In Prague, for the first time in the Czech Republic, an AI agent paid with a card. Mastercard and ČSOB tested Agent Pay. Mastercard and Československá obchodní banka carried out the first transaction in the Czech Republic in Prague, which was independently carried out by an AI agent with a card. We have recently written about purchases made through AI in our article. In a pilot test of Mastercard’s Agent Pay service, the user searched for and purchased an experience (a coffee tasting) without having to manually enter their credit card details. The test used PayOS infrastructure and the Priceless.com platform and, according to Mastercard, demonstrated that autonomous purchases can be secure, authenticated and under consumer control.
What new awaits you?
Until now, AI in the payment chain has been on the analysis side — banks use it to assess fraud, segment clients, and recommend products. Agent Pay reverses the role: AI is the initiator of the transaction, not a passive observer. The real card number does not move around in the system at all — it is replaced by an encrypted token, similar to Apple Pay or Google Pay, only with extended data for the issuer, which then knows that the payment was initiated by a digital agent. Every purchase is under biometric consent or via Passkeys.
In the context of the Czech market, this is the first implementation by a domestic bank. Globally, Agent Pay is one of the card schemes' responses to the "agent AI" phenomenon — Visa has its own Visa Intelligent Commerce initiative, Stripe announced an agentic toolkit for developers, and OpenAI/Anthropic are adding a payment interface to their models. For Comgate, GoPay, Adyen, and other gateways, this means that the "checkout" platform will have to cope with a non-traditional client — a buyer who is not a human at a browser — within two to three years.
What does this mean for a Czech entrepreneur?
Short term (until the end of 2026): nothing. The test has been closed and Agent Pay does not yet affect any regular e-shop or gastro operation. Most merchants whose shopping journey goes through ČSOB or a Comgate-type gateway will not see anything unusual in the statement.
Medium-term (2027–2028): expect payment gateways to start distinguishing between human and agent transactions. For e-commerce, this could mean a new type of conversion — the visitor will no longer be a browser, but an assistant who compares and buys for the customer. The key will be whether your catalog is machine-readable (structured data, MCP/API, tokenized availability) and whether your prices make sense beyond SEO logic.
Long term: routine purchases (office supplies, subscriptions, repeat grocery purchases) will increasingly go through the agent. Customer loyalty will shift from the brand to the rules that the agent receives from the user.
What should you bring?
- If you run an e-shop, check with your gateway (Comgate, GoPay, Stripe, Adyen, KB SmartPay) whether it can distinguish between agent transactions — this will likely be a parameter in reporting during 2026–2027.
- Structured data about products (Schema.org Product, prices, availability via API) will cease to be an SEO bonus and become a condition for an agent to even see you.
- Watch for when ČSOB or Komerční banka expand Agent Pay from a pilot to a production offering for corporate clients — this is a signal that the service will become part of regular packages.
- In catering and recurring purchase services (subscriptions, imports), think about how you want to be represented in the agent purchasing interface — it's usually the same theme as clean product names and understandable prices.
- Security: there is no reason to proactively change anything. Tokenization and biometrics remain on the bank and card scheme side, you invoice normally.
Glossary of terms
- AI agent (agent AI): software that independently performs steps based on the user's goal — search for a product, fill out a form, pay — without the need to confirm each action manually.
- Agent Pay: Mastercard's commercial service that allows an AI agent to initiate a card payment within a token, with the user's biometric consent.
- Tokenization: a technique where the real card number is replaced with a one-time or domain-limited token; both the merchant and the attacker see only the token, which by itself will not enable payment elsewhere.
- Passkey: a modern password-free login standard (FIDO2) that uses a cryptographic key stored on the device and biometrics (Face ID, fingerprint).
- Acquiring (card acceptance): a service thanks to which a merchant accepts card payments; in the Czech Republic it is provided by, for example, ČSOB, KB SmartPay, Global Payments, Comgate, GoPay, Stripe, Adyen, SumUp, myPOS, Teya or Viva Wallet.
- Card issuer: the bank that issued the card — in this test, ČSOB.
- Card scheme: Visa, Mastercard and others; set the rules for how money moves between the issuer and the accepting merchant.
- PayOS: payment infrastructure that ČSOB used in the test to connect the AI agent with a tokenized card.
