Maintaining a living glossary

Context

The EU regulatory stack governing digital finance and artificial intelligence has grown by accretion rather than design. MiCA [13] introduced a taxonomy of crypto-assets calibrated to 2020-era instruments; the AI Act [16] defined AI systems with reference to machine learning and statistical approaches; DORA addressed ICT risk without resolving how autonomous agents relate to the third-party providers it governs. Each instrument used the vocabulary available to its drafters at the time of passage, and no cross-instrument harmonisation body held the pen on shared definitions.

Agentic commerce has since introduced a further layer of complexity. The distinction between a modular AI agent executing a discrete task and a multi-agent system coordinating persistent, goal-directed behaviour across payment rails is architecturally significant [5], but neither category maps cleanly onto any current EU legal definition. The term "autonomous payment agent" does not appear in the legislative record. "Agentic AI" is absent from ESMA and EBA technical standards. This is a structural vacancy, and it is being filled ad hoc by national competent authorities applying the closest available analogue, which produces the definitional divergence the glossary must close [11][17].

A living glossary requires two interdependent structural components: a version-control architecture and a trigger-governed review cycle.

On the version-control side, each definition is assigned a URI-based persistent identifier that resolves to the exact text in force at a specified date. Semantic versioning distinguishes between a major revision (a change in legal scope or definitional boundary), a minor revision (a clarification that does not alter scope), and a patch (a correction of drafting error). Prior versions remain resolvable at their original URIs, so a contract or regulatory filing that cites a definition by version number retains a stable referent regardless of subsequent amendments [21]. This is the same property that software dependency management requires of package registries, and the legal vocabulary application preserves the core property while differing from the software case in one respect: a deprecated definition cannot be removed from the registry, because historical contracts and enforcement records depend on its continued resolvability.

On the review-cycle side, specific events serve as mandatory triggers: the entry into force of an EU legislative instrument affecting the defined domain; the publication of a CJEU ruling that interprets or distinguishes a covered term; the issuance of EBA, ESMA, or ENISA guidelines that employ the term in a context the current definition did not anticipate; and detected supervisory divergence across two or more member states within a defined observation window. Each trigger initiates a structured amendment process: a proposing body submits a redline against the current version, a defined consultation period follows, and the final amendment record attributes the change to its initiating instrument, the proposing body, and any formally registered dissent.

The amendment record is designed to function as a divergence register rather than a settlement instrument. This distinction is structural, not merely rhetorical. A settlement instrument would resolve an interpretive dispute by replacing the competing readings with a single canonical text and closing the record. A divergence register records that a dispute exists, attributes each competing reading to its source authority, and leaves the underlying interpretive question visible to courts, compliance teams, and supervisory bodies that must later engage with it. When a national authority departs from the canonical text, the departure is logged as a registered dissent rather than absorbed into supervisory practice without trace. Downstream compliance systems can subscribe to definition updates as structured data rather than monitoring legislative publications manually [11].

The glossary must also carry a definition for delegated payment authority, the condition in which an autonomous agent holds authority, granted by a human principal, to initiate payment instructions without per-transaction human confirmation. This construct sits at the boundary of existing PSD2 authentication requirements and the AI Act's classification of high-risk systems, and its absence from current regulatory vocabulary is the mechanism by which the compliance gap described in the TECHNICAL OBSOLESCENCE bullet above propagates into enforcement [5][16].

A canonical agentic commerce vocabulary with version-controlled, publicly citable definitions produces changes across at least three operational planes.

For compliance and audit functions, the change is one of traceability. When a supervisory filing must demonstrate that a payment instruction was initiated by an "autonomous agent" within the meaning of the applicable instrument, the filing can cite a specific definition version in force on the transaction date. This applies with particular force to delegated payment authority: where an agent holds standing authorisation to initiate payments without per-transaction confirmation, the compliance record must establish which version of that definition governed the authorisation at the moment it was granted, and which version governed each payment event during the authorisation's duration. Version-controlled definitions close that gap between the legal text and the technical system log, and give internal audit teams a fixed referent against which to assess historical conduct, a referent that does not retroactively shift when the glossary is subsequently updated [11][21].

For cross-border harmonisation, the change operates on the divergence problem directly. National competent authorities in France, Germany, and Estonia cannot interpret the same term differently if that term resolves to a single versioned URI accepted as the authoritative definition under the relevant regulatory technical standard. Divergence becomes detectable and attributable: when a national authority departs from the canonical definition, the departure is recorded in the amendment register rather than absorbed silently into supervisory practice [13]. This makes regulatory arbitrage structurally harder to sustain, because the definitional surface area it requires is narrowed and monitored.

For risk modelling, the implication is temporal. Models that price compliance risk across jurisdictions currently carry implicit assumptions about which version of a definition governs a given transaction. Version-controlled definitions make those assumptions explicit and auditable, reducing a source of model uncertainty that is currently unquantifiable.