📊 Full opportunity report: The rails. Why European agentic commerce is co-defined by two converging regimes. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European agentic commerce is being co-defined by two regulatory regimes — PSD3/PSR and the AI Act — which together shape the legal and technical frameworks for AI-enabled payments and decision-making. This convergence impacts speed, control, and durability of future payment systems.
European law currently prevents AI agents from directly paying for goods or services, as payment authorization requires human approval under existing regulations. This legal gap is being addressed through two major regulatory regimes: PSD3/PSR, which rebuilds the payment infrastructure, and the AI Act, which introduces high-risk obligations for AI systems involved in finance. The convergence of these regimes is shaping the future of agentic commerce in Europe.
The core issue is that, unlike in the US where private infrastructure like Mastercard’s Agent Pay or Visa’s Intelligent Commerce enables AI-driven payments, Europe’s payment system is governed by statutory regulations. PSD2’s Strong Customer Authentication (SCA) mandates multi-factor human authentication, preventing AI from acting as a payer without explicit legal authority. The upcoming PSD3 and Payment Services Regulation (PSR), scheduled for implementation around 2028, aim to overhaul the payment rails with API parity, requiring banks to expose interfaces as capable as their consumer apps, and to facilitate direct access for nonbank entities. Simultaneously, the EU’s AI Act, set to impose high-risk obligations on AI systems involved in credit scoring, fraud detection, and other financial decision-making, will enforce conformity assessments, human oversight, and registration requirements starting in 2026. These two regimes were not designed together, creating a fragmented legal environment where the capabilities of AI agents are limited not by technology but by the legal architecture they operate within. This dual regulation means that the European agentic commerce stack is being co-defined by statutory rules, not commercial infrastructure. The process is slower than the US, where private firms can extend payment rails at will, but the resulting system is more durable, with open APIs and data sharing built into law, reducing control by any single entity and fostering a more open ecosystem.The rails.
Why European agentic
commerce is co-defined by
two converging regimes.
SCA needs a human payer
first-class third-party interfaces
(Omnibus may slip it to 2027)
the clock agentic commerce runs on
choose the best deal — capability is here
authentication
required
as the equivalent of a human payer
- Mastercard Agent Pay, Visa Intelligent Commerce, Plaid
- The rail’s owner sets the rule — extend to agents by product decision
- Fast — moves at product speed
- Concentrated — a few firms control access
- PSD2/PSD3, PSR, SCA, FIDA
- The legislature sets the rule — no network can grant payer status
- Slow — moves at legislative speed
- Open — mandatory API parity, public data substrate
within
limits
Europe is betting that durable, open, publicly-owned rails produce a better agentic-commerce market than fast, concentrated, privately-owned ones — even at the cost of arriving later. Which foundation an agent economy actually prefers is the genuine open question.Thorsten Meyer · The Rails · Agentic Commerce 04
Implications of Dual Regulatory Frameworks on European AI Payments
This convergence of regulatory regimes signifies a deliberate, long-term approach to building a resilient, open, and legally clear infrastructure for AI-driven finance in Europe. While the pace is slower, the resulting system offers greater transparency, interoperability, and security, potentially setting a global standard for agentic commerce. It also means that European AI agents will face legal constraints that could delay their deployment compared to the US, but may ultimately lead to a more stable and trustworthy market environment.
AI payment authorization devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Regulatory Evolution and Its Impact on Agentic Commerce
The European Union has been progressively regulating digital finance, with PSD2 establishing multi-factor authentication and open banking, and now moving toward PSD3/PSR to modernize the payment infrastructure. The AI Act, agreed upon in November 2025, aims to regulate high-risk AI applications, including those in finance, with strict compliance and oversight requirements. These developments are part of a broader effort to create a unified, legally grounded digital economy that balances innovation with consumer protection.
Prior to this, the US adopted a different approach, relying on private sector-led infrastructure like Mastercard’s Agent Pay and Visa’s Intelligent Commerce, which allow faster deployment of AI payment agents but lack the same level of statutory security and openness. The European approach emphasizes legal clarity and open access, which influences the pace and nature of AI’s role in commerce.
“European agentic commerce is not a product the labs ship onto existing rails; it is a system being co-defined by two converging regulatory regimes.”
— Thorsten Meyer
European payment API integration tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Uncertainties Surrounding Implementation Timelines and Effectiveness
While the regulations are set to be implemented between 2026 and 2028, the exact timelines, final scope, and practical effects remain uncertain. Delays in legislative processes, technical challenges in compliance, and how effectively the regimes will integrate are still developing issues. It is also unclear how quickly market participants will adapt to these new statutory constraints and whether the systems will be fully operational by the projected dates.
Yubico – Security Key C NFC – Basic Compatibility – Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified (Pack of 2)
The information below is per-pack only
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in Regulatory Rollout and Market Adaptation
Regulators will finalize and implement the PSD3/PSR regulations, with expected publication in summer 2026 and phased rollout through 2028. Concurrently, the AI Act’s high-risk obligations will begin to take effect, requiring conformity assessments and oversight. Market participants, including banks, fintechs, and AI developers, will need to adapt their systems to comply with the new legal architecture. Monitoring how these frameworks interact in practice will be critical over the coming years.
AI compliance assessment software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How does the European approach to AI payments differ from the US?
Europe relies on statutory regulations like PSD3/PSR and the AI Act to build a legal infrastructure, making AI payments slower but more durable and open. The US depends on private infrastructure like Mastercard and Visa, enabling faster deployment but with less legal transparency and control.
When will AI agents in Europe be able to pay directly for goods and services?
It is uncertain; the legal frameworks required for AI agents to act as payers are still being finalized. Payment authorization depends on the implementation of PSD3/PSR, expected around 2028, and the AI Act, with high-risk obligations starting in 2026.
What are the advantages of Europe’s statutory rails?
Statutory rails offer transparency, open access, and security, reducing control by any single entity and fostering an open, interoperable ecosystem that can be more resilient over time.
Will the slower regulatory process hinder innovation in Europe?
While the pace is slower, the durable and transparent infrastructure could lead to more sustainable innovation, though short-term deployment of AI agents may lag behind the US.
Source: ThorstenMeyerAI.com
