Agentic AI and Consumer Protection

Is EU Consumer Law Ready for AI Agents?

Online shopping is entering a new phase. Consumers already use AI tools to discover products and compare offers, but the more fundamental change is agentic AI: systems that do not only recommend, but act. AI agents may book a flight or switch energy supplier on the consumer’s behalf. Some estimates suggest that between 10% and 20% of e-commerce transactions could be handled by an AI agent by 2030.

This new CERRE paper by Christoph Busch asks whether EU consumer law is ready for this development. The paper spells out an implicit assumption of EU consumer law: that the person making the purchasing decision is a human being. Once an AI agent sits between consumer and trader, this assumption of consumer protection law no longer applies.

Where the framework comes under strain

Disclosure rules were built around the limits of human attention, limits that agents do not share. Consent is harder still: EU law requires consumers to explicitly acknowledge a payment obligation, and whether an agent can do so on the consumer’s behalf remains unresolved. More broadly, many consumer protection requirements presuppose a human interacting via a screen; as agents transact directly through APIs, compliance with these rules becomes not merely difficult but structurally impossible.

Several risks are specific to the agentic setting. For example, an agent operated by a merchant may have an inherent incentive to steer purchasing decisions to its own products – and its preferencing may be opaque to the consumer. Agents can also be manipulated themselves, for example through ‘prompt injection’ attacks. EU law protects consumers from dark patterns; it offers no equivalent protection for the agents acting on their behalf.

Liability is where these questions converge. When an agent buys the wrong product or authorises a payment it should not have, existing rules say little about how the risk should fall between consumer, agent provider and trader. Nor will the answer come from consumer law alone, intersecting as it does with contract law, the AI Act and product liability rules. Without a clear liability architecture, the paper warns, consumers have little reason to trust delegated decision-making, and providers little incentive to offer it.

Policy directions

The Digital Fairness Act, expected in the third quarter of 2026, offers the opportunity to respond. The paper sets out three priorities.

Settle the foundations: policy-makers must clarify the validity of contracts concluded through AI agents, and explain how consumer law applies to agentic transactions. Until this is resolved, businesses cannot confidently build agentic models and consumers have little reason to trust them.

Move from compliance by design to compliance by protocol: firms should embed information duties, consent and redress into the technical protocols that structure agentic commerce. This would make compliance largely self-enforcing.

Differentiate and keep rules proportionate: an agent whose decisions must be confirmed by the consumer at every step is not the same as one transacting autonomously. Nor is a marketplace-embedded agent the same as an independent one or an agent built into an operating system: each raises distinct concerns. Rules should be proportionate and risk-based so as to avoid unnecessarily inhibiting innovation.

The cost of waiting

Intervening too early risks regulating a technology whose trajectory is still uncertain; intervening too late risks allowing harmful practices and market structures to become entrenched. The paper concludes that the second risk is now the greater one. The DSA and the DMA arrived when the platform economy was already consolidated and intervention had become difficult and costly. Agentic commerce has not reached that point — which is precisely why this is the moment to shape its rules.