On 11 November 2026, the European Commission presented its proposal for a Digital Fairness Act. The proposed regulation would repeal the Unfair Commercial Practices Directive and add a new chapter of rules for digital markets, covering dark patterns, influencer marketing, personalised advertising and pricing, in-game spending, addictive design, ticketing and subscriptions. For businesses that build or deploy artificial intelligence (AI), the most consequential provision is Article 26, which governs software that concludes contracts on a consumer’s behalf.
The proposal arrives three months after the United States Court of Appeals for the Ninth Circuit vacated a preliminary injunction that Amazon obtained against Perplexity’s Comet shopping agent. On the record before it, the court held that the user who directs the agent is the person who accesses Amazon’s systems for the purposes of the US Computer Fraud and Abuse Act. The Commission’s proposal rests on a comparable premise: an agent acting on a consumer’s instructions acts for the consumer, and consumer law continues to apply when the agent does the buying.
A regulation in place of a directive
The proposal carries over the substance of the Unfair Commercial Practices Directive. It converts it into a directly applicable regulation, replacing 27 national transposing regimes and allowing the Commission to enforce directly in certain cross-border cases under a proposed revision of the Consumer Protection Cooperation Regulation published alongside it. The new obligations are set out in Chapter III, titled “Digital fairness”, and a breach of any of them constitutes an unfair commercial practice in its own right. Once the European Parliament and the Council agree on a final text, the rules would apply 12 months after entry into force.
AI agents and automated contracting
Article 3 defines an “automated system” as software capable of carrying out actions and making decisions that produce legal effects for its user, including concluding contracts, without the need for human intervention. The recitals confirm that this captures AI systems, including those subject to human oversight, and the definition reaches well beyond conversational assistants to any software that can, for example, reorder household supplies unprompted.
Article 26 applies to traders that make such systems available to consumers, so it covers a retailer’s own shopping assistant as well as an independent agent that buys across many merchants. On first use, the consumer must expressly choose whether to confirm every contract the agent proposes, confirm only certain contracts defined by criteria the consumer sets, such as a maximum price, or dispense with confirmation altogether, and may change that choice at any time. Where confirmation is chosen, the agent must present key pre-contractual information before the consumer commits, and the recitals state that using an agent does not waive consumer rights, even under full autonomy
Article 27 eases information duties where both sides of a transaction are automated, and financial services fall outside Article 26.
Payments and conflicts of interest
The sharpest clause is Article 26(4)(b). Where the agent’s provider receives any payment for proposing a contract, or has any conflict of interest with the merchant concerned, the agent must disclose it and obtain the consumer’s confirmation, regardless of the autonomy setting the consumer chose. The recitals give sponsored suggestions and examples of a merchant’s product preferences. This is a duty of loyalty, the obligation of an agent to put its principal first, written as a product specification. An agent funded by subscriptions may act alone within its mandate. In contrast, one funded by commissions, affiliate fees, or sponsored placements must stop and ask each time a conflicted contract is proposed, thereby making autonomy the privilege of the unconflicted.
One point remains open. A retailer’s own assistant proposing the retailer’s own products has an obvious interest in the sale, and the reference to preferencing in the recitals appears apt to cover it, in which case a merchant-operated agent could never buy autonomously from its own catalogue.
Questions the proposal leaves open
The omissions are as significant as the rules. Article 2 leaves the validity, formation and effect of contracts to national law, so 27 legal systems will decide who bears the loss when an agent misreads an instruction. The prohibition of dark patterns in Article 10 is framed around interfaces that deceive or manipulate consumers. It is silent on merchants that manipulate the agent itself, for instance, through instructions hidden on a product page, and whether the general rules apply to that conduct will depend on whether an agent’s decision counts as the consumer’s transactional decision. Article 26 prevents merchants from compelling consumers to use agents, yet nothing in the proposal obliges merchants to admit them, which was precisely the issue in the Amazon litigation.
Article 36 also gives a trader held liable for an unfair online practice a right of recourse against business partners whose conduct contributed to the infringement, a right the recitals expressly link to third-party software and algorithmic systems, so agent providers building on third-party models should expect it to feature in supply contract negotiations.
AI Act authorities and other AI provisions
Article 17 requires traders whose products are designed, or can reasonably be foreseen to be, to encourage compulsive or excessive use, to allow consumers to disable specified features. These include features that simulate interpersonal relations, such as persistent prompts to keep engaging with an automated system, which the recitals link to AI companions and general conversational chatbots. Article 30 assigns enforcement of that obligation against providers and deployers of AI systems within the scope of the AI Act to the authorities designated under Articles 70, 74 and 75 of that Act. It extends the Commission’s AI Act market surveillance powers to it, so the chatbot’s engagement design could be supervised by the authority responsible for its AI Act compliance.
Article 25 gives consumers the right, on request and where other means are ineffective, to communicate with a human being in post-contract customer service. The recitals extend the restrictions on personalised advertising to product recommendations made
in natural language systems, and Article 34 allows courts and authorities to order disclosure of evidence on how an online practice is designed and operates, subject to protection for trade secrets.
Dark patterns, personalisation and subscriptions
Article 10 prohibits online interfaces that are likely to deceive or manipulate consumers, or otherwise materially distort their economic behaviour, and is supported by a list of dark patterns that are unfair in all circumstances. Influencer marketing must be labelled “advertisement” or “commercial collaboration”, with brands required to secure compliance by contract. Targeted advertising based on profiling is prohibited where the trader is aware with reasonable certainty that the consumer is a minor, or where it uses special categories of personal data, and price personalisation reasonably likely to harm minors or vulnerable consumers is also prohibited.
In games and apps, prices in paid-for virtual currency must show their monetary value, loot boxes must disclose the odds and may not be offered to minors, and pay-to-win mechanics are prohibited for minors. Ticket sellers using dynamic pricing must disclose the maximum price payable, and resellers must display the original price. A consumer would be bound by a paid contract after a free trial only after a reminder and express agreement. Automatically renewing contracts attract reminder duties and, once extended indefinitely, may be ended on a month’s notice. Traders selling online must offer a “terminate the contract here” function.
Enforcement and next steps
The Commission could impose fines of up to 6% of worldwide annual turnover in widespread cross-border cases it investigates itself, and the accompanying Consumer Protection Cooperation proposal would require traders established outside the Union to appoint a legal representative within the Union, a requirement likely to apply to many AI developers.
The proposal will change in negotiation. However, businesses building or deploying agents should already map whether they fall within Article 26, how a first-use mandate would work in their products, which commercial arrangements would trigger the conflict rule, and how their supply contracts allocate risk. All online businesses should also review interface design, subscription flows, influencer arrangements and personalisation practices against Chapter III. The proposal proceeds on the basis that the agent’s act is the consumer’s act. What the agent owes the consumer when that act goes wrong is, for now, a question it leaves to national law.
Contributed by: Anny Svinti
