Agent payments and checkout protocols: what fashion retailers need to know in 2026
ACP, UCP, AP2, Visa's Trusted Agent Protocol and Mastercard Agent Pay all aim to let AI agents pay safely. What each does, how they fit together and what fashion retailers should decide now.
KEY TAKEAWAYS Summary by the editors
- Agent checkout protocols standardise how an AI agent passes a cart, customer details and a payment credential to a merchant without a custom integration for every assistant.
- The Agentic Commerce Protocol was developed by OpenAI and Stripe and is open source under Apache 2.0; businesses remain merchant of record.
- Google's Agent Payments Protocol, announced in September 2025 with more than 60 partners, uses cryptographically signed Intent and Cart Mandates to prove what the user authorised.
- Google's Universal Commerce Protocol covers catalogue, cart, checkout, identity linking and order management, and supports AP2, MCP and A2A.
- Card networks are adding agent identification and tokenisation, such as Visa's Trusted Agent Protocol and Mastercard Agent Pay, to help merchants tell legitimate agents from bots.
Agent payment and checkout protocols are open standards that let an AI assistant hand over a cart, shipping details and a scoped payment credential to a retailer in a predictable way. For fashion retailers in 2026, the key points are that several protocols coexist, the retailer usually stays merchant of record, and most of the work sits with payment providers and commerce platforms rather than in-house teams.
Why do AI agents need new checkout protocols?
Online checkout was designed for a person clicking through a website. When an agent buys on someone's behalf, three questions arise that existing flows do not answer well: did the customer really authorise this purchase, is this agent legitimate or a malicious bot, and how does the merchant receive the order without building a separate integration for every assistant? The new protocols address one or more of these questions.
What are the main agentic commerce protocols?
| Protocol | Backed by | Main purpose | Merchant role |
|---|---|---|---|
| Agentic Commerce Protocol (ACP) | OpenAI and Stripe, Apache 2.0 | Checkout between buyers, AI agents and businesses; first implemented in ChatGPT | Remains merchant of record |
| Universal Commerce Protocol (UCP) | Google, co-developed with Shopify, Etsy, Wayfair, Target, Walmart and others | Catalogue, cart, checkout, identity linking and order management | Remains merchant of record |
| Agent Payments Protocol (AP2) | Google with more than 60 partners at launch | Proof of user authorisation through signed mandates; payment-agnostic | Receives verifiable intent and cart records |
| Trusted Agent Protocol | Visa, co-developed with Cloudflare | Helps merchants recognise approved agents and separate them from bots | Keeps visibility of the consumer behind the agent |
| Agent Pay | Mastercard | Registered agents pay using agentic tokens within limits set by the consumer | Accepts tokenised payments |
How does the Agentic Commerce Protocol work?
OpenAI and Stripe published ACP alongside ChatGPT's Instant Checkout in September 2025. According to OpenAI, ChatGPT passes order details to the merchant's backend, the merchant accepts or declines the order, processes payment through its existing provider and handles fulfilment, returns and support. Payment credentials travel as encrypted tokens authorised for a specific amount and merchant. Merchants not using Stripe can accept payments through Stripe's Shared Payment Token API or ACP's delegated payment approach without switching processor.
One caveat: in March 2026, CNBC reported that OpenAI was moving away from Instant Checkout towards retailer-run apps inside ChatGPT, with checkout on the retailer's own site. The protocol remains published, but the checkout surface around it changed within six months.
What are AP2 mandates and why do they matter?
Google announced AP2 on 16 September 2025. Its central idea is the mandate: a cryptographically signed digital record of what the user asked for. An Intent Mandate captures the instruction, such as a request for white running shoes, or rules for a delegated task including price limits and timing. A Cart Mandate records the exact items and price the user approved. Together with the payment, they form what Google calls a non-repudiable audit trail.
For fashion, this is relevant to disputes. If a customer says an agent bought the wrong size or colour, a signed record of the approved cart helps establish what was authorised. AP2 supports cards, real-time bank transfers and stablecoins, and launch partners included Adyen, American Express, Mastercard, PayPal, Worldpay and Etsy.
How do UCP, AP2, MCP and A2A fit together?
These standards sit at different layers rather than competing head to head:
- MCP (Model Context Protocol) is an open standard for connecting AI applications to external systems such as databases and tools.
- A2A (Agent2Agent) lets agents from different systems communicate.
- UCP defines commerce actions such as catalogue search, multi-item carts, checkout sessions with tax and pricing logic, OAuth-based identity linking and order status webhooks, and states built-in support for MCP, A2A and AP2.
- AP2 handles proof of authorisation and payment.
- Card network programmes add agent identity and tokenised credentials.
It is also worth separating what is live from what is announced. The Agentic Commerce Protocol site, for example, notes that mechanisms for AI platforms to discover ACP-enabled merchants are still in development, and many launches have started in the US only. European fashion retailers should therefore expect a staggered rollout, check availability market by market and treat early pilots as learning exercises rather than revenue plans. Ask your payment provider specifically how agent-initiated transactions are authenticated, flagged and reported before enabling any in-assistant checkout, and how this fits with existing fraud screening and customer authentication flows.
Who is liable when an agent payment goes wrong?
The protocols are designed so that the retailer remains merchant of record, which means returns, refunds and customer service stay with the retailer. Mastercard says Agent Pay lets consumers set limits on what agents may buy, and plans ways to resolve unfamiliar agentic transactions. Visa says its Trusted Agent Protocol helps merchants avoid wrongly blocking legitimate agent traffic while still detecting rogue bots. Detailed rules on chargebacks for agent-initiated purchases are still developing, so retailers should ask their payment service provider how agent transactions are flagged and how disputes are handled.
What should fashion retailers do in 2026?
- Ask your payment service provider and commerce platform which protocols they support or plan to support.
- Check that your fraud and bot rules will not automatically block identified agents.
- Make sure returns, delivery times and size exchange policies are available in structured form, because agents will surface them before purchase.
- Decide per channel whether you want in-assistant checkout or a hand-off to your own site.
- Avoid exclusive bets: the landscape changed several times between 2025 and 2026.
Frequently asked questions
What is the Agentic Commerce Protocol?
ACP is an open standard developed by OpenAI and Stripe, licensed under Apache 2.0, for checkout between buyers, AI agents and businesses. It was first implemented in ChatGPT. Businesses remain merchant of record and control fulfilment.
What is AP2 from Google?
The Agent Payments Protocol is an open, payment-agnostic protocol announced by Google in September 2025. It uses signed Intent and Cart Mandates to prove what a user authorised, creating an audit trail for agent-led purchases.
Is UCP the same as ACP?
No. UCP is Google's Universal Commerce Protocol, covering catalogue, cart, checkout, identity linking and order management. ACP comes from OpenAI and Stripe. Both keep the merchant as merchant of record.
Do fashion retailers need to implement these protocols directly?
Usually not. Most retailers will gain support through their payment service provider or commerce platform. Retailers should focus on product data, policies and fraud rules that allow legitimate agents.
One edition every weekday morning. Read in five minutes. Free for industry professionals.
