Agentic Commerce and PCI: Will AI Shopping Agents Push You Out of SAQ A?

AI shopping agents will not decide your PCI scope. Your integration will. An agent that pays through your processor's form, or with a token your processor issued, leaves an SAQ A merchant on SAQ A. An integration that routes the customer's card number to your own server takes you off it, and your SAQ A stops being the right form for that channel.

That is the whole argument. The rest of this post is about telling which kind of integration someone is selling you.

By Dennis Wu, a certified security and PCI professional (CISSP · PCIP) with 30+ years in the field, including running PCI Level 1 compliance at buuteeq/Booking.com.

What is agentic commerce, in plain terms?

Agentic commerce means a customer tells an AI assistant what to buy and the assistant finds it, fills the cart and pays, often without the customer ever seeing your store. The agent works for the customer. The card belongs to the customer. The payment still has to land with your processor somehow, and that "somehow" is where your compliance lives.

PaymentsJournal ran a useful conversation on this in September 2026 between Nuvei's Hilla Peled and Javelin's Don Apgar. One line from it stuck with me, because it describes exactly what a small merchant should want: merchants want to support agents, "but not if it requires compromising funds or expanding PCI scope" (PaymentsJournal, Sep 23, 2026).

How big is agentic commerce right now?

Small, and most shoppers are not ready to let go of the button. Peled put agentic purchases at 1.5% of US purchases. Nuvei's own consumer study found only around 1% of respondents wanted fully automated AI purchasing, while 56% said they would never let an AI spend without their approval, whatever the amount (PaymentsJournal, Sep 2026).

Read those two numbers together. The 1.5% is a vendor's figure and I have not seen the method behind it, so I treat it as a rough direction. The 56% is the more useful number for a small store: most of your customers still want to approve the purchase.

Apgar made the point merchants tend to miss: "AI doesn't magically give people more money to spend." Agentic orders are purchases moving from one channel to another.

So there is no reason to rush. There is a good reason to understand the plumbing before someone sells you a shortcut.

Why does SAQ A care how an agent pays?

SAQ A is the short form, and you only qualify while card data never touches your systems. The questionnaire's own eligibility criteria say all processing of account data is "entirely outsourced" to a PCI DSS compliant provider, and that you do not "electronically store, process, or transmit any account data on merchant systems or premises" (PCI SSC, SAQ A v4.0.1 r1, Jan 2025).

There are two more lines for online stores. Every element of the payment form in the customer's browser has to come "only and directly" from your processor. And you confirm your site is not susceptible to attacks from scripts that could affect your ecommerce system.

Nothing in that list mentions who is shopping. Person or AI agent, the questionnaire is indifferent. It only asks where the card number goes. If you are not sure which form you are on today, start with SAQ A vs SAQ A-EP.

What are the three ways an AI agent can pay at my store?

There are really only three, and two of them leave SAQ A alone. The agent can drive your normal checkout like a person would, it can pay with a token your processor issued for that one purchase, or an integration can hand the raw card number to your server. Only the third one moves card data onto your systems.

1. The agent uses your checkout like a person

Some agents operate a web browser. They add to cart, reach your payment page, and type the card into your processor's hosted page or embedded form, exactly as a customer would.

PCI-wise, nothing changed. The card went into your processor's form. Your fraud rules and bot defenses may have opinions about a robot at checkout, but your SAQ does not.

2. The agent pays with a token your processor issued

This is where the industry is heading. Visa and Mastercard both announced agent payment programs in April 2025 built on tokenized card credentials, Visa Intelligent Commerce and Mastercard Agent Pay (Digital Commerce 360, May 6, 2025). OpenAI and Stripe released the Agentic Commerce Protocol in September 2025, where the agent's payment arrives as a Shared Payment Token.

The token is a stand-in for the card, scoped tightly. OpenAI's Delegated Payment Spec restricts each token to one merchant, a maximum amount and an expiry time, and marks it single-use (OpenAI, Delegated Payment Spec). Your processor charges it like any other payment method. You never see a card number.

That is the model the PaymentsJournal piece called "orchestration without custody." You take part in the sale. Your processor keeps custody of the card. If you file SAQ A, that phrase is your eligibility criteria in three words.

3. The integration sends the card number to you

This is the trap, and it is written down. OpenAI's own spec says plainly that integrating with it directly "involves directly handling cardholder data (CHD) and may affect your PCI scope," and that direct integration "is only for PSPs or PCI DSS level 1 merchants using their own vaults" (OpenAI, Delegated Payment Spec).

Put plainly: the people who wrote the spec are telling you the direct route is for payment processors and for merchants big enough to run their own card vault. If you are filing SAQ A, you are neither.

If a card number arrives at your server, you no longer meet the "does not electronically store, process, or transmit" criterion. For that channel, SAQ A is no longer the right form, and what replaces it is a far longer questionnaire. Our plain-English PCI guide explains why SAQ D is the one you want to avoid wandering into.

Does an agent integration add risk to my payment page even if it uses tokens?

It can. Token-based agent programs keep the card off your systems, but the software that connects your store to them still runs somewhere. If an "agent-ready" app injects a script onto the page that hosts your payment form, that script is part of what you vouch for when you confirm your site is not susceptible to script attacks.

SAQ A already asked you that. Agents just give vendors a new reason to add code to the most sensitive page you have. The PCI Council's September 2026 AI guidance makes the same point about AI on a payment page: inventory it and monitor it like any other script. Here is what that guidance means for a small store. The quarterly external vulnerability scan (Requirement 11.3.2) also still applies to the system hosting that page; our post on SAQ A and ASV scans covers who that catches.

There is a separate problem on the agent side. Attackers can feed hidden instructions to shopping agents through pages they read, and we covered how that works in agentjacking. For now that is mostly a fraud problem. It is also the reason the card networks keep talking about trust and limits rather than speed.

Who is liable when an AI agent makes a purchase the customer disputes?

Nobody has settled that yet, and anyone who tells you otherwise is guessing. The PaymentsJournal discussion named agent ownership, meaning whether the agent acts for the consumer, the merchant or the AI company, as one of the open questions that will shape how agentic payments work. Peled's summary was blunt: getting an agent to buy was easy, getting issuers to approve "a purchase that no human initiated" was the hard part.

Until the card networks and processors write that down, I would not take on any arrangement that makes your store the party holding the card. Custody is where liability tends to settle.

What should a small merchant do now?

Very little building. Mostly writing things down, then asking your processor and your vendors one pointed question each. You want to know today how card data moves through your checkout, so that when an agent integration is pitched, you can tell in five minutes whether it changes your SAQ.

1. Write one sentence per sales channel describing where the card number goes. "Customer types it into Stripe's hosted checkout" is a complete answer. If you cannot write that sentence, run Find My SAQ Type first.
2. Ask your processor what it supports for AI agents. If it offers a token-based agent program, that is your default path. Your processor already holds the card today; let it keep doing that.
3. Ask any app vendor or agency one question, in writing: does a card number, or anything your documentation calls cardholder data, ever reach our server or our web pages? Then ask for their PCI Attestation of Compliance, the signed document a provider uses to show it has been assessed.
4. Treat agentic checkout as a new channel. SAQ A's eligibility is confirmed "for this payment channel." Mention it to your acquirer when you add one, the same way you would mention adding phone orders.
5. Re-check every few months, not every year. The PaymentsJournal guests suggested revisiting your roadmap every few months rather than every 12 to 18. For scope, that means re-asking question 3 whenever an app updates its checkout features.

Should I worry about being late to agentic commerce?

Less than vendors would like. The PaymentsJournal guests argued early adopters will pick up share from laggards, and over a few years that may well be right. But the first categories Javelin expects agents to win are travel, B2B and commodity purchases. A $5M apparel or specialty store is not on that list.

Being a few months behind costs you a sliver of a 1.5% channel. Moving card data onto your own systems costs you the short form, and possibly a much longer assessment for as long as that integration runs. I know which of those I would rather explain to a processor.

The page that hosts your payment form is where most of these decisions eventually show up as new code. You can see what is running on it right now with our free Webpage Security Checker.

This is your store today. App updates, theme edits and new agency work change it — usually without anyone telling you. Run the free check, verify your domain, and keep it running.

Dennis Wu is a certified security and PCI professional (CISSP · PCIP) with over 30 years in the field, working with ecommerce merchants in the $1M–$50M range who have no in-house security team. This is a readiness and education resource, not a formal PCI assessment; your SAQ and attestation remain your call. Questions about how an agent integration would touch your own checkout? Get in touch.