Agentic commerce: can the law of contract adapt?

Agentic commerce involves autonomous AI agents negotiating and agreeing deals with little or no human supervision. Your AI agent might not only suggest the best time to visit the Dolomites, but also book airfares, hotels and car rentals based on your preferences – gleaned from your emails, browsing and previous holiday bookings and pay using your stored credentials.

Fundamental to agentic commerce is AI’s capacity to bind human users to contracts, often without those users knowing or approving the terms. As the Stanford academic Lauren H. Scholz puts it, “[i]t is contracts that give algorithms the power to change our world”.

An impending tsunami?

Some of the key developments in agentic commerce this year are:

• Mastercard and Visa released token-based platforms that let AI agents transact safely on behalf of consumers.

• OpenAI’s Agent Commerce Protocol and Anthropic’s Model Context Protocol enable AI-to-AI negotiation between buyers, sellers and businesses to complete a purchase.

• Google’s Agent2Agent connects 50 technology partners including Atlassian, Salesforce and PayPal “will allow AI agents to communicate with each other, securely exchange information, and coordinate actions on top of various enterprise platforms or applications”.

• Manus, an agent released by Chinese developer Butterfly, shocked Silicon Valley (a second DeepSeek moment?) with its sophisticated autonomy, outperforming OpenAI and other US apps.

McKinsey estimates that by 2030, the US B2C retail market alone could see up to USD1 trillion in orchestrated revenue from agentic commerce, with global projections reaching as high as USD3–5 trillion.

What can go wrong

A US user recently convinced a General Motors dealer’s chatbot to sell him a new car for a dollar. After telling the bot that every other offer was irrevocable, he made a $1 offer which the chatbot accepted.

Agentic AI can be just as risky for consumers. A recent study using agentic AI to search online for a mobile phone for the best price found that:

• 10% of the time, agents purchased phones at substantially higher prices than the user’s maximum budget; when a mid-range budget was set, that ‘disobedience’ rose toward 20%.

• Buyer agents routinely disclosed private budget limits despite instructions not to.

• Some paid above retail price, even when they ‘knew’ the true price.

Why agentic AI challenges traditional principles of contract law

Contract law requires that each party must have the intention to be bound to a set of specific terms.  In the past, the law has successfully adapted that requirement to machines, but is autonomous AI different?

Working from left to right in the above diagram:

• When you drive up to a parking machine, there is only one human immediately involved in the transaction and a machine on the other side. However, on the seller side, the terms and conditions were preset by a legal person and the machine (or the sign next to the machine) communicates those terms and you accept by dropping in the coins or tapping your card.

• Electronic transaction laws were introduced to allow contracts, including signatures, to take electronic form. However, humans were sitting behind the screens pushing the enter buttons to signify intent to contract.

• Dynamic pricing, such as airline ticket pricing, involves a human buyer on one side of the transaction and an algorithm on the other side setting the price. Although the seller may not know the exact price at the time of sale, the seller can be said to still ‘intend’ the price because the seller programmed the algorithm (that is, the algorithm is ‘deterministic’).

• Algorithmic trading, which now accounts for a substantial volume of share trading, involves algorithms on both sides of the transaction, with deals being struck at prices about which neither the seller nor the buyer have knowledge at the time of sale. Again, as the algorithms are deterministic, the human buyers and sellers can be said to have the requisite contracting intention, even though they do not know the terms in real time.

• The next step is having an autonomous AI on one or both sides of the transaction which sets the terms applying its own ‘judgement’ (that is, not a deterministic algorithm). Does this stretch too far the attribution of intention to the human user? As LH Scholz puts it, “if the instructions given to an algorithmic-agent by its principal are vague, they cannot be considered the level of objectively manifested intent necessary to ground a contractual promise”.

Tool or independent agent?

Machine actions can be readily attributed to human users when the machine can be characterised as a mere tool. Two recent cases illustrate the challenge in treating AI as a tool (as earlier computer software is treated) when AI gains more autonomy.

In a Singaporean case, Quoine operated a trading platform for bitcoin. Due to a technical problem, the platform was temporarily unable to access external market data about the prices of bitcoin. B2C2 was a trader on the platform and its algorithm began offering to buy bitcoin at a preprogrammed fallback price. Separately, the falling price on the platform triggered margin calls on other traders’ accounts, and their algorithms sold ‘at the best available price on the platform’, which happened to be B2C2’s backup price. As a result, B2C2 bought millions of dollars’ worth of bitcoin at a rate 250 times the market rate.

When Quoine discovered the trades, it purported to cancel the contracts on the basis of the contractual principle of mistake. Quoine argued that if the trades had been undertaken by human agents, they would have realised the mistaken price and the contracts would be void. By analogy, Quione argued that the algorithms should be treated as a ‘legal agent’ and their ‘knowledge’ of the mistaken price should be attributed back to their human users.

However, the Singapore courts held that since the programs in question were ‘deterministic’ and ‘do not have a mind of their own,’ the court should treat them as ‘mere machines.’ The relevant knowledge was that of the programmer and the algorithms behaved in the exact manner they were programmed to behave.

In Moffat vs. Air Canada, the airline’s chatbot incorrectly informed customers that they could apply for a discounted bereavement fare within 90 days of ticket purchase, whereas the airline’s terms provided for no retrospective refund. Air Canada argued that the chatbot was "a separate legal entity ... responsible for its own actions”. The Tribunal characterised the chatbot as a tool, describing it as "an interactive component" of Air Canada's website.

In both cases, the defendant argued that the agent was more than a tool, although to opposite ends: in Quoine’s case, so that the agent’s knowledge could be imputed to the human user, and in Air Canada’s case, to escape liability by saying “it wasn’t me”.

How to adapt contract law to agentic commerce

Broadly, there are two potential avenues to address when to legally attribute the actions of AI to humans when the AI has more autonomy than a mere tool.

First, developers and users call autonomous AI ‘agents’ so why not apply the law of agency by which an agent, through actual or ostensible (apparent) authority, can bind a principal. Agency shifts the inquiry about the ‘intention to contract’ away from the principal and towards the AI agent. We don’t need to resolve whether AI has subjective intentions, motivations or thoughts because, under existing contract law principles, intention is largely determined objectively from words and acts. As there will be a digital record of the interaction between AI agents, arguably it could be easier to establish the intention to contract between AI agents than in the messier world of communications between humans.

However, agency law requires that the agent be a legal person. The law has granted legal personality to non-humans – companies – so why not autonomous AI? Some commentators have argued that granting legal personality to autonomous AI would be a means of accountability and "promote the regulation of behaviour".

However, Canadian commentator Mortimer argues that treating artificial general intelligence (AGI) systems as legal entities could reduce accountability of corporate actors and the rights of consumers as corporations ‘scapegoat’ AGI systems. More broadly, he adds that:

Mortimer and Scholz argue that autonomous AI could be treated as constructive agents or sui generis agents only for the limited purposes of contract formation. Scholz argues:

The second potential solution is to treat the deployment of the autonomous AI as an ‘open offer’ by the human user – for example, “I will sell to anyone at whatever price my agent negotiates”. The terms may not be definite or known, but the intention to be bound is. A proponent of this approach, Oliver argues that those proposing an agency approach are, in effect, overthinking the intention issue:

Oliver argues this approach avoids the “thorniest problems of AI”:

How far should humans be held liable for agents?

AI doesn’t always obey. It hallucinates, misleads or even deceives to bypass guardrails. Whether applying the agency or open-offer approaches, the underlying question is whether humans should be treated as giving their AI agents a ‘blank cheque’ and holding them responsible for whatever the agent negotiates.

The UN Commission on International Trade Law (UNCITRAL) in its Model Law on Automated Contracting provides that a deploying party should not be liable for AI’s actions if the deploying party could not reasonably have expected the action and the other party knew or reasonably ought to know that the party would not expect the action. This approach steps around the whole issue of whether AI as an agent has ‘intention’ while drawing some boundaries around what actions of an AI agent can be attributed to the human user.

However, ‘reasonableness’ is an uncertain standard, even more so with AI given that it can be a ‘black box’ and the unexpected is to be expected of AI.

Conclusion

The Australian Treasury recently released a paper concluding that Australia’s principles-based consumer protection laws make an AI-specific statute unnecessary. However, it noted that agentic AI may require this position to be revisited.

While the Treasury paper may be correct so far as gaps in current legal protections go, including even for agentic AI, there is a much larger question of how to facilitate agentic commerce. In the past, many jurisdictions introduced legal frameworks to promote online contracting. Do we now need to build a more proactive legal framework for agentic commerce?