The sovereignty scorecard

Traditional e-commerce locates human decision-making at the point of purchase: a consumer selects, authorises, and confirms each transaction. The regulatory architecture built around this model (payment services directives, consumer protection law, data protection rights) assumes a human actor whose consent can be obtained at a defined moment and whose recourse can be addressed through a defined pathway.

Agentic commerce displaces that assumption. An AI agent operating on delegated authority selects, negotiates, and executes transactions across multiple merchant and payment-rail integrations without per-transaction human authorisation. The architecture that supports this capability is layered: cloud and compute infrastructure at the base; LLM orchestration and reasoning above it; identity-credentialing and permission-scope management above that; payment rails and settlement mechanisms; merchant interfaces; and consumer-experience surfaces at the top [2][3]. Each layer involves different technical operators, different contractual relationships, and, critically, different regulatory perimeters.

The sovereignty question for the EU is therefore not a single question about one instrument or one authority. It is a set of layer-specific questions about which actors govern each stratum, under which jurisdiction, with which enforcement mechanism. Platform intermediation at any layer concentrates governance power in the operator of that layer [1][4], and when that operator is incorporated outside the EU, the formal regulatory perimeter and the practical control boundary diverge. The scorecard exists to map that divergence with precision rather than to produce a single headline rating that would obscure it.

The scorecard assigns a control rating to each architectural layer of the agentic commerce stack using two independently assessed conditions. The first condition is operative regulatory attachment: whether an enforceable EU instrument, with a current application date, binds the specific decision loops, data flows, and identity scopes operating at that layer. Proposed legislation, politically agreed texts pending Official Journal publication, and soft-law guidance each receive a materially lower weight than operative hard law with a designated supervisory authority and sanction mechanism. The second condition is user-governance mechanism maturity: whether consent, recourse, and human-oversight rights are implemented and enforceable at the consumer-experience layer for the transaction type in question [10][11].

A layer achieves a high-control rating only when both conditions are satisfied. This two-condition structure is deliberate. A single composite score would obscure the recurring gap in EU digital regulation: instruments that establish strong institutional obligations on intermediaries while leaving the consumer-facing governance apparatus underdeveloped. The payment-rail layer illustrates this precisely. EBA licensing obligations under PSD2 bind payment service providers with specificity, yet operative consumer-recourse mechanisms for transactions initiated by an autonomous agent acting on delegated authority are absent from current EU law [12]. Rating that layer as high-control on the basis of intermediary regulation alone would produce a systematically misleading output. The scorecard therefore requires a separate rating on each condition, with the composite control score set to the lower of the two.

The grid's four enumerated entries correspond directly to the scorecard's coverage: the first entry states the overall finding across all layers; the three that follow represent the three layers assessed in detail (payment rails, orchestration, and data infrastructure). Each layer is assessed independently against both conditions; the narrative that follows this grid elaborates the specific regulatory instruments, application dates, and governance gaps at each layer.

Three specific fractures follow from the scorecard's dual-condition structure. First, the orchestration and intelligence layer operates without operative EU regulatory attachment to its specific control points. The AI Act's GPAI provisions, operative from August 2024, address model-level transparency and systemic-risk obligations for general-purpose model providers. They do not assign supervisory jurisdiction over the autonomous agent's permission scope or identity-delegation chain as distinct from the underlying model. The Annex III high-risk obligations, which carry more targeted supervisory requirements, apply from August 2026 and were framed for systems with defined input-output boundaries and a human decision-maker in the loop. Neither tier reaches the orchestration layer's most consequential control point: the agent's real-time authority to select, negotiate, and execute transactions on a natural person's behalf [6][9].

Second, the data and identity-infrastructure layer is subject to fragmented supervisory authority. Transactional data generated by agent-mediated commerce falls within the scope of GDPR, the Data Governance Act, and financial data regulations simultaneously, without a designated authority holding consolidated oversight [8][10]. The FiDA framework addresses financial data spaces through a hybrid hard-law and soft-law co-regulatory structure; its operative application date and the scope of mandatory participation for agentic intermediaries await supervisory clarification [11]. The result is a layer where regulatory intent is established as an identified risk position but operative control is not.

Third, the consumer-experience layer carries a structural governance deficit that runs across all other layers. Even where intermediary obligations exist at the payment-rail or merchant-interface layer, the consumer's ability to identify that an agent rather than a human initiated a transaction, contest that transaction through a defined recourse pathway, and withdraw delegated authority without foreclosing commerce access is not addressed in any operative EU instrument reviewed here [4][12]. This deficit means that sovereignty claims resting on intermediary regulation alone overstate the EU's actual control position.