An AI agent placed the order and accepted the terms. Is that a contract, and who is bound?

Automation stopped being a defence in 1999

The Uniform Electronic Transactions Act defines an electronic agent as a program or automated means "used independently to initiate an action or respond to electronic records or performances, in whole or in part, without review or action by an individual". Section 14 then provides that a contract may be formed by the interaction of electronic agents, or of an electronic agent and a person, even where nobody read the terms. The federal E-SIGN Act adds the hinge at 15 U.S.C. § 7001(h): the record keeps its effect "so long as the action of any such electronic agent is legally attributable to the person to be bound".

That is a narrow victory, and it is worth being precise about what it settles. It answers one objection — that no human formed an intention — and nothing else. Attribution, scope of authority, mistake and proof are all left to other law, and UETA § 14(3) says as much: "the terms of the contract are determined by the substantive law applicable to it". Our guide to what a chatbot can commit a business to covers the sell-side version of the same statutes; this one is about the side that buys.

The agent is a tool, which is why the exposure is yours

In August 2026 the Ninth Circuit had to decide whether an AI shopping agent "accessed" a retailer's computers. Its answer turned on something more general: "However advanced the Assistant currently is, it is a tool, not a person for statutory purposes." An agent has no legal personality, holds no assets and cannot be sued. It is an instrumentality of whoever deployed it, in the same category as a form, a script or a standing order.

So the question is never what the agent intended. It is whether the purchase is your act. Two things decide that, and only one of them is inside your control. Actual authority is what you configured — the spending cap, the vendor allowlist, the categories, the human-approval gate above a threshold. Apparent authority is what the seller could reasonably conclude from what you held out. A configuration file is now a document about legal authority, not just an operational setting, and it is the first thing anyone will ask to see.

It bought a hundred of them. Is there a way out?

UETA § 10 carries a provision on errors in automated transactions, and at first reading it looks like the answer. It is not, and the mismatch is worth reading carefully because it is the single most over-claimed point in this area. The provision lets an individual avoid the effect of an electronic record produced by an error the individual made in dealing with the electronic agent of another person, and only where that agent gave no opportunity to prevent or correct the error, and the individual promptly gives notice, returns anything received and has taken no benefit from it.

A company whose own purchasing agent misread a unit field and ordered a hundred is outside every element of that. It is not an individual, the error was not made in dealing with someone else's agent, and the checkout page it clicked through almost certainly did show a confirmation step. UETA § 10(4) forecloses the obvious workaround too: that paragraph and the fallback below it cannot be varied by agreement.

What is left is the fallback in § 10(3): the error has the effect given by other law and by the parties' contract. In practice that means the seller's order-acceptance clause, its cancellation window and its returns policy — which is why the terms your agent is allowed to accept matter more than any rescission theory. A standing purchase order with your own terms attached is a better instrument than an argument about mistake after the fact.

The seller's terms are where the fight actually moved

Most consumer-facing sites prohibit automated access, scraping and bots somewhere in their terms. Until recently the assumed consequence was a federal computer-crime claim. That assumption has narrowed sharply. Amazon sued Perplexity in November 2025 over its Comet browser agent shopping on Amazon under users' own logins, and won a preliminary injunction in March 2026. On 4 August 2026 the Ninth Circuit vacated it, holding that Amazon was unlikely to succeed on the "access" element of the Computer Fraud and Abuse Act: "It is the user who accesses Amazon's computers, with the help of the Assistant to carry out specific acts on Amazon.com."

Read the limits as carefully as the holding. It is a preliminary-injunction ruling on the record as it stood, the panel expressly declined to "establish a new legal regime governing agentic AI", and it left tort claims untouched. Its footnote points at what survives: the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users". So the exposure for a business whose agent shops against a site that forbids it is contractual and commercial — account termination, cancelled orders, a breach claim — rather than criminal. That is a real change in shape, not a free pass.

The other half of the answer is that sellers are starting to offer a front door instead of a fence. Visa and Cloudflare published the Trusted Agent Protocol in October 2025, which signs an agent's identity into the HTTP request so a merchant can recognise an accountable agent rather than an anonymous bot. The Agentic Commerce Protocol, an open standard from Stripe, OpenAI and Meta, defines agent-driven checkout while keeping the business as merchant of record. Using a declared channel converts the same purchase from a possible terms breach into an anticipated one. If you run the site, what makes your terms of service binding is where to start; the website terms of use is where the automated-access clause lives.

Why the chargeback is probably not there

The reflex when an agent buys something unwanted is to dispute the charge as unauthorised. Regulation Z defines unauthorised use as "the use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit". An agent you configured, funded and pointed at a merchant fails that test on every limb. The $50 cap at 12 CFR § 1026.12(b) is not the route.

The billing-error procedure at § 1026.13 is, but on different grounds — goods not accepted or not delivered as agreed — and it runs out 60 days after the creditor transmits the first periodic statement showing the charge. Regulation E takes the same line on debit and bank rails: § 1005.2(m) carves out transfers "initiated by a person who was furnished the access device to the consumer's account by the consumer" unless the institution was told that authority ended. And if the card is a company card, § 1026.3(a) exempts business-purpose credit from Regulation Z altogether, so none of the consumer machinery applies. Revoking the agent's credential is the act that changes your position, and the sooner it happens the better; disputing a card payment sets out how the underlying process runs.

If you cannot prove which agent acted, you have no argument

UETA § 9 makes an electronic record attributable to a person "if it was the act of the person", and lets that be shown in any manner, including the efficacy of any security procedure applied to identify who acted. That cuts both ways. It is how a seller pins an order on you, and it is the only way you ever show an order fell outside the scope you set. A business that cannot reconstruct which agent ran, under whose credentials, on what instruction, has conceded the point before the argument starts.

Two clauses are worth adding on each side. In your contract with a counterparty who may transact with you by agent: a statement that orders placed through a declared agent channel are the principal's orders, a notice route for revoking an agent's authority, and a retention commitment for the transaction log. Internally, the same discipline that governs corporate cards — named owner, stated limits, exception reporting — belongs in an AI use policy, because the limits in it are what your authority argument will consist of.

What is genuinely unsettled

Not much of this rests on case law, and pretending otherwise would be the wrong service. No United States court has yet decided whether a business is bound by a purchase its own autonomous agent made outside the scope it was given; the Ninth Circuit decision is about computer access, not contract formation, and it says plainly that it does not set a regime. The uniform-law layer has not moved either — UETA is unamended and still reads as it did in 1999. At the federal level there is a discussion draft, the AI AGENT Act released by Senator Warner on 29 June 2026, which would build an FTC registry of vetted agents and require large platforms to admit users' own agents; it has not been introduced, and it leaves liability allocation open. Assume the gap stays open for a while, and that the record you kept is what fills it.