Agentic Commerce: Payment Agents, UCP, ACP, and AP2 (as of 2026)

Agentic commerce refers to purchasing processes in which an AI agent researches products, selects them, and initiates payments on behalf of a user. The most important protocols for this are UCP from Google, ACP from OpenAI and Stripe, and AP2 from Google. There are also tools such as the Stripe Agent Toolkit. The technology is still at an early stage. In 2026, we recommend human approval of payments, although the law does not require it.

The break with classic e-commerce is fundamental: the purchase moves from a human click on the order button to an authorized function call by an agent. This creates new layers (product discovery through agents, checkout through protocols, payment initiation through payment services) and with them new security questions that every DACH organization has to answer before its first pilot project.

Three quick answers

• What happens technically? An agent receives an authorization mandate from the user, researches and selects, calls a merchant checkout through a commerce protocol such as UCP or ACP, and initiates the payment through a payment service, at Stripe for example with a Shared Payment Token. During the pilot phase, a human approves every payment first.
• Who supplies the building blocks? The most mature layer today is integration: the Model Context Protocol (MCP) is the de facto standard for connecting tools. On the commerce and payment side, UCP and AP2 from Google and ACP from OpenAI and Stripe exist side by side. UCP and ACP compete at checkout, and AP2 adds authorization to UCP. Commercially, the payment infrastructure (Stripe, for example) is furthest along.
• How far along is this in 2026? Early production, not a mass market. Agent penetration is single-digit across almost all business functions; hallucination rates of 22-94% across 26 leading foundation models make fully autonomous payments without hard limits reckless.

How payment agents trigger purchases

The typical flow of an agentic commerce purchase breaks down into four phases, each assigned to its own protocol or infrastructure layer.

1. Mandate and identity. The user gives the agent a mandate: “Buy X up to an amount of Y.” For this, the agent needs a verifiable, cryptographic identity so that every action can be attributed to an authorized agent. The Agent Payments Protocol (AP2) represents such mandates as cryptographically signed credentials.

2. Discovery and selection. The agent finds suitable products. This is where the Universal Commerce Protocol (UCP) comes in: merchants publish their capabilities in a manifest that agents use to find them without a custom integration.

3. Checkout. The agent calls the merchant checkout. This standardized ordering process between agent and merchant is governed by the Agentic Commerce Protocol (ACP) from OpenAI and Stripe and by the checkout capability of UCP.

4. Payment. The actual transaction runs through a payment service provider. At Stripe, a Shared Payment Token handles this: it shares one of the customer's payment methods with the merchant, scoped to that merchant and capped by a maximum amount and an expiration time. As of 2026, the payment layer is among the most mature commercial building blocks. The Stripe Agent Toolkit, by contrast, is a developer tool: it connects agent frameworks such as LangChain to the Stripe API via function calling.

Cutting across all of these layers is the Model Context Protocol (MCP), the de facto integration layer. In December 2025, Anthropic reported more than 10,000 active public MCP servers and more than 97 million monthly SDK downloads for Python and TypeScript. In the “agentic mesh” architecture, MCP connects agent and tool (vertically), while agent-to-agent protocols (A2A) connect agent and agent (horizontally). AP2 is designed as an extension for A2A and MCP. In December 2025, Anthropic handed MCP over to the Agentic AI Foundation, a fund under the umbrella of the Linux Foundation. This shows that the integration layer is maturing toward a vendor-neutral standard.

The building blocks at a glance: layers and maturity

The following table maps the central layers of agentic commerce to their function and maturity. All maturity ratings reflect the state of 2026 and are deliberately conservative.

Important for context: provider, version, and integration details at the commerce and payment layer are moving fast in 2026. Verify specific product releases, dates, and prices directly with the respective provider before a project instead of taking them from secondary sources.

The protocols compared: UCP, ACP, AP2

Behind the layers are three named protocols with different backers and tasks.

UCP standardizes the purchase path from discovery to order management. Merchants publish a manifest of their capabilities at /.well-known/ucp, and agents use it to find them without a custom integration. Google introduced UCP in January 2026, and more than 20 other partners such as Adyen, Mastercard, Stripe, Visa, and Zalando support it. UCP separates the customer's payment instrument from the payment processor and is compatible with AP2.

ACP was developed jointly by OpenAI and Stripe. Stripe published it as an open standard on September 29, 2025. On the same day, OpenAI launched Instant Checkout in ChatGPT, initially only for users in the US. In March 2026, OpenAI scaled Instant Checkout back and has since moved in-chat purchasing into the ChatGPT apps of merchants such as Instacart. According to an OpenAI spokesperson, ACP remains the technical foundation (Digital Commerce 360). Payment runs through a Shared Payment Token: with it, the agent shares one of the customer's payment methods with the merchant, scoped to that merchant and capped by a maximum amount and an expiration time. According to Stripe, Shared Payment Tokens are also available in Austria, Germany, and Switzerland. The specification is published under the Apache 2.0 license at agenticcommerce.dev.

AP2 was introduced by Google on September 16, 2025. It addresses the question of whether an agent may initiate a payment at all. Mandates record what the user has permitted: first conditions such as budget and permitted payment methods, then approval of a specific cart. The mandates are cryptographically signed credentials that make any tampering detectable, and together they form a reviewable audit trail.

Stripe offers integrations for UCP and for ACP for selling through agents.

Security and authorization: human-in-the-loop as the default

This is the core of any serious agentic commerce architecture. An agent that moves money is in a different risk class than an agent that summarizes text. Three research findings demand discipline: hallucination rates between 22% and 94% across 26 leading foundation models, with even the best models wrong in around 20% of cases; 362 documented AI incidents in 2025 alone (up from 233 in 2024); and agent penetration that is still single-digit across almost all business functions.

This leads to our recommendation: for payments, every architecture needs a human approval checkpoint. During the pilot phase, a human approves every payment. Once the agent runs reliably, small amounts below a fixed threshold can go through automatically, while everything above it still needs human approval. The matching architecture pattern is the orchestrator with specialized sub-agents and a final human approval layer: a coordinating agent distributes subtasks, and the final approval of consequential actions stays with a human.

The law does not require this approval. The AI Act requires human oversight under Art. 14 only for high-risk systems, and a shopping agent usually does not count as one. For electronic payments in the EU, however, PSD2 applies with strong customer authentication: the payer authenticates with two of three factors (knowledge, possession, inherence). Exemptions exist for small amounts up to €30 in online retail (with cumulative caps) and for recurring payments of the same amount to the same payee, among others. Subsequent payments that the merchant initiates based on an existing mandate are not subject to the requirement, but setting up such a mandate online is. Whether an exemption applies is decided by the card issuer and the payment service provider, not by the merchant. With Stripe's Shared Payment Tokens, the agent passes on the customer's payment method only in restricted form: bound to one merchant, a maximum amount, and an expiration time. If authentication becomes necessary, for example via 3D Secure, the customer completes it themselves in their bank's interface (Stripe).

The specific controls that belong in every implementation:

• Authorization mandate with a hard amount limit and category-based approvals.
• Verifiable, cryptographic agent identity, so that every transaction can be attributed to an authorized agent.
• Complete audit trail: reviewable, tamper-proof, GDPR-compliant.
• Human approval gate for every payment during the pilot phase, later for all payments above a fixed threshold.
• Transparency under Art. 50 of the AI Act: the transparency obligations for interaction (chatbot/voice disclosure) apply from August 2, 2026. According to the Digital Omnibus on the AI Act, generative AI systems placed on the market before that date must implement machine-readable marking under Art. 50(2) by December 2, 2026; new systems must do so from market launch. ISO 42001 certification is considered a structural lever.

A concrete example: a procurement agent with limits

A DACH B2B scenario makes the principle tangible. A mid-sized retailer uses a procurement agent for recurring office supply reorders. The mandate for the pilot phase:

This is how an order runs:

1. If the amount is above €250 or the product group is outside the mandate, the agent aborts.
2. If the monthly total would exceed €2,000, it also aborts.
3. The agent writes the transaction to the audit trail (log_audit_trail).
4. If the amount is at or above approval_from, the agent requests human approval with request_approval. In the pilot, this applies to every order.
5. Only after approval does the agent hand the Shared Payment Token to the merchant (merchant.checkout). The merchant charges the payment method, and only now does money flow.

The crucial point: even for a €47 routine order within all limits, no money flows during the pilot without the request_approval step. Only once the agent works reliably in the pilot do you raise approval_from to a fixed threshold, say €50. Below it, the order runs automatically; above it, a human still approves. The agent researches, compares, and prepares, and the approval of larger amounts stays with a human. This is how you capture the productivity gain (research, price comparison, pre-filling) without giving up control over the payment. Reliable studies put productivity gains in structured work at 14-26%. You can reach exactly this range with “agent prepares, human approves” without taking on uncontrolled payment risks.

Healthy skepticism: what does not hold up yet in 2026

In 2026, agentic commerce is a promise with a solid core, but the gap between demo and production is large. Three points for context:

• No protocol standard. UCP and ACP compete at checkout, and there is no common standard. If you tie yourself closely to a single protocol today, you take on a lock-in risk.
• Thin DACH adoption. Europe has its first early adopters and a growing vendor ecosystem, but few production references for agent-driven payments. Conversational and agentic commerce assistants are in early production.
• Trust and brand risk. GDPR requirements, brand voice, and the acceptance of autonomous payments slow things down. In DACH, generic, US-style agent outputs are often recognized as off-brand.

For agencies and B2B decision-makers

For DACH agencies, the value in 2026 lies not in selling fully autonomous purchasing agents but in the clean architecture behind them: authorization mandates, amount limits, verifiable agent identity, a reviewable audit trail, and transparency under Art. 50 of the AI Act as a standard deliverable. If you wire payment infrastructure such as Stripe, a commerce protocol such as UCP or ACP, and MCP cleanly through an integration layer and consistently build in the human approval gate, you deliver exactly the implementation that is ready for works council co-determination and compliance, which purely US-driven approaches often lack.

For B2B decision-makers: start with a clearly bounded, high-frequency procurement or comparison use case, keep protocol decisions interchangeable, and treat autonomous payments as what they are as of 2026: an option for later, not for the first pilot. Talk to us if you want to set up a payment agent pilot with real limits and approval gates.