Spotlight on agentic AI | The Digital Fairness Act and agentic commerce

On 11 November 2026, the European Commission published its proposal for the Digital Fairness Act (DFA). The proposed Regulation would update EU consumer law to tackle practices such as dark patterns, addictive design, misleading influencer marketing, unfair personalisation, opaque pricing and subscription traps. Its aim is to strengthen consumer protection, particularly for children and other vulnerable consumers, while giving businesses clearer, more consistent rules.

Much of the commentary has focussed on dark patterns, subscription traps and loot boxes. But for businesses developing or deploying AI agents, two of the most interesting provisions are Articles 26 and 27.

They deal with software that concludes contracts on a consumer’s behalf and, crucially, how much autonomy consumers can give it. Article 26 would require traders offering these systems to give consumers a choice about when an agent must seek approval.

The consequences could extend beyond product design to the commercial models that make agentic commerce viable.

What does Article 26 actually require?

Article 26 applies to traders that make “automated systems” available to consumers to conclude or perform contracts, whether with those traders or with others.

The definition in Article 3(21) is broad: software capable of taking decisions and actions with legal effects without human intervention. It is not tied to the AI Act’s definition of an AI system, so rule-based purchasing tools could be caught alongside more sophisticated AI agents. And because the test is based on capability, a system remains in scope even if its user chooses to approve every purchase.

On first use, consumers would have to actively select one of three levels of autonomy:

• Confirm everything. Every contract proposed by the agent requires the consumer’s approval.
• Confirm some things. The consumer decides which types of contract require approval, using criteria such as a maximum price or time limit.
• Confirm nothing. The agent can conclude contracts without seeking individual approval.

The trader offering the system would then have to confirm the consumer’s choice on a durable medium.

The third option is particularly interesting. Rather than insisting on human approval at every checkout, Article 26 would expressly allow autonomous contracting, provided the consumer has chosen it.

A number of safeguards would sit alongside that choice:

• Controls. Consumers must be able to adjust the agent’s parameters at any time (Article 26(1)).
• Information. Where approval is required, the agent must first provide key pre-contractual information, including the price and the trader’s identity (Article 26(4)(a)).
• Commercial influence. Payments received for proposing a contract, and conflicts of interest involving the relevant trader, must be disclosed. Either would trigger mandatory confirmation, regardless of the consumer’s chosen autonomy setting (Article 26(4)(b)).
• No compulsory agents. Traders could not make the use of an automated system a condition of accessing or transacting through their online interfaces (Article 26(9)).

Financial services are excluded from Article 26.

What about Article 27?

Article 27 deals with contracts concluded entirely through automated systems on both sides: for example, a consumer’s buying agent transacting with a retailer’s selling agent.

The retailer could provide information required under the Consumer Rights Directive in a commonly used machine-readable format. Certain checkout formalities would also fall away, including the familiar requirement for an “order with obligation to pay” button.

A checkout button serves little purpose when there is no human to click it. The consumer would still receive a plain-language contract confirmation afterwards. The focus shifts from the mechanics of checkout to the authority given to the agent.

What could this mean for businesses?

Agent providers. An autonomy setting needs to work beyond the onboarding screen.

An agent authorised to spend €80 should not be able to complete a €120 purchase because of a surcharge added at checkout. Effective spending limits, clear approval prompts and records of what the consumer authorised (and what the agent actually did) would matter, even though Article 26 does not expressly prescribe logging.

How these choices are presented matters too. Article 10 and the proposed Annex I blacklist of dark patterns could make pre-selecting “confirm nothing”, or steering consumers away from approval, problematic.

Retailers and marketplaces. A retailer’s own shopping agent would also fall within scope.

A harder question is whether an agent recommending purchases from its own operator would have a “conflict of interest” under Article 26(4)(b). If so, every purchase might require confirmation, even where the consumer has opted for full autonomy. The proposal does not say that every retailer-operated agent is conflicted. But the answer could affect competition between retailer-operated agents and independent buying assistants.

Article 26(9) would also prevent merchants from making agents the only route to purchase. It would not, however, give third-party agents a general right of access to merchants’ websites or APIs.

Commercial models. Sponsored recommendations and affiliate arrangements would not be prohibited, but could introduce friction.

Where a payment or conflict triggers Article 26(4)(b), consumers would need to approve a transaction even after opting for full autonomy. One question is whether a commission payable only after a completed sale counts as payment “for proposing” a contract. The answer could have important consequences for advertising-funded agents that aim to offer seamless autonomous purchasing.

What remains unclear?

The proposal would not resolve every legal question raised by autonomous purchasing:

• Liability and payments. Article 2(2) preserves applicable national contract law, leaving questions of validity, authority and mistaken purchases to be resolved elsewhere. The relationship with payment authorisation under PSD2 and the forthcoming Payment Services Regulation also remains unclear. Article 36’s proposed right of recourse could affect risk allocation between merchants and agent providers.
• Other rules. Article 4 gives precedence to the AI Act and Digital Services Act where they conflict with the DFA. There is also an open question about whether the DFA’s dark patterns rules would catch merchant interfaces designed to influence buying agents rather than human consumers.

Looking ahead

The important point about Articles 26 and 27 is that they recognise a different way of buying: consumers set the parameters, software carries out the transaction and some disclosures are designed for machines rather than checkout screens. The proposal would accommodate genuinely autonomous purchasing, but would insist on human approval where the agent has certain commercial interests of its own.

Where that line is drawn will matter. In particular, the treatment of retailer-operated agents and commission-funded recommendations could shape which models of agentic commerce work in practice.

The proposal will now be considered by the European Parliament and Council. As published, it would apply 12 months after entering into force, with potentially substantial penalties for breaches. There is some distance to travel before the rules become law, but the choices being made now could have a lasting effect on the agentic commerce market.

If you would like to discuss what the proposed rules could mean for your business, please get in touch with the Bristows AI team.