The agentic commerce decision test

European procurement and compliance practice has operated for years under governance frameworks calibrated to deterministic, auditable automation. Robotic Process Automation, the dominant vendor category, executes predefined rules against structured data and produces outputs that are fully traceable to authored logic [3]. The liability assignment is straightforward: the organisation that specifies the rules owns the decision.

That calibration is now under pressure from two directions. On the technology side, commercial AI systems increasingly exhibit at least one of the four agentic properties described in this brief, and vendors do not consistently distinguish their products from RPA in procurement documentation [8][9]. On the regulatory side, the EU AI Act, GDPR Article 22, and PSD2 each carry obligations that are triggered by the presence of specific system properties rather than by the label a vendor applies. A compliance team that assesses a vendor submission on the basis of marketing category rather than structural criteria will systematically misclassify risk.

At the vendor-assessment stage, the gap between marketing label and structural reality translates directly into misassigned contractual liability. Public and private procurement officers in Europe are under increasing pressure to professionalise AI governance within acquisition cycles [5], yet the technical vocabulary for distinguishing scripted from agentic systems has not been standardised across industries [2][4]. The four criteria in this brief draw on the most current peer-reviewed taxonomic work [8][9] and translate that work into a checklist applicable at the vendor-assessment stage, before a system is deployed in a live commerce or payment environment.

Each criterion isolates a distinct architectural property that scripted automation structurally cannot exhibit [8][9].

Multi-agent collaboration is present when the system instantiates specialist sub-agents and coordinates their outputs toward a shared goal. A scripted automation pipeline may route data across modular services, but each module's behaviour is fully specified at design time; no module revises its logic based on the emergent state of another. An agentic system, by contrast, allows sub-agents to produce outputs that modify the task framing for sibling agents within the same run. The distinction is architectural: fixed graph versus adaptive graph.

Dynamic task decomposition is present when the system generates a task plan after observing the current environment state, rather than executing a plan authored at design time. Robotic Process Automation, the dominant scripted paradigm, operates on explicit rule sets and predefined decision trees [3]; it cannot produce a novel step sequence it was not pre-programmed to emit. When a system constructs its own intermediate steps in response to live data, the resulting behaviour is structurally opaque to static audit.

Persistent memory is present when prior interaction history, inferred preferences, or accumulated context influence a decision made in a later session. This is distinct from a configuration file or a session cookie: the memory state is written by the system's own inference process, alters over time, and functions as an input to future decisions. GDPR Article 22 attaches to any solely automated decision producing legal or similarly significant effects; persistent memory is one property that can make Article 22 explanation obligations harder to discharge, because a memory state written by inference is not easily reconstructed from a static rule set for the purposes of explanation. Decisions shaped by accumulated inference across sessions may resist the kind of deterministic audit trail that Article 22's explanation right presupposes.

Coordinated autonomy is present when the system initiates consequential external actions across service or platform boundaries without a synchronous human confirmation at each handoff. This is the criterion most directly relevant to payment compliance: a system that can instruct a payment service provider, select a fulfilment partner, and confirm a purchase order in a single autonomous run has exercised agency across at least three regulatory perimeters simultaneously [8][9]. The absence of a contractual delegation chain at each such handoff constitutes an independent compliance failure regardless of how the other three criteria score.

Once a system crosses into agentic territory on even one criterion, three specific compliance vectors shift in ways that scripted-automation governance frameworks do not address.

First, GDPR Article 22 automated-decision safeguards become directly applicable wherever a solely automated decision produces legal or similarly significant effects. Persistent memory intensifies the discharge problem: an agentic system's memory state is dynamic and potentially non-reproducible across sessions, which means the standard RPA audit trail is structurally insufficient. Compliance teams must contract for memory-state logging at the vendor level, not merely for transaction-level audit records.

Second, PSD2 strong customer authentication exemption eligibility depends on whether the transaction was initiated by an authenticated human or by an autonomous system acting on stored credentials. PSD2 Article 97 and the EBA's RTS on SCA do not explicitly address agentic-system-initiated transactions; the exemption categories were written against a model of human-confirmed payment acts, and how they apply to a system exercising coordinated autonomy across payment boundaries is an open interpretive position rather than settled compliance exposure. Acquiring banks and payment service providers should treat this as an identified gap requiring explicit contractual delegation rather than relying on existing exemption categories pending authoritative regulatory guidance.

Third, EU AI Act high-risk classification obligations attach when a system makes or materially influences decisions in regulated sectors, including financial services. A system that exhibits dynamic task decomposition and coordinated autonomy in a procurement context meets the functional profile of a high-risk system irrespective of the vendor's own classification. Procurement teams that accept a vendor's self-classification as automation without applying the four criteria independently expose the contracting organisation to the full obligations of the AI Act without the governance infrastructure those obligations require [1][7].