When Your AI Employee Starts Buying: What Agentic Commerce Means for Your Business

In September 2025, a shopper in the United States asked ChatGPT to buy a specific item from an Etsy seller, and ChatGPT did it - discovery to payment, inside the chat, without ever opening the merchant’s website¹. Four months later, at the National Retail Federation in January 2026, Google unveiled the Universal Commerce Protocol with Shopify, Target, and Walmart on stage - a shared language that lets an AI agent query live inventory and pricing, negotiate terms, and create an order directly^2,3.

This is agentic commerce, and it is not a demo. Visa and Mastercard have built tokenised payment rails that give an agent a card scoped to a single amount and merchant^6,7. Gartner expects 20 percent of all digital commerce transactions to run through AI platforms by 2030¹⁰. Morgan Stanley puts the US opportunity at $190 billion to $385 billion¹¹. The rails are live, and they point in one direction: software that does not just recommend what to buy, but buys it.

For a business, this cuts two ways. Your own AI employees will start executing purchases - reordering, renewing, placing supplier orders - inside your real policies. And other companies’ buying agents will start looking for you, which means your products, prices, and terms have to be readable by a machine, not just a human clicking through a website. This guide is for the operations leader, CFO, or Geschaeftsfuehrer who needs a practical, honest view of both sides - without the hype.

The Two-Sided Shift

Most coverage of agentic commerce frames it as a consumer story: people shopping through chatbots. For a business, the more important change is structural, and it hits from two directions at once.

• Side one: your agents buy - Your AI employees move from suggesting a purchase order to actually placing it, from flagging a renewal to executing it, from drafting a supplier email to completing the transaction - all inside your budgets and approval rules.
• Side two: their agents buy from you - Buyers at other companies increasingly send an agent to research and transact. If your catalogue, pricing, and terms are not machine-readable, their agent cannot choose you, no matter how good your product is.
• Both sides share one dependency - A buying agent is only as good as the context it acts from. On the buy side that context is your spend policy; on the sell side it is your structured product and offer data.
• The timeline is short - OpenAI shipped Instant Checkout in September 2025, Google shipped UCP in January 2026, and the payment networks shipped their rails in 2025^1,2,6. This is a 12-to-18-month shift, not a five-year one.
• The risk is asymmetric - Getting the buy side wrong costs you money through bad or runaway purchases. Getting the sell side wrong costs you revenue silently, as agents route around you without ever telling you.

The rest of this guide takes both sides in turn, starting with the rails that make any of it possible.

The New Rails for Agentic Commerce

An agent cannot buy anything without three things: a way to read a merchant’s live offer, a way to prove what the user authorised, and a way to pay that a bank and a seller will trust. In the space of a year, the industry shipped all three.

The protocols that let agents transact

• OpenAI Agentic Commerce Protocol (ACP) - Co-developed with Stripe and launched September 2025 to power Instant Checkout in ChatGPT. Users buy from Etsy sellers and over a million Shopify merchants inside the chat, with payment through encrypted tokens authorised for a specific amount and merchant^1,21.
• Google Universal Commerce Protocol (UCP) - Announced at NRF in January 2026 with Shopify, Etsy, Wayfair, Target, and Walmart, and endorsed by Stripe, Adyen, and American Express. Merchants expose live inventory, pricing, shipping, tax, and discount logic that an agent queries in real time^2,3,14.
• Google Agent Payments Protocol (AP2) - Announced September 2025 with 60-plus partners. It adds three signed mandates - Intent, Cart, and Payment - carried as W3C Verifiable Credentials, giving a cryptographic record of what was authorised, selected, and charged^4,5.
• Agent2Agent (A2A) - An open protocol for agents to discover each other and collaborate, moved to the Linux Foundation in June 2025 with AWS, Microsoft, Cisco, and Salesforce as founding members. AP2 is built as an extension of A2A and the Model Context Protocol⁹.

The payment rails that let agents pay

• Visa Intelligent Commerce - Opens Visa’s network to agent developers with tokenised cards that encrypt card numbers and prove the agent is authorised to buy. Launch partners include Anthropic, OpenAI, Microsoft, Mistral, Perplexity, Stripe, and Samsung^6,7.
• Mastercard Agent Pay - Tokenised payment technology built into conversational AI platforms, so an agent can pay inside the recommendation flow rather than bouncing the user to a checkout page^7,8.
• Scoped, single-use tokens - The common thread is that the agent never holds a raw card number. It gets a token locked to one amount and one merchant, which is what makes overspend structurally hard rather than merely discouraged⁶.
• Stablecoin and bank rails - AP2 treats stablecoins and bank transfers as first-class payment types alongside cards, which matters for cross-border and business-to-business settlement⁵.

That line - trusted by users, banks, and sellers - is the whole game. The protocols above are machinery for creating that trust. Which is exactly why, inside a company, the trust has to come from somewhere specific: your own rules and history. More on how AI agents differ from simple automation is covered in our guide to telling whether you can rely on an AI agent.

When Your AI Employee Starts Buying

The most immediate impact is not consumers shopping in chat. It is the routine buying work inside your own company - the reorders, renewals, and supplier orders that eat hours and leak money. These are the first jobs an AI employee should take over, because they are repetitive, rule-bound, and easy to check.

Where the money leaks today

• Maverick spend is large - Industry analyses put purchases made outside approved contracts at roughly 23 percent of total procurement spend, with organisations losing 5 to 15 percent of annual procurement spend to off-contract buying¹⁶.
• Off-contract buys cost a premium - When teams buy outside agreed terms, estimates put the waste at 12 to 18 percent on each affected dollar, from lost volume discounts and worse pricing¹⁶.
• Sourcing is slow - Manual sourcing cycles routinely run 12 weeks; AI-assisted procurement has compressed them toward 6 weeks by automating supplier identification, requests, and bid evaluation¹⁵.
• Requisitions drag - Dialog-based buying guidance has cut requisition cycle times by up to 78 percent in reported deployments, mostly by removing back-and-forth and wrong-supplier rework^15,17.
• Invoices pile up - Matching invoices to purchase orders and delivery notes is the kind of high-volume checking work that consumes finance teams and is a natural fit for automation, as covered in our piece on AI tools for accounts payable.

Nine concrete things an AI employee can buy or transact

1. Consumables reorder - When stock of a standard item drops below a threshold, the agent places a repeat order with the approved supplier at the contracted price.
2. Software renewals - It flags an upcoming subscription renewal, checks usage against seats, and either renews within policy or escalates if the cost or seat count changed. This is where the seat-based software trap often hides.
3. Supplier repeat orders - For known parts or materials, it raises a purchase order against the framework agreement without a buyer re-keying anything.
4. Spot-buy within limits - For a one-off under a small threshold, it finds an approved vendor, confirms the price, and buys, logging the reason.
5. Invoice-to-PO matching - It reconciles incoming invoices against purchase orders and goods receipts, approving clean matches and routing exceptions to a human.
6. Contract-term enforcement - Before any order, it checks the supplier’s agreed terms, minimum order quantities, and rebate thresholds so the company actually gets what it negotiated.
7. Travel and events booking - Within travel policy and budget, it books and pays, then files the receipt and expense record automatically.
8. Supplier onboarding checks - For a new vendor, it gathers the compliance documents and runs them against policy before any spend is allowed.
9. Budget-aware approvals routing - It reads the live budget line, approves what fits the rules, and sends anything above the sign-off threshold to the right person with the context attached.

Why Safe Buying Starts in the Company Brain

A generic shopping agent knows the internet. It does not know that your legal team mandated a specific data-processing clause, that you have a framework agreement with one supplier at a better price, or that the last time someone bought this category off-contract it caused a three-month billing dispute. An AI employee that buys for you has to know all of that. That knowledge is the Company Brain.

What the Company Brain gives a buying agent

• Spend policies - who can buy what, up to which amount, in which category, and what needs sign-off. The rules that normally live in a PDF nobody reads become rules the agent enforces.
• Preferred suppliers and framework terms - the agreed price, minimum quantities, lead times, and rebate thresholds, so the agent buys on the terms you negotiated rather than list price.
• Past decisions and their outcomes - which suppliers delivered late, which substitutions worked, which categories caused disputes. The institutional memory that usually walks out the door with a retiring buyer.
• Contract and compliance context - data-processing requirements, certifications a supplier must hold, and clauses that must be present before an order is placed.
• Live system state - current budget lines, open purchase orders, and stock levels, read from the ERP and CRM in real time rather than from a stale export.

How the Company Brain gets built

1. Connect the systems - The agent reads from the tools you already run: email, Teams, SharePoint, the CRM, and the ERP. Policy documents, contracts, and supplier records come from where they already live.
2. Capture the unwritten rules - The knowledge that lives only in people’s heads gets surfaced through daily use, as the team corrects and confirms what the agent proposes.
3. Learn from feedback - Every approval, rejection, and correction teaches the agent. It gets sharper on your categories and suppliers over time, which is the opposite of a generic tool that stays generic.
4. Keep the memory current - New contracts, price changes, and lessons from disputes feed back in, so the agent’s context does not drift out of date.

We go deeper on how this memory is assembled and ramped up in our guide to building a Company Brain. The short version: the buying agent is only trustworthy because of what sits behind it.

The Guardrails That Make It Safe

Context tells the agent what a good purchase looks like. Guardrails make sure a bad one cannot slip through anyway. Three controls do most of the work, and none of them should rely on the model’s judgement alone.

The three non-negotiable controls

• Hard spend limits - Enforced in code and at the payment token, not as a prompt instruction. A token scoped to one amount and one merchant cannot be stretched, which is the structural reason tokenised rails matter⁶.
• Human sign-off thresholds - Above a defined amount, or for any new supplier or unusual category, a person approves before anything is bought. The agent prepares the decision with full context; the human makes it.
• Full auditability - Every action is logged: what the agent searched, which policy it applied, what it ordered, what it paid, and who approved anything above threshold. Verifiable-credential protocols like AP2 add cryptographic proof of authorisation at the transaction level^4,5.

This is the honest counterweight. Gartner expects more than 40 percent of agentic AI projects to be cancelled by the end of 2027, citing unclear value, rising costs, and weak risk controls¹². The lesson is not to wait - it is to deploy with discipline: narrow use case, real guardrails, measured results. For a deeper look at what separates a reliable agent from a demo, see our analysis of agent reliability.

Becoming Machine-Readable: When Other Firms’ Agents Buy From You

The second side of agentic commerce is quieter and, for many companies, more dangerous. If buyers send agents to research and purchase, your business has to be legible to those agents. A beautiful website a human loves is worthless to a machine that needs structured inventory, price, and terms.

What agents need from you to transact

• Live, structured product data - Not a PDF catalogue, but queryable inventory, pricing, variants, and availability. UCP is built precisely so merchants expose these as live commerce primitives rather than static feeds^2,14.
• Machine-readable terms - Shipping, tax, returns, and discount logic an agent can read and factor into a decision, not bury in a footer a person has to scroll to find.
• A trusted payment path - Support for the tokenised rails buyers’ agents use, so the transaction can actually complete once the agent decides^6,7.
• Clear identity and provenance - Verifiable records of who you are and what you offer, which is where credential-based protocols like AP2 point⁴.
• Accurate, current data - An agent that gets a wrong price or a false in-stock will not forgive it the way a human might; bad data means lost or disputed orders.

The reassuring part of Pichai’s point is that you do not lose the customer relationship - you stay the merchant of record. The hard part is that you only get into the consideration set at all if your data is readable. Agents cannot choose what they cannot parse.

How Superkind Fits

Superkind builds AI employees that take over routine work and live inside the systems a company already uses. For agentic commerce, that means an AI employee that buys out of your Company Brain, within your guardrails, connected to your real tools - not a generic shopping bot bolted on from outside.

• Buys from the Company Brain - The agent acts out of your spend policies, preferred suppliers, past decisions, and contract terms, so a purchase reflects how your best buyer would decide.
• Connected to your real systems - It reads and writes across email, Teams, SharePoint, CRM (Salesforce, HubSpot), and ERP (SAP Business One), plus accounting tools like DATEV and Lexware, rather than forcing a new platform.
• Hard guardrails by design - Spend limits, approval thresholds, and supplier allow-lists are enforced as rules, with a human-in-the-loop step for anything above the line.
• Full audit trail - Every action the agent takes is logged with its reason, so finance and auditors can see exactly what was bought, why, and on whose authority.
• Learns from daily feedback - Your team corrects and confirms what the agent proposes, and it gets sharper on your categories and suppliers over time.
• First use case live in weeks - A focused purchasing workflow goes into production fast, rather than through a six-month rollout.
• No rip-and-replace - The AI employee sits on top of your stack, so you keep the ERP and purchasing tools you already trust.
• Outcome-focused - The engagement is tied to a measurable result on a real workflow, not seats or licences, as we argue in our piece on the seat-based software trap.

Decision Framework: Are You Ready for Agentic Commerce?

Not every company should let an agent buy tomorrow, and not every company can afford to be invisible to buying agents. Use these signals to decide where to act first.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI employees that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach, with the guardrails and company knowledge that make autonomy safe.