Half the room already lets an agent shop for them. Does your site know what to do when one shows up?
That was the show of hands at our San Francisco IMPACT Roadshow: roughly half the attendees said they were already comfortable letting an AI agent make a purchase on their behalf, and nearly all of them expected to be by the end of the year. The consumers are ready. The question is, are the merchants?
Over two days in Chicago and San Francisco, we brought together commerce, payments, and fraud leaders to cut through the hyper and answer one question — agentic commerce is coming, so what can you actually do about it?
Here’s what we heard.
Agentic commerce is already here, and it looks like referral traffic
The format was deliberately small and frank: a welcome from David Coates, an opening on agentic commerce from our Director of AI, Adam Davies, and panels moderated by our Chief Merchant, Jennifer Howard, with partners from Mastercard, VGS, and Basis Theory.
The most useful reframe was also the simplest. Most of what people call “agentic commerce” today is referral traffic, structurally no different from a paid search click. OpenAI, Anthropic, Gemini, and others are functioning as sophisticated referral engines, and that traffic is already arriving on your site whether or not you’re counting it.
That makes the first move a measurement problem, not a technology overhaul. Can your analytics identify and tag traffic coming from LLM sources? Can you track UTM parameters and referral URLs from those platforms, then watch how that traffic behaves once it lands: bounce rate, browse time, conversion? Teams that start measuring now turn an abstract “we should do something about AI” conversation into a concrete business case. Those that wait will be guessing.
The payments rails are ready. Merchant readiness is the gap.
The recurring message from the payments side of the panel: getting a payment credential from point A to point B is a solved problem. Issuers and networks are already building for agentic transactions, with frameworks like Mastercard’s agentic token live and designed to signal agent involvement right at the moment of payment.
So what’s holding up scale? The merchant’s own storefront. If an agent can’t find what it’s looking for in your catalog, navigate your site, or complete a checkout, no payment technology rescues that transaction and the sale could be lost. The work ahead is about catalog quality, discoverability, and learning to speak the language of agent protocols like UCP and ACP, often through platforms like Shopify, Google, or ChatGPT rather than building everything in-house.
Don’t block the bots that want to buy from you
One of the biggest “aha” moments was a habit many merchants didn’t know they had. Blanket bot-prevention policies, the kind configured years ago in Cloudflare or Akamai, are now turning away legitimate scraper agents acting on behalf of real customers. Our own data puts a number on it: during Cyber Month, 10% of the bot traffic we saw came from legitimate customers, not bad actors. Block all of it, and that’s revenue walking out the door before anyone sees it.
The fix starts with a phone call. Ask your bot-prevention provider whether you can assess the trustworthiness of scraper agents using certificates from trusted identity providers, then admit the good ones and watch how they behave on your site. This is a theme we know well: the goal was never to block all automation, it’s to tell the difference between an agent that represents a customer and one that represents a threat. You can’t do that without seeing the identity behind the bot.
Loyalty and liability: the unsolved problems worth naming out loud
What made both rooms valuable was the candor about what isn’t figured out yet. Your agent doesn’t know you’re a loyalty member. Ask a general-purpose agent to order your coffee and it has no idea you’re a Gold member with your extra shots covered. Solving that gap outside your own environment will take consent frameworks and data-sharing standards the industry is still writing.
Liability is the other open question. When an agent buys something the customer didn’t want, or negotiates a volume discount and orders far more than anyone intended, who pays? The panel’s working analogy was lending a friend your credit card: you stay liable if it goes wrong. Standardization is accelerating, with Mastercard’s verifiable intent framework, Amex’s intent protocol, and Google’s AP2 now folded into the Fido Alliance. Until those settle, the non-negotiable is an audit trail: a verifiable record of agent intent at the time of every transaction.
The shift is closer than the roadmap suggests
The San Francisco session closed on urgency rather than alarm. A generation that has used LLMs for three years is entering the workforce and gaining spending power, and for them, asking an agent to handle a purchase won’t feel novel. It’ll be the default, the same way younger shoppers never knew a world without mobile payments.
That’s why the 2026 holiday season came up as a realistic pilot window. Gemini, Microsoft, Meta, and OpenAI all have live agentic commerce pilot programs, and applying now is a low-cost way to do the technical groundwork while the bigger infrastructure decisions are still being made. The merchants who wait for the behavior shift to become obvious will be the ones playing catch-up.
Where to go next
If you take one thing from both rooms, make it this: small, reversible, measured steps beat waiting for certainty. Four to start with:
- Audit your analytics so you can segment LLM-sourced traffic.
- Call your bot-prevention provider and ask what it takes to admit trusted agents.
- Review your product content, because agents recommend what they can read.
- Set a defined risk budget for experimentation and review it at 30-day intervals.
None of these require betting the company. You don’t have to be the first merchant into agentic commerce, but the ones treating it as a someday problem are the ones who’ll spend next year catching up.
Curious where to go next? IMPACT Roadshow was the start.
Here’s how you can continue the conversation:
Register for IMPACT 2026. Our flagship IMPACT event returns to New York on October 14th, where the full agentic commerce conversation gets the stage it deserves.
Join the next Agentic Commerce Collective Roundtable. On Wednesday, June 17th, we’re hosting “Agentic Commerce in 2026: What’s Actually New for Search & Discovery” with Eric Shea (PwC), Scot Wingo (ReFiBuy), and Forter’s Jason Grunberg and Jameelah Calhoun. As AI agents increasingly shape how products get discovered and chosen, brands face a new challenge: being surfaced, trusted, and selected by machines. This is the third roundtable in our virtual series and, like the others, it won’t be recorded, so the conversation will only be available if you’re there.
