OUT-LAW ANALYSIS 8 min. read
The retailers best positioned to benefit commercially will be those who treat governance as strategic investment. deepblue4you/iStock.
28 Oct 2026, 12:11 pm
Retailers that invest now in proper governance over the use of agentic AI in enabling online purchases stand to gain a competitive advantage as the technology develops and increasingly shapes consumer behaviour.
In the UK, policymakers and regulators are considering how to adapt rules for a new world where AI tools operate autonomously based on dynamic reasoning, with little or no human input. The disruption this is expected to cause to retail financial services was foreshadowed in a regulatory review published earlier this year and challenges the way existing rules, protocols and standards relevant to e-commerce transactions operate.
A new “trusted framework for agentic finance” is envisaged by the Financial Conduct Authority (FCA), which has said that it wants to “create the conditions in which agentic finance can thrive, with innovation and consumer protection built together from the start”. In tandem, the Treasury has acknowledged that existing payment services regulations “may not fully facilitate the use of agentic AI” and is considering possible reforms. I previously set out my view on what new rules for agentic AI in payments might look like.
On AI governance more broadly, the Financial Stability Board (FSB), which coordinates financial regulation across the 'group of 20' (G20) major global economies, has weighed in with its own guidance, encouraging adoption of 12 “sound practice” standards. In the first of those standards, the FSB suggests (75-page / 918KB PDF) board-level alignment of AI governance with business strategy and risk appetite.
While the FSB’s guidance is aimed at financial institutions, it would be wrong of retailers to think that best practices developed on AI governance are only relevant to the payment service providers they partner with, and not to them directly. Agentic AI should not be viewed as an IT or operations issue; it should be on every board's risk register and considered as part of a retailer's risk appetite framework. The FSB’s guidance offers retailers a good template for their own good governance over the technology at a time of rapid rise in its use in e-commerce.
Read more on agentic AI:
In its guidance, the FSB explicitly encourages institutions to build the capacity to evolve governance, not just implement fixed rules. This is particularly relevant because retailers are operating in an increasingly fast-moving legal and regulatory environment in respect of AI, from dealing with implementation of the EU AI Act, to responding to emerging technical standards on agent identity and delegated authorisation, to implementing new guidance issued by regulators to address the use of agentic AI.
Retailers operating across jurisdictions should also be alert to the risk of conflicting regulatory requirements on agent identity verification, data processing, and transparency obligations, and should ensure their governance frameworks account for this complexity from the outset.
In the UK, businesses benefit the work undertaken by regulators in this regard being coordinated through the Digital Regulation Cooperation Forum (DRCF). The DRCF provides a forum through which the FCA, the Competition and Markets Authority (CMA), Ofcom and the Information Commissioner’s Office (ICO) can work together on holistically addressing questions new technologies raise around digital regulation but within their individual remits.
Earlier this year, the DRCF published a report on the future of agentic AI with a view to enabling innovation, building on earlier research published by the CMA. This was followed by new guidance from the ICO promoting data protection law compliance in the context of agentic AI.
Retailers should note that agentic AI interactions are likely to generate new categories of data, such as agent behavioural patterns and delegated preference profiles, which may constitute personal data under the UK General Data Protection Regulation. Consideration should be given to how consent mechanisms operate when an agent acts on behalf of a consumer and whether profiling obligations are triggered.
In a speech at an event in September, chief executive of the DRCF Kate Jones stressed that “AI autonomy does not remove organisational responsibility” and that UK regulators “are clear that existing obligations around transparency, fairness, safety, consumer protection and competition continue to apply”. She said directors in “every boardroom” should be asking who in their organisation is accountable for AI, why people should trust the technology, and whether the organisation has the capability to oversee and challenge its use.
A one-off policy update is not sufficient. Governance in this space is an ongoing institutional capability. Retailers need a structured review cadence built in from the outset of their AI projects.
Third-party AI risk management
The FSB focuses on the need to manage third-party AI dependencies. It flagged how there is the risk that third-party AI systems fail to perform as expected, that there is a lack of transparency over how those systems operate, including over the data they process, as well as over the quality of data the systems have been trained on. Use of third-party systems can also pose more systemic risks where there is over-reliance on one, or a small number, of service providers, and requires thought to be given to business continuity planning to account for the risk of outages, it said.
These risks clearly need to be managed in the context of consumer-facing AI agents retailers operate themselves, but retailers must also factor how they address third-party technology which relies on agents, such as that operated by payment service providers or for fraud screening. There could be a contractual gap if standard merchant agreements do not address AI-related service failures.
For example, retailers should give thought to whether they have access to recourse if an AI-enabled fraud screening tool wrongly declines a legitimate agent-initiated transaction, or if an AI-driven chargeback assessment reaches an incorrect conclusion. Retailers should also be asking payment service providers directly how they are implementing the FSB standards and what the merchant-facing implications are.
Retailers should also consider the consumer-facing implications. Where an AI agent makes a purchase that does not reflect the consumer's actual intention, questions will arise as to who bears responsibility; returns policies, refund processes, and terms and conditions may all need updating to account for agent-initiated transactions.
Proactive engagement here will result in better contractual and operational positioning for retailers. Retailers should review whether their existing commercial insurance policies, such as professional indemnity or cyber insurance, adequately cover losses arising from agentic AI failures, whether from their own systems or those of third-party providers.
In its guidance, the FSB suggests AI performance evaluation should be proportionate to materiality and risk and that human oversight should be calibrated to reflect the degree of autonomy and complexity in how agentic AI tools operate.
Retailers should ask themselves whether they feel they would be able to detect when something is going wrong with agent-initiated transactions. Traditional payment monitoring, such as conversion rates, declines, and chargebacks, will not reflect signs of agentic anomalies, such as spikes in agent-initiated returns, unusual high-value purchase patterns from a single agent identity, or clusters of disputes citing agent misinterpretation of product information.
Effective human oversight doesn’t need to mean that every transaction should be reviewed. However, retailers should have defined pathways for issues identified to be escalated, clear internal accountability for agentic commerce risks, and both a technical and contractual ability to pause or flag anomalous agent behaviour such as ‘kill switches’. Retailers should also ensure their systems are capable of maintaining comprehensive audit trails for agent-initiated transactions: such records will be essential for regulatory compliance, dispute resolution, and internal performance monitoring.
Governance as a strategy
There is a tendency to frame agentic commerce challenges purely as compliance problems, but the FSB standards should invite retailers to give this issue a different framing.
Retailers that build robust governance frameworks will be better placed to capture the commercial opportunity, not just manage the risk. For example, thinking about agent-friendly flows at the checkout stage, with embedded security, should result in higher sales conversion rates. Conversely, poorly designed flows will mean failed payments and lost sales.
Similarly, fraud systems should be set up to avoid legitimate agent activity being flagged as suspicious, as this could mean lost sales to competitors where their systems are better calibrated.
Ensuring product data information is of a high quality to be visible to AI tools is also essential as AI agents can only discover and evaluate products accurately if data is well-governed and accessible to the agent. Poor data governance will mean commercial disadvantage in the world of agent-driven search.
Retailers should also be mindful that as agentic commerce grows, there is a risk of creating a two-tier customer experience that disadvantages consumers who do not use AI tools. The implications under consumer protection and equality frameworks should be considered, particularly in respect of older or less digitally engaged demographics.
The success Amazon has reported in operating its agentic AI shopping assistant 'Rufus' – it said Rufus contributed to nearly $12 billion worth of annualised sales from 2025 and has been used by more than 300 million customers – reflects deliberate governance, data, and operational investment, not just technology. While smaller retailers cannot replicate Amazon's scale, they can apply the same strategic logic: governance investment now will result in a competitive advantage as agentic commerce grows.
Policymakers and regulators are still building their own understanding of agentic AI and how tools are being operated in the market, but the rules, guidance and standards that will govern how the technology is used in the context of agentic commerce in future are being written now.
As well as the prospect of a new framework for agentic finance and updated payment services regulations, retailers can expect new technical standards for agent identity and delegated authorisation within the next 18 months and should anticipate that the CMA’s engagement on agentic commerce matters could lead to its intervention on issues such as price transparency and algorithmic pricing as well as having broad competitive implications for agent ecosystems. For retailers, there is a risk that dominant AI agent platforms could act as gatekeepers, steering consumers towards preferred retailers or products. Ensuring commercial agreements with agent platform providers contain adequate protections is therefore essential.
As policymakers and regulators grapple with the issues and seek industry input on shaping new frameworks, retailers should take the opportunity to have their say as and when consultation exercises are opened.
On governance, action now can confer a competitive advantage later. Retailers should:
The FSB's 12 standards carry a clear message for retailers: agentic AI governance is not optional and is not solely a payments industry problem. The retailers best positioned to benefit commercially will be those who treat governance as strategic investment. What the FSB framework adds, beyond the operational risk picture, is a governance architecture that retailers can adapt and apply now. Action now is recommended before sector-specific regulation arrives and before disputes force retailers to consider the questions that preparation would have anticipated.
Written by
