AI payment agents are no longer just a futuristic demo. Payment networks are building products for agent-led commerce, while security bodies and regulators are clarifying the controls businesses will need.
That does not mean autonomous spending is ready for every company, merchant or country. The real issue is not whether an AI tool can click “buy.” It is whether a business can prove who gave it permission, what it was allowed to purchase, and how a bad transaction can be stopped and investigated.
Payment networks are building the rails
Mastercard announced Agent Pay in April 2025, describing a model in which AI agents can be registered and verified, use tokenized payment credentials, and operate within user-defined controls. Visa announced Visa Intelligent Commerce a day later and subsequently released developer tools intended to connect agents to its payment APIs.
These announcements matter because they show that agentic payments are becoming a product and infrastructure priority for major networks. They are not proof that every bank, card issuer, merchant, payment processor or regulator supports autonomous payments today.
For small businesses, this distinction is important. A tool may be technically able to make automated payments, but the relevant issuer, payment service provider and merchant may impose separate contractual, authentication or fraud-monitoring requirements.
Delegation is the central business risk
A traditional employee purchase already involves delegated authority. An AI payment agent raises the stakes because it can act quickly, at scale and across systems.
Before allowing software to spend money, a company should be able to answer basic questions: Which person or team authorized the agent? What supplier categories can it use? What is its spending limit? Can it make cross-border payments? Can it start a subscription or accept a price change?
Consider a procurement agent that reorders packaging supplies. It may be useful if it can buy approved products from approved vendors within a monthly budget. It becomes much riskier if it can switch suppliers, accept substituted goods, place recurring orders or send funds to a new overseas payee without review.
The same principle applies to AI treasury automation and machine-to-machine payments. Automation should begin with narrow, measurable authority rather than broad access to a corporate card, bank account or finance platform.
Build payment authorization controls first
A written delegated-spending mandate should exist before an AI agent goes live. It should state the business purpose, permitted currencies and countries, approved merchants or suppliers, transaction caps, total budget caps, time limits and prohibited purchase categories.
The mandate should also define approval triggers. A human might need to approve a new merchant, a large order, a changed price, a recurring commitment, a cross-border transaction or an unusual refund request. Every deployment needs an immediate kill switch.
Credentials deserve equal attention. Do not give a language model reusable card numbers, passwords, broad bank permissions or unrestricted API secrets. Instead, assign each agent a distinct identity and a narrow, revocable credential. Network tokenization or other protected payment credentials can reduce exposure where available.
Logging turns automation into accountable automation
When a payment is disputed, “the AI did it” is not an acceptable audit trail. Businesses need records that connect the corporate or user authorization to the specific agent identity and version that acted.
A useful record should include the instruction, supplier quote or cart state, authentication result, payment request, issuer or processor response, fulfilment outcome and any human override. Logs should be protected from alteration and retained under the company’s legal, tax and operational requirements.
This evidence helps with chargebacks, supplier disputes, fraud reviews and internal controls. It can also reveal duplicate orders, unexpected substitutions and model drift before losses become material.
Security guidance is clear, even if the rules are not global
The PCI Security Standards Council said in its 2025 AI guidance that using AI does not remove applicable PCI requirements. Its guidance emphasizes least-privilege access, protected account data, monitoring, accountable human oversight, ongoing validation, revocable credentials and the ability to disable a system. PCI SSC published additional AI payment-environment guidance on October 7, 2026.
This is influential security guidance, not a universal law or a replacement for PCI standards. Still, it offers a practical baseline: test for prompt injection, manipulated merchant content, credential theft, data leakage, duplicate purchases, outages and unsafe fail-open behaviour.
NIST’s voluntary Generative AI Risk Management Framework profile offers a complementary approach: govern the system, map its risks, measure performance and manage problems throughout its lifecycle.
EU rules depend on the use case
For EU-facing businesses, an AI purchasing agent is not automatically a high-risk AI system simply because it can spend money. However, the EU AI Act’s transparency obligations have applied since August 2, 2026, and the Act lists systems used to assess an individual’s creditworthiness or credit score among Annex III high-risk use cases. The surrounding use of AI matters.
Financial entities should also consider DORA, which has applied since January 2025 and makes ICT risk management and third-party vendor arrangements especially relevant for covered firms. Under PSD2, strong customer authentication is required in specified cases, including when a payer initiates an electronic payment transaction. Businesses should confirm their design with the relevant bank, issuer or payment service provider instead of assuming a chatbot instruction is enough.
Start narrow, then earn the right to expand
The best first use of AI payment agents is usually a constrained one: approved vendors, low limits, no new payees, no recurring commitments and human review for exceptions. Expand only after testing, monitoring and reconciliation show that controls work in real conditions.
Agentic payments may become a meaningful efficiency tool for procurement, travel, invoice settlement and treasury operations. But the durable advantage will not come from letting software spend freely. It will come from making every automated payment traceable, limited and reversible.