📊 Full opportunity report: The rails. Why European agentic commerce is co-defined by two converging regimes. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European agentic commerce is being built on two regulatory regimes—payment law and AI law—that are shaping its infrastructure. This convergence affects how AI agents can pay, assess, and operate, and is slower but potentially more durable than the US approach.
European regulatory regimes are jointly shaping the future of agentic commerce, with PSD3/PSR and the AI Act setting the legal framework for AI-powered payment and assessment systems. This convergence determines whether AI agents can pay, assess, or score in Europe, and marks a fundamental difference from the US model.
The core issue is that, in Europe, the ability of AI agents to execute payments is not solely a technological question but a legal one. While AI can compare products, fill carts, and recommend, European law requires human authorization for payments, creating a legal ‘rail’ that AI cannot bypass. Unlike the US, where private infrastructure like Mastercard’s Agent Pay and Visa’s Intelligent Commerce enable agent payments through decision-driven networks, Europe’s payment infrastructure is statutory, governed by PSD2’s Strong Customer Authentication (SCA) and upcoming PSD3/PSR reforms. These reforms, scheduled for implementation around 2028, will impose mandatory API parity, requiring banks to expose interfaces as capable as their consumer apps, and open finance provisions under FIDA will make data a public utility rather than private control.Simultaneously, the AI Act, agreed in November 2025 and set to impose high-risk obligations in 2026, classifies AI systems involved in credit scoring, fraud detection, and other financial tasks as high-risk. These systems will require conformity assessments, human oversight, and registration, adding guardrails to AI-driven financial activities. The two regimes were not designed together, leading to a fragmented, seam-prone architecture where the legal authority, scope, and timelines differ. This means that whether an AI agent can pay depends on the evolving payment laws, while its ability to assess or score depends on AI-specific regulations.
The rails.
Why European agentic
commerce is co-defined by
two converging regimes.
SCA needs a human payer
first-class third-party interfaces
(Omnibus may slip it to 2027)
the clock agentic commerce runs on
choose the best deal — capability is here
authentication
required
as the equivalent of a human payer
- Mastercard Agent Pay, Visa Intelligent Commerce, Plaid
- The rail’s owner sets the rule — extend to agents by product decision
- Fast — moves at product speed
- Concentrated — a few firms control access
- PSD2/PSD3, PSR, SCA, FIDA
- The legislature sets the rule — no network can grant payer status
- Slow — moves at legislative speed
- Open — mandatory API parity, public data substrate
within
limits
Europe is betting that durable, open, publicly-owned rails produce a better agentic-commerce market than fast, concentrated, privately-owned ones — even at the cost of arriving later. Which foundation an agent economy actually prefers is the genuine open question.Thorsten Meyer · The Rails · Agentic Commerce 04
Implications of Dual Regulatory Frameworks for European AI Payments
This convergence of two regulatory regimes creates a deliberate but slower path for European agentic commerce, contrasting with the US’s faster, privately controlled infrastructure. The statutory approach, with mandatory API access and open finance, may produce a more resilient and open market but at the cost of delayed deployment. The legal architecture’s complexity and fragmentation mean that the pace and capabilities of AI agents in Europe will be constrained not by technology but by evolving laws. This approach could lead to a more durable and equitable market structure, but it also introduces uncertainty about timing and implementation.
European AI payment authorization device
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Regulatory Evolution and Its Impact on AI Commerce
European regulation has historically prioritized consumer protection and data privacy, exemplified by PSD2’s Strong Customer Authentication and open banking initiatives. The recent agreement on PSD3 and the Payment Services Regulation (PSR) aims to overhaul payment infrastructure by mandating API parity and direct access for nonbank providers, scheduled for implementation around 2028. Meanwhile, the AI Act, finalized in late 2025, classifies certain AI systems as high-risk, requiring compliance assessments and oversight. These developments are unfolding separately but will intersect in shaping how AI agents operate within the European legal framework, creating a complex but potentially more robust infrastructure for agentic commerce.
“European agentic commerce is not a product the labs ship onto existing rails; it is a system being co-defined by two converging regulatory regimes.”
— Thorsten Meyer
PSD3 compliant API banking tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Uncertainties in Implementation and Timing of Regulations
It remains unclear how quickly the PSD3/PSR reforms will be implemented and how effectively they will integrate with AI regulations under the AI Act. The exact timeline for AI high-risk obligations and their enforcement is still uncertain, and the interaction between these regimes may evolve as regulators interpret and refine the rules. Additionally, the practical ability of AI agents to operate within these frameworks, including the technical and legal hurdles, is still being tested.
high-risk AI assessment software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in Regulatory Development and Market Adoption
Regulators are expected to finalize and implement PSD3 and PSR reforms by 2028, with ongoing trilogues and legislative adjustments. The AI Act’s high-risk obligations are likely to come into force by 2027 or 2028, depending on legislative progress. Industry stakeholders will monitor these developments to adapt AI agent capabilities accordingly. The first practical deployments of compliant agentic systems in Europe are anticipated within the next two years, with full integration contingent on regulatory clarity and technological readiness.
European agentic commerce payment system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How does European regulation affect AI agents’ ability to pay?
European law requires human authorization for payments, which means AI agents cannot pay directly without legal changes. Upcoming regulations like PSD3/PSR will rebuild the payment infrastructure, but legal authority to pay still depends on legislative approval.
What is the main difference between US and European agentic commerce?
The US relies on private, decision-driven infrastructure owned by firms like Mastercard and Visa, allowing faster deployment. Europe’s approach is statutory, built into law with mandated API access and open finance, making it slower but potentially more durable.
When will European regulations for AI and payments be fully in place?
PSD3/PSR reforms are expected around 2028, while the AI Act’s high-risk obligations may be enforced by 2027 or 2028, depending on legislative progress.
Will European agentic commerce be more secure or open?
The statutory, open-infrastructure approach aims to create a more open and resilient market, but the slower pace may delay widespread adoption compared to the US.
What are the risks of the fragmented European regulatory approach?
The main risks include delays, legal uncertainties, and potential difficulties in integrating AI and payment systems smoothly, which could hinder rapid deployment of agentic commerce.
Source: ThorstenMeyerAI.com
