Reference note

Disputes and liability for AI-agent purchases

What signed mandates prove, what they do not assign, and the evidence a merchant should retain while liability rules are still settling.

Published 10 August 2026 . Part of AP2, the agentic payments protocol.

A customer disputes a purchase, claiming they never asked for that product. The agent did receive an instruction and executed it within the limits it was given. Who bears the cost?

The question looks legal. It is architectural first, because it mixes two layers that share neither purpose nor pace of change: proof of authorisation, and allocation of liability.

Two layers not to conflate

Proof of authorisation is a technical problem, and it is on its way to being solved. AP2 addresses it with signed mandates, carried as W3C Verifiable Credentials: an intent mandate that sets scope and constraints, a cart mandate that freezes items and amount, a payment mandate on the network leg. The guiding principle Google states is verifiable intent rather than inferred action, precisely to address the risk of agent error or hallucination.

Allocation of liability is a rules problem, and it is not solved. No protocol decides who absorbs a dispute. That decision belongs to card network rules, acquiring contracts and applicable consumer law. Vendors specialising in dispute management converge today on a simple observation: there is no rule saying “if an AI agent made the purchase, the agent provider is liable”, and in practice the cost keeps rolling down to the merchant.

Conflating the two layers produces an expensive planning error: believing that implementing AP2 shifts the risk. A signed mandate improves the quality of the evidence. It does not rewrite the rule that decides who pays.

What the protocol does lock down

Two design elements are worth noting, because they genuinely reduce the dispute surface.

The cart mandate freezes the exact items and price and binds them to the original intent. The classic “this is not what I ordered” dispute loses its factual basis: there is a signed record of what was approved.

On the UCP side, the framing points the same way. Reference implementations note that the specification pushes for a manifest to represent exactly one merchant, precisely to keep liability and ownership clearly attributed. That constraint is worth knowing before designing a marketplace architecture: sharing one manifest across several sellers works against the model.

Governance in progress

Standardisation does not stop at the initial release. AP2 has been donated to the FIDO Alliance, with continued work announced inside working groups dedicated to agentic authentication and payments. For a committee arbitrating a roadmap, that means the authorisation layer is set to stabilise in a multi-party forum, while liability rules remain with the networks and regulators.

Put plainly, the two layers will not move at the same pace. Conditioning a rollout on the second one settling would be imprudent.

What a merchant should retain now

Without waiting for the rules to clarify, the defensible position is to build an evidence file you can actually use. Concretely, for every agent-initiated transaction:

the agent’s declared identity and the channel used, knowing that this declaration is not cryptographically verifiable end to end in the current state of the ecosystem, a point developed in the note on agent traffic;
the mandates received and their signatures, kept in replayable form, not merely logged as text;
the outcome of capability negotiation, which evidences the conditions both parties actually accepted, see the note on the UCP manifest;
the payment processing specification declared at the time of the transaction, not the current version of the manifest, see the note on payment handlers.

That last point is the one most often missed. A manifest evolves; a dispute arrives weeks later. If you cannot tell which version was being served at the time, your file rests on a reconstruction.

Three questions for internal arbitration

Can we replay a three-month-old agent transaction, mandates and negotiation included?
Do our terms and conditions address agent-initiated purchases, or do they assume a human buyer on the site?
Does our acquiring contract say anything about the agentic channel, or does it default to treating it as a card-not-present transaction?

None of these three is resolved by the protocol. All three arise on the day of the first dispute.

For the mandates themselves, see AP2. For the network-side rails, see Visa and Mastercard.

Sources

Back to AP2, the agentic payments protocol · All notes · Lire en français