AI Agents Now Complete Checkout Directly, and Most Businesses Are Not Ready

Can an AI agent complete a purchase without a person ever clicking "buy"? Across four competing payment protocols launched within the past year, the answer is already yes, and the volume behind that shift is not hypothetical. An October 2025 Gartner press release forecast that 90% of all business-to-business (B2B) purchases will be handled by AI agents within three years, channeling more than $15 trillion in spending through automated exchanges by 2028 ¹. For a business that still treats its checkout and product catalog as something only a human browses, that number describes revenue moving through a channel its marketing dashboard was never built to see.

The infrastructure enabling that shift arrived first from Google. In September 2025, Google announced the Agent Payments Protocol (AP2), an open protocol developed with leading payments and technology companies to securely initiate and transact agent-led payments across platforms, built as an extension of its existing Agent2Agent (A2A) protocol and Model Context Protocol (MCP) ². More than 60 organizations signed on to help shape it, including Mastercard, PayPal, American Express, Coinbase, Salesforce and Etsy. For a business, AP2 decides whether an AI agent acting on a customer's behalf, or an agent the business itself deploys to handle procurement, can actually authorize a payment against its systems at all, not a future integration to plan around eventually.

Visa moved next, unveiling the Trusted Agent Protocol (TAP) on October 14, 2025, in San Francisco, co-developed with Cloudflare to add cryptographic agent identity to the existing web request flow ³. Visa's own announcement framed the urgency in blunt terms: AI-driven traffic to retail websites in the United States had surged more than 4,700% over the prior year, and merchants had no reliable way to tell a legitimate shopping agent from a scraping bot or a fraud script ³. TAP lets an approved agent attach a signed header to its request that a merchant verifies against a Visa-operated directory, with Adyen, Shopify, Stripe and Worldpay among the early partners testing it. A business without that verification layer wired into its checkout faces the same choice every unverified request forces: block the traffic and lose a legitimate sale, or accept it and absorb a fraud risk a human cashier used to catch on sight.

Mastercard's answer, Agent Pay, launched April 29, 2025, from Purchase, New York, introducing Agentic Tokens that build on the same tokenization already securing mobile contactless payments and card-on-file storage, extended to cover agent-initiated transactions instead of a person tapping a card ⁴. Microsoft, IBM, Braintree and Checkout.com joined as launch partners to scale the program across consumer and B2B use cases. The practical effect for a merchant is that an agent-initiated charge now arrives wrapped in the same fraud-scoring and tokenization infrastructure as a normal card transaction, provided the merchant's payment processor has actually turned that capability on rather than leaving it to activate itself.

Google returned in January 2026 with a second, broader protocol: the Universal Commerce Protocol (UCP), unveiled January 11 at the National Retail Federation's annual event and co-developed with Shopify, Etsy, Wayfair, Target and Walmart ⁵. Where AP2 governs the payment step, UCP defines how an agent discovers a product, negotiates its available options, runs checkout and exchanges post-purchase data with a merchant, launching with payment networks including Visa, Mastercard and Stripe and retailers including Best Buy and The Home Depot already endorsing it ⁵. A product that only exists inside a JavaScript-rendered storefront or an inconsistent product feed is invisible to an agent working through UCP in much the same way a page rendered only client-side is invisible to an AI crawler that never executes the script; the agent cannot negotiate a checkout on inventory it cannot discover.

None of these protocols has consolidated into a single standard, and each launched from a different company within about nine months of one another, Mastercard in April 2025, Google's payment layer in September 2025, Visa's trust layer in October 2025 and Google's broader commerce layer in January 2026. The pace has not slowed: Visa expanded its own footprint again in June 2026, announcing a strategic collaboration with OpenAI to route agent-initiated payments through its network directly inside OpenAI's products ⁶. For a business, that fragmentation is the actual operational risk, not picking the wrong protocol, but assuming one integration covers the field while an agent shopping on a different rail cannot complete a purchase at all. A retailer live on Google's Universal Commerce Protocol but unverified under Visa's Trusted Agent Protocol is purchasable to an agent built on one stack and functionally closed to one built on the other, a gap a business will not see in any dashboard because the agent simply moves to a competitor's listing instead of returning an error.

The same infrastructure cuts both ways. A business is not only a potential merchant an agent might buy from, it is also a potential buyer running its own procurement or inventory-reordering agent against a supplier's catalog, the B2B side of Gartner's $15 trillion forecast ¹. An agent built to reorder stock or renegotiate a vendor contract still needs a way to authenticate itself and authorize a payment, which is exactly what AP2 and Agent Pay were built to standardize on the buying side, not only the selling side. A business automating that workflow without a human still reviewing and approving the actual payment step is building the same trust gap on the outbound side that an unverified storefront creates on the inbound side.

Italian DesAIgns builds AI automation around that same human-in-the-loop principle, agents that draft, prepare and route a task for a final approval rather than acting on a payment unsupervised, while also making sure a business's product data and checkout are actually legible to the shopping agents already live on Google's, Visa's and Mastercard's rails. A quick AI visibility check shows whether a business's existing site and product data are structured well enough for an AI agent to find it, not just for the customers still browsing by hand.