📊 Full opportunity report: The rails. Why European agentic commerce is co-defined by two converging regimes. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European agentic commerce is being shaped by two converging regulatory regimes—PSD3/PSR and the AI Act—resulting in a statutory infrastructure that influences how AI agents can operate and pay. This contrasts with the US’s commercial rails approach.
European law is currently shaping the future of agentic commerce through the simultaneous development of two major regulatory regimes: PSD3/Payment Services Regulation and the EU AI Act. These frameworks are establishing the legal infrastructure that will determine whether AI agents can perform payments and other financial tasks in Europe, a process that is still underway and will influence the pace and nature of market development.
The core issue is that, unlike in the US where private payment networks facilitate agent payments, Europe’s payment infrastructure is statutory, requiring human authorization for transactions under PSD2 and upcoming PSD3/PSR reforms. These reforms, agreed in November 2025 and expected to be implemented by 2028, mandate API parity and open finance principles, making the payment rails more open and regulated.
Simultaneously, the EU AI Act, with high-risk obligations set to land in 2026, classifies AI systems used in finance—such as credit scoring and fraud detection—as high-risk. These systems will face conformity assessments, human oversight, and registration requirements. The convergence of these two regimes—one rebuilding payment infrastructure, the other regulating AI—creates a complex, fragmented legal environment that will define what agentic commerce can do in Europe.
This regulatory environment is not a technological gap but a legal one. An AI agent’s ability to pay, assess, or recommend depends on whether the legal framework permits it, which is still being established. The timelines differ: PSD3/PSR’s full implementation is expected around 2028, while the AI Act’s high-risk obligations could be in place by 2027, depending on legislative progress.
The rails.
Why European agentic
commerce is co-defined by
two converging regimes.
SCA needs a human payer
first-class third-party interfaces
(Omnibus may slip it to 2027)
the clock agentic commerce runs on
choose the best deal — capability is here
authentication
required
as the equivalent of a human payer
- Mastercard Agent Pay, Visa Intelligent Commerce, Plaid
- The rail’s owner sets the rule — extend to agents by product decision
- Fast — moves at product speed
- Concentrated — a few firms control access
- PSD2/PSD3, PSR, SCA, FIDA
- The legislature sets the rule — no network can grant payer status
- Slow — moves at legislative speed
- Open — mandatory API parity, public data substrate
within
limits
Europe is betting that durable, open, publicly-owned rails produce a better agentic-commerce market than fast, concentrated, privately-owned ones — even at the cost of arriving later. Which foundation an agent economy actually prefers is the genuine open question.Thorsten Meyer · The Rails · Agentic Commerce 04
Implications of Dual Regulatory Frameworks for European Agents
This convergence means European agentic commerce will develop more slowly than in the US but will be built on a more durable, open legal foundation. The statutory rails—mandated API access, open finance—are not controlled by any single private entity, making the infrastructure more resilient and equitable. However, the fragmented timelines and regulatory complexity may delay the deployment of fully autonomous or payment-capable AI agents in Europe, affecting competitiveness and innovation.
Ultimately, Europe’s approach emphasizes deliberate, law-based infrastructure over rapid deployment, potentially leading to a more stable but slower market. The contrasting foundations—private commercial rails in the US versus statutory, regulated rails in Europe—raise questions about which system will better support scalable, trustworthy agentic commerce in the long term.
European open banking API integration tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Regulatory Shift and Its Impact on Agentic Payments
In recent years, Europe has been moving toward a more regulated framework for digital payments and AI systems. The PSD2 directive, introduced in 2018, already mandated strong customer authentication, limiting automation of payments. The upcoming PSD3 and Payment Services Regulation (PSR), agreed in November 2025, aim to overhaul the payment infrastructure with API parity, direct access for nonbanks, and open finance principles.
Simultaneously, the EU AI Act, finalized in late 2025, classifies high-risk AI systems—such as those used in credit scoring and fraud detection—as subject to strict oversight, including conformity assessments and human oversight. These regulations are not designed together but are converging in time, shaping a unique legal environment for AI-driven financial services in Europe.
This dual development contrasts sharply with the US, where private firms like Mastercard and Visa build proprietary payment rails that can extend to AI agents by decision, creating a faster, more concentrated ecosystem.
“European agentic commerce is being co-defined by two regulatory regimes—PSD3/PSR rebuilding the payment rails and the AI Act installing high-risk guardrails—creating a complex, statutory infrastructure.”
— Thorsten Meyer
Build Financial Software with Generative AI (From Scratch)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Uncertainties Around Implementation and Market Impact
It remains unclear how quickly the new regulations will be fully implemented and how they will interact in practice. The exact timeline for AI high-risk obligations and their enforcement is still uncertain, with some legislative processes possibly slipping into 2027 or later. Furthermore, how these frameworks will influence actual market behavior and innovation remains to be seen, especially regarding the pace of AI agent deployment and payment capabilities in Europe.
3 Pack Surcharge Fee Payment Sign – 3% Fee, Credit Card Logos, Contactless Icon, No Fee For Cash Or Debit, Business Payment Signs Service and Retail
CLEAR PAYMENT NOTICE: Clearly informs customers of a 3% credit card surcharge while noting no fee for cash…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in European Agentic Regulatory Development
Regulatory agencies will continue to finalize and implement PSD3/PSR by 2028, with ongoing trilogues and legislative adjustments. The AI Act’s high-risk obligations are expected to be enforced starting in 2026, but delays are possible. Market participants and developers are closely watching these timelines, preparing for compliance and integration efforts. The first real-world tests of agentic commerce under these regimes are likely to occur in the next 12-24 months, providing clearer signals on how the legal architecture influences innovation.
AI-Powered Software Audits: Revolutionizing Audit, Compliance, Risk, Security, and Governance for Organizations: Harnessing AI to Automate Compliance, and Strengthen Governance in the Digital era
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How will the EU’s regulatory approach affect AI agents’ ability to make payments?
AI agents in Europe will need to operate within the new legal framework established by PSD3/PSR and the AI Act, which will require compliance with API standards, human oversight, and high-risk classification. Whether an agent can pay depends on regulatory approval and the legal recognition of the agent as a payer, which is still being defined.
How does Europe’s approach differ from the US in developing agentic commerce?
Europe relies on statutory, regulation-driven payment rails that are designed to be open and resilient, whereas the US depends on private, commercial rails controlled by firms like Mastercard and Visa, which can extend or restrict access based on decision-making. This leads to slower but potentially more durable infrastructure in Europe.
When will we see fully operational AI agents capable of payments in Europe?
Full operational capability depends on the finalization and enforcement of PSD3/PSR by 2028 and the AI Act’s high-risk obligations, which could be in place by 2027. Market deployment will likely follow regulatory compliance, which may take several years after legislation is enacted.
Source: ThorstenMeyerAI.com
