The autonomous-to-supervised spectrum

The framing of automation as a binary (human or machine) has persisted long past its analytical usefulness. In European commerce and payments, the operative question concerns the specific decision points at which machines are permitted to act without per-action human confirmation, and which regulatory instrument governs the consequences when they act incorrectly.

This matters because EU regulatory architecture was constructed on an implicit model of identifiable, licensed actors initiating discrete, auditable payment events. PSD2 assigns liability to payment service providers. GDPR assigns data-processing obligations to controllers. The AI Act assigns risk classification to deployers. The DSA assigns platform responsibility to intermediaries. None of these instruments was drafted to handle a payment chain in which an orchestrator AI agent delegates cart optimisation to a sub-agent, which triggers a payment-initiation API call through an open-banking provider, completing a transaction the consumer authorised in general terms weeks earlier [20][24].

Placing a commerce architecture on the spectrum is therefore a design decision with direct consequences for which regulatory instrument applies, which actor bears liability, and how supervisory intervention would reach the architecture in practice [5][12].

The spectrum can be divided into five structurally distinct positions, differentiated by where discretion resides and what triggers machine action.

At the fully human pole, every decision (product selection, payment authorisation, timing) is made and confirmed by a natural person. Machines supply information but initiate nothing. Regulatory fit is clean: the human is the accountable actor, and every existing instrument maps onto that actor without ambiguity.

At the AI-assisted position, a model generates recommendations (price optimisation outputs, product rankings, fraud-risk scores), and a human confirms or rejects each one before any external action occurs. Discretion remains with the human; the machine narrows the choice set. Regulatory exposure is limited primarily to GDPR obligations on automated processing and AI Act transparency requirements for high-risk recommendation systems [1][2].

At the human-supervised agent position, a machine executes defined classes of action autonomously, including initiating a subscription renewal or completing a pre-approved cart, but a human supervisor retains the structural capacity to halt, audit, or reverse the agent within a defined window. This is the position occupied by most current European agentic commerce deployments. Discretion is split: the agent holds it during execution; the human holds it at the boundary. PSD2 liability allocation rules were not written for this split, and the Strong Customer Authentication exemption framework does not map cleanly onto multi-agent pipelines. The recurring-transaction exemption under PSD2 RTS Article 14 applies where a payer has authorised a series of transactions to the same payee; the merchant-initiated transaction carve-out operates where the payee, not the payer, triggers execution within a pre-agreed mandate. Neither exemption was designed for a configuration in which an orchestrator agent delegates payment initiation to a sub-agent that then calls a third-party open-banking API, because that configuration distributes the roles of payer, payee, and initiating party across actors the exemption logic treats as unitary [20][24].

At the delegated multi-agent position, an orchestrator agent decomposes a commercial task and assigns sub-tasks to specialised sub-agents, which execute concurrently or sequentially. No human touches the execution chain between the initial instruction and the completed transaction. Discretion has been wholly pre-delegated. Accountability nodes are distributed across orchestrator, sub-agents, API providers, and PSPs, a configuration that existing EU instruments address in fragments [17][24].

At the fully autonomous pole, machines select products, negotiate terms, initiate payment, and handle post-transaction exceptions without any human-defined execution boundary. Discretion is fully machine-held. This position has no stable regulatory home under current EU law and is the theoretical endpoint that cost and latency pressures push architectures toward [6][11].

Movement along the spectrum produces three distinct, traceable consequences: liability allocation, supervisory reach, and consumer recourse.

On liability allocation, the mid-spectrum positions generate the most ambiguous exposure. When a human-supervised agent or delegated pipeline initiates a payment that results in fraud or an erroneous transaction, the question of which actor bears the PSD2 liability (the payment service provider, the merchant deploying the agent, the open-banking API provider, or the orchestrator-agent operator) cannot be resolved by reading any single instrument. The AI Act's risk classification for high-risk AI systems adds a compliance layer but does not assign payment liability. GDPR's data-processing obligations apply to the personal data consumed by the agent but do not govern the commercial outcome. This fragmentation means that unresolved fraud liability at mid-spectrum positions is structurally absorbed by PSPs and merchants as a cost of operating without a clear adjudication mechanism [20][24].

On supervisory reach, national competent authorities retain meaningful intervention capacity at the fully human and AI-assisted positions, where transaction trails are legible and actors are identifiable. At the delegated multi-agent position, the transaction trail passes through multiple API layers, potentially across several EU jurisdictions, before completing. Real-time supervisory visibility requires standardised API reporting that EU frameworks have not consistently mandated [20][25]. The experimentalist governance architecture underlying EU FinTech regulation, which centres on framework goals, peer review, and periodic reporting, was designed for licensed institutions with stable organisational boundaries, not for agent pipelines that may instantiate dynamically per transaction.

On consumer recourse, platforms operating at the human-supervised agent position retain a structural mechanism for consumer recourse: the human supervisor can reverse an action within the oversight window. Platforms that migrate toward delegated multi-agent execution remove that mechanism, transferring recourse responsibility to post-transaction dispute processes that were designed for simpler actor configurations [7][23]. Consumer vulnerability to opaque, data-intensive platforms is a documented concern in the EU FinTech policy literature [24], and the recourse deficit widens as the execution boundary moves further from human confirmation.