AI agents can act as payers, requiring legal authorization, human oversight, and compliance with open and secure infrastructure standards.
What is the main difference between the US and European approaches?
The US relies on private, commercial rails controlled by firms like Mastercard and Visa, enabling faster deployment. Europe’s approach is statutory, involving law-based infrastructure that is slower but aims for greater stability and openness.
When will these regulations be fully in place?
PSD3/PSR is expected by 2028, with the AI Act’s high-risk rules possibly coming into effect by 2027 or 2028, depending on legislative progress.
Will Europe’s approach limit innovation?
While slower, the statutory framework aims to create a more durable and equitable environment, potentially fostering long-term trust and inclusion in AI-driven finance.
What are the risks of fragmented regulation?
The interaction between different regimes could create implementation challenges and legal uncertainties, which might delay market readiness or cause compliance complexities.
Source: ThorstenMeyerAI.com
This content is for general information only and is not financial, tax or legal advice. Consult a qualified professional for decisions about your money.
