📊 Full opportunity report: The rails. Why European agentic commerce is co-defined by two converging regimes. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European agentic commerce is being shaped by two regulatory regimes—PSD3/PSR and the AI Act—that are being developed simultaneously, creating a unique, statutory infrastructure that differs from the US model. This convergence impacts how AI agents can operate in payment and decision-making functions.
European law is currently shaping the future of agentic commerce by simultaneously developing two major regulatory regimes—PSD3/PSR and the AI Act—that will define how AI-powered agents can operate within payment and decision-making systems. This convergence creates a complex, statutorily driven infrastructure that differs fundamentally from the US approach, where private networks and commercial rails dominate.
The core issue is that, in Europe, an AI agent’s ability to pay or authorize transactions is not just a technological question but a legal one. Under current law, AI cannot act as a payer because European regulations require human authorization for online payments. PSD2’s Strong Customer Authentication mandates multi-factor human verification, and this remains a barrier for AI agents to execute payments directly. Meanwhile, the upcoming PSD3 and Payment Services Regulation (PSR), scheduled for implementation around 2028, will rebuild payment infrastructure with mandatory API parity, requiring banks to expose interfaces as capable as their own apps, but these changes are still in progress. Simultaneously, the EU AI Act, expected to take effect in 2026, classifies AI systems involved in high-risk financial activities—such as credit scoring and fraud detection—as high-risk, requiring conformity assessments, human oversight, and registration. These two regimes, developed independently, are converging in the same timeframe, creating a layered, fragmented regulatory environment that governs the entire agentic finance ecosystem. The result is that the legal authority, rather than technological capability, will determine whether an AI can pay, assess, or recommend in Europe, with different timelines and authorities overseeing each regime.This structural divergence from the US, where private firms operate on commercial rails that can be extended by decision, means European agentic commerce will be slower to develop but potentially more durable. The open finance mandates and API parity requirements could lead to a more resilient, inclusive system, but the complexity and statutory nature of the regulations introduce significant delays and uncertainties.
The rails.
Why European agentic
commerce is co-defined by
two converging regimes.
SCA needs a human payer
first-class third-party interfaces
(Omnibus may slip it to 2027)
the clock agentic commerce runs on
choose the best deal — capability is here
authentication
required
as the equivalent of a human payer
- Mastercard Agent Pay, Visa Intelligent Commerce, Plaid
- The rail’s owner sets the rule — extend to agents by product decision
- Fast — moves at product speed
- Concentrated — a few firms control access
- PSD2/PSD3, PSR, SCA, FIDA
- The legislature sets the rule — no network can grant payer status
- Slow — moves at legislative speed
- Open — mandatory API parity, public data substrate
within
limits
Europe is betting that durable, open, publicly-owned rails produce a better agentic-commerce market than fast, concentrated, privately-owned ones — even at the cost of arriving later. Which foundation an agent economy actually prefers is the genuine open question.Thorsten Meyer · The Rails · Agentic Commerce 04
Implications of Statutory vs. Commercial Payment Infrastructure
This convergence of regulatory regimes means that European agentic commerce will be shaped more by law than by technological innovation. The statutory nature of the rails—mandated API access, open finance, and high-risk AI oversight—creates a foundation that is less controllable by any single entity but more durable against monopolization. This could result in a more open, equitable market in the long term, but at the cost of slower development and potential delays in deploying agentic payment capabilities.
For businesses and consumers, this means that European AI agents may lag behind their US counterparts in payment execution but could benefit from a more transparent and regulated environment that prioritizes security and oversight. The broader impact is a fundamental difference in how agentic commerce will evolve on each continent, with Europe emphasizing legal robustness over speed.
European AI payment regulation compliance tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Regulatory Frameworks for Payment and AI
The European Union has been steadily building a comprehensive regulatory framework for digital finance and AI. PSD2, enacted in 2018, introduced Strong Customer Authentication, requiring human verification for online payments. Building on this, PSD3 and the Payment Services Regulation (PSR), expected to be implemented around 2028, aim to overhaul payment infrastructure with mandatory API interfaces, fostering open banking and data sharing.
Concurrently, the EU AI Act, agreed upon in November 2025 and scheduled for implementation in 2026, categorizes certain AI systems as high-risk, imposing conformity assessments, human oversight, and registration requirements. These two regimes are being developed independently but are set to influence each other, creating a layered regulatory environment that will govern AI agents’ capabilities in Europe.
Unlike the US, where private firms like Mastercard and Visa operate private payment rails that can be extended or modified at will, Europe’s approach is statutory, requiring legislative action for changes. This difference underpins the contrasting speeds and structures of agentic commerce development on each continent.
“The core issue is that, in Europe, an AI agent’s ability to pay or authorize transactions is not just a technological question but a legal one.”
— Thorsten Meyer
API integration tools for financial institutions
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Implementation Timelines
The exact timelines for the full implementation of PSD3/PSR and the AI Act remain uncertain, with PSD3 expected around 2028 and the AI Act possibly slipping into 2027 or later. It is also unclear how effectively these regimes will integrate in practice, and whether legal barriers will delay or restrict AI agents’ payment capabilities in Europe.
Additionally, the precise mechanisms through which AI systems will be registered, overseen, and authorized under these regimes are still being defined, leaving some ambiguity about operational details.
Yubico – YubiKey 5C NFC – Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified – Protect Your Online Accounts
POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in European Agentic Commerce Regulation
Regulatory agencies and lawmakers will continue to finalize the details of PSD3/PSR and the AI Act, with formal adoption and implementation expected over the next two years. Industry stakeholders are closely monitoring these developments to adapt their AI and payment strategies accordingly. The first wave of compliant AI agents is likely to emerge post-2026, once the regulations are in effect and fully clarified.
Further, ongoing discussions about interoperability, enforcement, and cross-border compatibility will shape the evolution of Europe’s agentic commerce infrastructure, influencing global standards and competitive positioning.
AI high-risk financial activity monitoring software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How does Europe’s regulatory approach differ from the US in developing agentic commerce?
Europe relies on statutory, regulation-driven infrastructure like PSD3/PSR and the AI Act, which are developed through legislative processes, making development slower but potentially more durable. In contrast, the US uses private, commercial rails controlled by firms like Mastercard and Visa, allowing faster, decision-based extensions.
Will AI agents in Europe be able to pay directly for transactions soon?
Not immediately. Under current law, AI agents cannot act as payers without human authorization. The upcoming regulations aim to change this, but full implementation is still pending, likely around 2028 or later.
What are the risks of Europe’s layered regulatory environment for AI and payments?
The complexity and different timelines may delay deployment of AI payment agents and create operational uncertainties. However, this layered approach could also lead to a more secure and transparent system in the long term.
How might this regulatory convergence impact global AI payment markets?
Europe’s approach could set a precedent for more durable, regulation-based infrastructure, influencing international standards and encouraging similar statutory frameworks elsewhere, though it may also slow innovation compared to faster, private-sector-driven models.
Source: ThorstenMeyerAI.com
