August 2, 2026. Today marks the enforcement date for the EU AI Act's high-risk obligations — the most consequential AI regulation in history. But while regulators have spent years debating model safety, transparency, and risk classification, one question remains completely unaddressed: what happens when AI agents spend money?
Three major regulatory frameworks converge around today's date — and none of them contain provisions for autonomous machine-to-machine payments:
| Framework | Status | M2M Payments? |
|---|---|---|
| EU AI Act | High-risk obligations effective today | ❌ Not addressed |
| GENIUS Act (US) | Implementation deadline July 18, 2026 | ❌ Not addressed |
| MiCA (EU) | Transitional period ended July 1, 2026 | ❌ Not addressed |
This is not a drafting oversight. It's a category error: these frameworks regulate humans using AI. They don't contemplate AI acting as an economic principal — making its own decisions about when and how much to pay for services.
Here's the problem in practice. An AI agent — say, a coding assistant — needs to call a token security check API before deploying a smart contract. It receives an HTTP 402 response with a $0.01 USDC fee. It signs the payment and gets the security data.
Who is legally responsible for that transaction?
The EU AI Act's high-risk classification system — which applies to "remote biometric identification," "critical infrastructure," "education," "employment," and other domains — says nothing about financial liability when an AI system autonomously incurs costs. And with stablecoins, once funds land in a merchant wallet, they cannot be recalled. The risk sits entirely with whoever funded the agent's wallet.
The Keyrock report found that 98.6% of all agent payments settle in USDC — a stablecoin with no chargeback mechanism. Traditional card rails have dispute resolution built in. Agent payment rails don't.
This isn't just a legal theory problem. It's a product design problem. The way to make autonomous agent payments safe isn't to ban them — it's to build infrastructure that makes them auditable, limitable, and reversible when necessary.
American Express was first to recognize this, launching Agent Purchase Protection on April 14, 2026. But Amex's solution is a wrapper on card rails — and 76% of agent transactions fall below Visa's $0.30 fee floor. You can't insure a $0.01 API call with a $0.30 minimum fee.
The real answer is building compliance into the payment protocol itself. Here's what that looks like:
This is the model minia2a.uk has been building — a managed marketplace where AI agents discover and pay for services within an authorization envelope set by their human operators. 175 services. 320K+ requests. Free trials on every endpoint. And every transaction recorded.
While regulators catch up, the private sector is assembling the infrastructure:
| Layer | What It Does | Who's Building It |
|---|---|---|
| Authorization | Humans delegate spending authority to agents | Google AP2, Visa Agent Credentials |
| Discovery | Agents find services they can pay for | minia2a.uk, ERC-8004, 8004scan.io |
| Protocol | HTTP 402 handshake — price, payment, delivery | x402 (Coinbase/Linux Foundation), MPP (Stripe) |
| Settlement | Actual money movement | USDC on Base/Solana, XDC gasless USDC |
| Facilitation | Merchant onboarding, compliance, fiat off-ramp | Coinbase, Stripe/Bridge, KakaoPay, Galaxy Money Tree |
This stack is maturing faster than the regulatory frameworks that should govern it. The EU AI Act's enforcement today is a milestone — but it's incomplete without M2M payment provisions. The next wave of regulation will have to address the question that today's frameworks ducked: when an AI agent spends money, who is accountable?
The most likely near-term development: liability will follow the authorization layer. If you set a $10/month spending limit and your agent stays within it, the payment infrastructure (wallets, facilitators, protocols) bears the KYC/AML burden. If your agent exceeds limits because of a protocol bug, the protocol bears liability. If it exceeds limits because you configured it wrong, you do.
This is why authorization envelopes — not just payment protocols — are the critical missing piece. Google AP2 and Visa Agent Credentials are bets on this thesis. Managed marketplaces that combine discovery with spending controls are the practical implementation.
The EU AI Act is the beginning, not the end. The frameworks that actually govern agent payments will be written in the next 12–18 months — and they'll be shaped by the infrastructure that exists when they're drafted. Build infrastructure that makes compliance easy, and regulation follows.