58% of UK Retailers Think AI Agents Are Already Buying From Them. Most Can't Prove It.

What the Research Found

In the first quarter of 2026, the Payments Association surveyed 100 senior finance, payments and risk leaders at UK online retail businesses. Retail Gazette reported the findings in May, and the headline number is striking: 58% believe AI-initiated transactions have already reached their platforms. A further 72% are preparing or planning their approach to autonomous AI purchasing. Only 10% rule out agent activity entirely.

Then the confidence falls away. Just 41% feel very confident in current liability frameworks. Asked who should carry the cost of a disputed £2,000 purchase initiated by an AI agent, the responses scattered: 24% said it would depend on the circumstances, 21% backed a shared liability model, and 18% put it on the AI vendor. There is no settled answer, and the merchants know it.

"The concern is that businesses are already processing AI-initiated transactions without the controls, liability clarity or transaction visibility needed to manage the risks properly," said Emma Banymandhub, CEO of the Payments Association.

Note the order of that list. Controls, liability clarity, transaction visibility. Two of those three depend on the third.

Why "Believe" Is the Honest Word

A merchant cannot easily count agent traffic, because agents arrive in two very different ways.

Some identify themselves. The major AI systems send declared user-agent strings when they fetch a page or a feed, and those requests are trivially countable if anyone is looking. Others do not: an agent driving a headless browser on a shopper's behalf looks, to your storefront, exactly like a person with an unusual browsing rhythm. Nothing in the checkout tells you which one just paid.

That is why 58% is a belief rather than a measurement, and why the Payments Association's fuller write-up found 39% naming uncertainty over technical standards and protocols as their single biggest barrier, with 32% putting authentication near the top. These are not abstract worries. They are the symptoms of running a channel you cannot instrument.

"Agentic commerce will not arrive as a single moment. It will arrive as transactions that look unfamiliar, then routine," said Matt Simester, Managing Director of Piran Consulting.

The Regulator Has Already Answered the Easy Question

On 9 March 2026 the Competition and Markets Authority published guidance on complying with consumer law when using AI agents, alongside research titled Agentic AI and consumers. Its central point is not complicated: existing consumer protection law applies whether a decision is made by a person or by an AI system. Businesses deploying agentic systems are expected to keep human oversight, monitor for errors and bias, and fix workflows promptly when outcomes go wrong. At the end of the same month the Digital Regulation Cooperation Forum, which brings together the CMA, FCA, ICO and Ofcom, published its own foresight paper on agentic AI.

So the law is not waiting for the technology. What is genuinely unresolved is narrower and more practical: authentication, dispute mechanics, and who bears the loss when an agent gets it wrong.

"Disputes are still built for humans. That gap matters," said Monica Eaton, founder and CEO of Chargebacks911.

This article is not legal advice, and the liability question is above our pay grade. But there is a version of the problem that is squarely a merchant's own to solve, and it is available today.

Visibility Comes Before Liability

One finding in the survey deserves more attention than it got: merchants with a formal policy on agent transactions were nearly four times more likely to feel confident about liability frameworks. The rules did not change for those businesses. What changed is that they had looked.

That is the practical lesson. You cannot influence what an agent tells a shopper about your product, or argue about a transaction after the fact, if you have no record that the agent was ever there. Three things are within reach before any standard lands:

• Measure it. Declared agents are countable today. Log which AI systems fetch your product data, how often, and which products they ask about. That turns "we believe" into a number you can act on.
• Decide who you serve. Serving every crawler that arrives is a choice made by default. Approving specific agents, and being able to change that list, is the same choice made deliberately.
• Control what they read. An agent that cannot find structured data does not give up; it infers from a page built for humans, and inference is where wrong prices, stale stock and invented specifications come from.

Where Agenticfeed Fits

This is the part of the problem Agenticfeed was built for. Your catalogue is published as a structured, machine-readable feed that agents can read directly, with live price and stock, so the facts an agent repeats are facts you set rather than guesses scraped off a product page.

Because that feed is a defined endpoint rather than an open storefront, the traffic to it is countable. Every request is logged with its user-agent and timestamp, which agents reach your catalogue is visible rather than inferred, and the list of approved agents is yours to set. That does not settle who pays for a disputed £2,000 order. It does mean you are not the merchant in the 58% who suspects something is happening and cannot say what.

The related question of whether the agent recommends you at all is covered in How AI Shopping Agents Choose Products, and the mechanics of the feed itself in What Is an Agentic Feed.

Frequently Asked Questions

How do I know if AI agents are already buying from my store?

Check your server logs for the user-agent strings the major agents declare, such as ChatGPT-User, PerplexityBot, Google-Extended and ClaudeBot. Well-behaved agents identify themselves. Agents that drive a headless browser do not, which is precisely why merchants cannot put a firm number on their agent traffic today.

Who is liable if an AI agent makes a disputed purchase?

It is unsettled in the UK. In the Payments Association's survey, 24% of merchants said it would depend on the circumstances, 21% backed a shared liability model and 18% said the AI vendor should be responsible. The CMA's March 2026 position is that existing consumer protection law applies whether a decision is made by a person or an AI system, so the underlying obligations have not moved even while the apportionment is argued over.

What can a merchant do before the standards settle?

Three things that do not depend on the rules landing: identify agent traffic in your logs so you know your real exposure, decide explicitly which agents you serve rather than leaving it to chance, and publish structured product data so agents read facts you control instead of inferring them from a page built for humans.

The Takeaway

The interesting number in this research is not 58%. It is 41%, the share of UK merchants confident in the liability framework they are already trading under. The gap between those two figures is not going to be closed by a regulator this year.

It narrows, though, for any merchant who stops guessing. Agent traffic is measurable, the agents you serve are yours to choose, and the data they read is yours to publish. Do those three and the unresolved questions are still unresolved, but they become someone else's argument, happening on a channel you can actually see.