Sen. Mark Warner [D-Va.] has released a discussion draft of legislation that would create the first federal framework governing AI agents that act on consumers’ behalf online, pairing the proposal with a letter urging the Treasury Department to develop rules for agentic AI in financial services.
The two moves signal that Washington is beginning to grapple with a question of what happens when the “consumer” on the other end of a payment, dispute, or account interaction is actually a piece of software.
The draft bill, the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act of 2026, or AI AGENT Act, would establish a category of “custodial user agents,” software that a consumer expressly authorizes to interact with large online platforms on their behalf. The authorization would have to be transparent, documented, limited in scope, and revocable.
The proposal’s core provisions impose fiduciary-style duties on these agents. A covered agent could not act in ways that benefit itself at the user’s expense, cause foreseeable harm, or contradict the user’s directions. It could not collect, use, or share consumer data except as necessary to perform the delegated service, and the draft flatly prohibits repurposing that data for advertising, behavioral profiling, or sale. Those duties could not be waived by contract, terms of service, or user consent.
Agents would be required to register with the Federal Trade Commission before accessing platform interfaces, maintain real-time records of actions taken on a consumer’s behalf, and obtain express authorization before handing off authority to another system. Platforms with more than 50 million monthly U.S. customers, a definition covering social media, e-commerce, personal finance, and AI services, would have to maintain nondiscriminatory interfaces for authorized agents. Violations would be enforced by the FTC as unfair or deceptive practices, with each affected consumer counted as a separate violation. The FTC would coordinate implementing regulations with the CFPB, FDIC, and OCC.
Notably for an industry watching the state-versus-federal AI regulation fight, the draft preempts state law only where it directly conflicts, leaving state AI and privacy regimes largely intact. The bill also expressly preserves the FDCPA, FCRA, and Gramm-Leach-Bliley Act.
In his companion letter to Treasury Secretary Scott Bessent, Warner asked how existing laws allocate liability between institutions and consumers when an agent makes a mistake, is defrauded, or causes losses, and pressed for guidance on how banks should oversee AI-enabled third-party vendors and emerging agentic payment rails.
Warner released the measure as a discussion draft to gather stakeholder input before formal introduction.
Read the letter. Read the draft bill
