Saturday, August 29, 2026 Next update in 1d 8h 36m 08s

— A weekly publication —

The Agentic Commerce Report

A weekly read of everything that moved in agentic commerce — protocols, payment rails, retailer pilots, regulation. Summarised, sourced, and stitched to what came before.

Regulation

10 events tracked

Government, judicial, and regulatory response to agent-initiated commercial transactions is in early formation. Tracked weekly here: regulatory filings, judicial rulings, and central-bank publications, plus vendor-side policy responses.

launch

How Claude's text watermarking works

Anthropic embeds statistical watermarks in all Claude text output globally, using C2PA for files, under EU AI Act Article 50.

EU AI Act Article 50, which became enforceable on August 2 (2026-w31), requires generative AI providers to mark outputs in machine-readable formats. Anthropic applies the watermark globally, not only in Europe, across the Claude Platform API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and models accessed through AWS, Google Cloud, and Microsoft Foundry. The statistical mark travels with text when copied and pasted and persists through some editing, making it distinct from metadata-only approaches. For files, Anthropic uses C2PA (the Coalition for Content Provenance and Authenticity open standard). Anthropic joins Google, Meta, OpenAI, and Black Forest Labs in adhering to the EU code on AI-content transparency. The cross-copy persistence of the mark raises the technical bar compared to previous approaches by other providers, and covers every commercial surface including agent-generated commerce content.

  1. Anthropic
Issue 34
regulation

Google publishes letter opposing EU DMA measures requiring unrestricted third-party AI agent device access

Google published an August 5 letter opposing EU DMA measures requiring Android to grant any third-party AI agent deep system-level access to device capabilities.

The EU Digital Markets Act’s specification proceedings for Android entered the implementation phase this week, with the European Commission finalizing which interoperability measures apply. The contested measures would require Android to provide persistent microphone, camera, and screen access to any third-party AI agent — including unvetted applications. The letter is co-signed by 12 independent cybersecurity researchers and experts. The EU AI Office’s July 30 advisory highlighted agentic systems as an elevated risk category (2026-w31); the DMA measures were drafted under a separate regulatory process that predates that advisory. No resolution date has been published by the European Commission.

  1. Google Blog
Issue 33
regulation

EU AI Act enforcement powers over general-purpose AI models take effect

EU AI Office gained enforcement powers over GPAI models on August 2, 2026, ending a one-year compliance grace period.

The EU AI Act imposed documentation, training-content disclosure, and copyright-compliance obligations on GPAI providers from August 2, 2025. The one-year enforcement pause prevented the EU AI Office from acting on non-compliance. That pause ends today. The Office can now audit model documentation, run evaluations, order compliance measures, restrict EU market access, and impose fines. Fines for non-compliance reach €15 million or 3% of worldwide annual revenue, whichever is higher. GPAI providers that signed the Code of Practice on Transparency of AI-Generated Content—including Google, Apple, and OpenAI, who committed the prior week (2026-w30)—receive good-faith treatment in fine calculations. Models placed on market before August 2, 2025 face the same obligations but hold an additional compliance year, until August 2, 2027. Article 50 AI disclosure requirements, mandating that chatbots identify themselves as AI at the start of interactions, also take effect today. No jurisdiction has enacted regulation specific to agent-initiated commercial transactions.

  1. European Commission Digital
Issue 32
research

Our position on open-weights models

Anthropic stated it does not advocate banning open-weights AI, proposing chip export controls and distillation limits.

An open letter titled 'Open Weights and American AI Leadership', signed by 77 companies, foundations, and venture firms, was published July 24. Anthropic was absent from the signatories. The position paper, published July 27, clarifies that Anthropic has not called for a category ban on open-weights models; it disputes the letter's claim that open weights ease safety development or favor defenders over attackers. Anthropic's stated alternatives include maintaining chip export restrictions to limit authoritarian access, prohibiting industrial-scale distillation of frontier model capabilities into open-weights releases, and requiring safety evaluations of all models above a capability threshold regardless of weight availability. The statement is Anthropic's first public position paper specifically on open-weights policy and arrives four weeks after US export controls on Fable 5 and Mythos 5 were lifted following government classifier review (2026-w27).

  1. Anthropic News
Issue 32
regulation

Google is signing the EU AI Act Code of Practice on Transparency of AI-Generated Content.

Google signs the EU AI Act Code of Practice on AI-content labeling; Article 50 takes effect August 2, 2026.

The code implements EU AI Act Article 50 obligations, requiring signatories to mark AI-generated output as machine-detectable and label AI-generated text published on matters of public interest. Violations carry fines of up to €15 million or 3% of worldwide annual turnover. Google committed to SynthID watermarking in partnership with Apple, ElevenLabs, Kakao, NVIDIA, and OpenAI. The code is voluntary, but providers who opt out must demonstrate compliance through other means and face greater regulatory scrutiny. Article 50 obligations take effect August 2, 2026, one week after this signing. The EU AI Act's general-purpose AI model obligations begin on the same date, applying risk-based requirements to foundation models. The code sets a multi-company watermarking precedent that national market surveillance authorities can reference in enforcement actions against non-signatories.

  1. Google Blog
Issue 31
regulation

Redeploying Fable 5

US export controls on Fable 5 and Mythos 5 lifted June 30; global access resumed July 1 with updated cyber classifiers.

The directive of June 12 (2026-w24) suspended both models for all users worldwide after Amazon researchers reported a technique bypassing Fable 5's safety classifiers. The US Department of Commerce's Center for AI Standards and Innovation (CAISI) reviewed Anthropic's updated classifiers, which block the reported bypass in over 99% of cases. Testing confirmed that Claude Opus 4.8, GPT-5.5, and Kimi K2.7 could identify the same vulnerabilities independently, narrowing the capability-gain assessment. Mythos 5 returned to US organizations under Project Glasswing (2026-w23) from June 26. Fable 5 returns to Pro, Max, Team, and Enterprise plans at up to 50% of weekly usage limits through July 7, then transitions to usage credits. Anthropic committed to pre-release government access, rapid information sharing, and joint research with designated agencies.

  1. Anthropic News
Issue 30
regulation

Trump says he no longer views Anthropic as a national security threat after G7 meeting with CEO

Trump told Axios on June 19 he no longer sees Anthropic as a threat after meeting CEO Amodei at G7; Commerce Department directive suspending Fable 5 remains legally in force.

Trump met Anthropic CEO Dario Amodei at the G7 Summit in Évian-les-Bains on June 17. Amodei and Google DeepMind CEO Demis Hassabis proposed a US-led democratic AI alliance at the summit; Canada endorsed the proposal. In a pretaped Axios interview published June 19, Trump said Anthropic had “behaved very responsibly” and said he would consider easing export restrictions. The Commerce Department directive issued June 12 (2026-w24) blocks foreign nationals from accessing Fable 5 and Mythos 5 and has not been formally rescinded; the Pentagon supply-chain designation remains in place. Trump’s statement carries no binding legal force. Anthropic’s confidential IPO filing (2026-w23) proceeded at an estimated $965 billion valuation; the ongoing federal restrictions had cast uncertainty over that listing. The UK lobbied for a carve-out before the summit and was denied.

  1. The Next Web
Issue 28
regulation

Statement on the US government directive to suspend access to Fable 5 and Mythos 5

The US government suspended Fable 5 and Mythos 5 globally via an export control directive citing national security.

Anthropic launched Fable 5 three days earlier on June 9, positioning it as the first Mythos-class model for general use. On June 12, the US government issued an export control directive — the first known such action targeting a deployed commercial AI model — requiring Anthropic to suspend Fable 5 and Mythos 5 for all foreign nationals, including Anthropic employees, anywhere in the world. Anthropic received the directive at 5:21pm ET with no specific technical disclosure. Access to all other Anthropic models — Opus 4.8, Sonnet, and Haiku — is unaffected. Anthropic disputes the finding, characterizing the claimed jailbreak as narrow and non-universal, and notes GPT-5.5 replicates the same capability without bypass. This is the first instance of a US government agency using national security authorities to remove a commercial frontier AI model from global deployment.

  1. Anthropic News
Issue 27
regulation

UK FCA 2026 priorities include potential rule changes for agentic AI payments

FCA publishes 2026 Payments Regulatory Priorities, stating it will consider whether regulation change is needed to support agentic AI payments as a discrete area.

The FCA priorities document is the first formal regulatory acknowledgment that agentic AI payments may warrant rule changes, joining the Regulation lane alongside the US Amazon-Perplexity injunction (2026-w11-regulation-amazon-perplexity-court-order). The agentic-AI line item appears alongside Open Banking and stablecoin priorities, framing agentic payments as a peer category. The publication follows Visa's Agentic Ready Europe launch (2026-w11-payments-visa-agentic-ready-europe) by two weeks and Santander-Mastercard's first European agent payment (2026-w10-pilots-santander-mastercard-europe-first-payment) by three weeks, sequencing the regulator's attention immediately after live production transactions. The FCA operates one of the most active payments regulators globally, and the inclusion establishes UK supervisory interest as a distinct workstream for the year.

  1. Payment Expert
Issue 18
regulation

Court grants Amazon preliminary injunction blocking Perplexity's Comet browser from Amazon accounts

Federal judge bars Perplexity's Comet AI browser from accessing password-protected Amazon accounts on behalf of users, citing unauthorised access concerns.

The injunction is the first US federal-court action specifically targeting an AI agent's access to password-protected accounts, populating the otherwise thin Regulation lane alongside the UK FCA's 2026 priorities (2026-w13-regulation-uk-fca-agentic-payments-priorities). The order draws a legal line between first-party agent deployment — Amazon Rufus serving Amazon customers (2025-w47-pilots-amazon-rufus-auto-buy) — and third-party agent access to the same accounts. Perplexity's parallel work on its free shopping agent (2025-w47-aeo-perplexity-paypal-instant-buy) sits outside the injunction's scope. The ruling foregrounds the authentication-versus-impersonation problem that FIDO Alliance later targets with its Agentic Auth working group (2026-w18-standards-fido-agentic-working-groups) and that Visa's Trusted Agent Protocol (2025-w42-payments-visa-trusted-agent-protocol) addresses at the network level.

  1. CNBC
Issue 16

What is the regulatory state of agentic commerce?

The regulatory state of agentic commerce is largely undefined: no jurisdiction has published binding rules specifically governing AI-agent-initiated transactions as of April 2026. Active threads include the UK Financial Conduct Authority's stated intent to consider whether existing payment rules need changes for agentic AI, the first US federal ruling on AI agent access to a commercial platform (the Amazon v. Perplexity injunction in March 2026), and EU and central-bank discussion papers on liability allocation when an agent transacts. Most enforcement is happening through general consumer-protection and unauthorised-access law, not agent-specific statute.

Government, judicial, and regulatory response to agent-initiated commercial transactions is in early formation. A US federal judge granted Amazon a preliminary injunction in March 2026 barring Perplexity's Comet AI browser from accessing Amazon accounts, citing password-protected system access — the first US federal ruling directly addressing AI-agent access to a commercial platform. The UK Financial Conduct Authority published its 2026 Payments Regulatory Priorities in March 2026, stating it will consider whether existing payment rules require changes to accommodate agentic AI payments. No jurisdiction had published binding rules specific to agent-initiated transactions as of April 2026. The European Banking Authority and the Bank for International Settlements have included agentic AI in their technology-watch outputs without published rule-making. State-level US activity has so far produced consumer-protection guidance but no statute. This hub tracks every regulatory filing, judicial ruling, and central-bank publication that touches on AI-agent commercial transactions, plus vendor-side policy responses.