Agentic Commerce Just Crossed a Threshold: The First Real Transactions Are Live

Two things happened this week that change the timeline for every e-commerce developer.

First, Nuvei completed a live in-agent payment proof of concept with Visa - real transactions, real merchants, real money flowing through AI agents. Not a sandbox. Not a partnership announcement. A payment processor, a card network, and actual merchants processing actual purchases initiated by AI agents.

Second, Salling Group and Google launched agentic commerce in production - the first regional retail deployment where AI agents are streamlining the shopping experience end-to-end. A real retailer, not a tech demo. Denmark's largest retailer, putting agentic commerce in front of real customers.

These aren't the same kind of signals we've been getting all year. They're qualitatively different. Here's why.

The Shift: From "Coming Soon" to "Operating Now"

The agentic commerce conversation has been running on two tracks since January 2026. Track one: the infrastructure announcements - Mastercard backing UCP, Shopify shipping Agentic Storefronts, Google AI Mode entering production. Track two: the deployment question - "when will anyone actually use this?"

Track two just got answered.

Nuvei's live PoC means the payment layer isn't theoretical. Visa Intelligent Commerce - the network that signed 100+ partners and has 30+ organizations in sandbox and 20+ agents integrating - now has live transactions in the wild. The agent says "buy this" and money moves. Real settlement, real authorization, real merchant accounts.

Salling Group's deployment means the discovery-to-storefront chain is operating at retail scale. Google AI Mode discovers products. The agent navigates the storefront. A real retailer with real inventory, real pricing, real customers. This is not a startup experiment - it's a major regional retailer betting a live customer experience on agentic commerce infrastructure.

Here's the timeline compression this represents:

The gap between "infrastructure announcement" and "live transactions" was six months. Not two years. Not "eventually." Six months.

If you've been treating UCP implementation as a Q4 project or a 2027 item, the timeline just moved up. The stores processing AI-driven transactions right now are the ones that already have valid UCP profiles. The ones that don't? They're not even visible to the agents that just started spending real money.

What the First Deployments Reveal About "Ready"

These first live transactions tell us three things about what "agentic commerce ready" actually means - and they're different from what most developers assume.

1. "Valid JSON" Is Not "Transaction Ready"

The Nuvei PoC didn't succeed because merchants had well-formatted UCP manifests. It succeeded because the full chain worked: the agent could discover the merchant, authenticate, browse products, add to cart, initiate checkout, and complete payment - end to end, without human intervention at any step.

This is the gap most UCP validation misses. A profile can pass structural validation (valid JSON, required fields) and rules validation (capability consistency, namespace matching) and still fail when an agent actually tries to use it. The payment handler that works in your test environment but requires a redirect that the agent can't follow. The Identity Linking endpoint that returns 200 but fails cross-domain recognition. The Cart capability where "add" works but "view" doesn't.

The first real transactions proved that end-to-end testing isn't optional. The agents don't retry. They don't work around broken endpoints. If any link in the chain fails, the transaction doesn't happen.

2. The Stack Works as a Chain, Not as Layers

The Salling Group deployment demonstrates something that separate partnership announcements don't: the three layers have to work together in sequence.

Discovery (Google AI Mode) finds the product. Storefront (Shopify/merchant platform) presents it. Payment (Mastercard/Visa) processes the purchase. If discovery works but payment fails, the agent found a product it couldn't buy. If payment works but discovery can't find the store, the transaction-ready merchant is invisible.

This sounds obvious, but the developer experience today is siloed. You test your payment integration separately from your catalog endpoint. You validate your manifest separately from your checkout flow. The Salling Group deployment proves this doesn't work - the agent traverses all three layers in a single session, and a failure at any point kills the entire interaction.

3. Cryptographic Trust Is the Foundation

Jesse McWaters (former Mastercard, now at a stealth agentic commerce startup) posted this week: "The biggest challenge in agentic commerce isn't payments. It's trust. How do you know an AI agent is acting within the scope of what a human actually authorized?"

The answer, from the protocol perspective, is UCP's signing_keys. When your manifest includes cryptographic keys and signs outgoing agent responses, the agent can verify: (a) this merchant is who it claims to be, (b) this response hasn't been tampered with, (c) this transaction was authorized by a real human.

Missing signing_keys is the single most common UCP validation failure. It's also the one that maps directly to the trust problem the industry is now identifying as the critical bottleneck. The first live transactions worked because the merchants in those deployments had their cryptographic verification chain intact. The merchants who skip this step - and most do - are building on sand.

What to Do Right Now

The threshold has been crossed. Here's what matters:

1. Run an end-to-end agent simulation, not just a manifest check.

Validation that stops at "valid JSON" tells you nothing about transaction readiness. You need to know whether an AI agent can actually browse your catalog, add items to cart, initiate checkout, and complete payment. The Nuvei PoC proved this is the real bar.

2. Test across all three layers in sequence.

Don't validate your payment handler independently of your catalog. Don't test discovery separately from checkout. Run the full chain in order - discovery, storefront, payment - and verify that every link holds. The Salling Group deployment proved that the chain breaks at the weakest link.

3. Fix your cryptographic trust layer.

If your UCP manifest doesn't include signing_keys, agents cannot verify your identity. They may still interact with your endpoints, but they can't trust the results. As the industry converges on "trust" as the critical challenge, merchants without signed manifests will be treated as untrusted - which in agentic commerce means invisible.

4. Set up monitoring.

Your UCP profile will break. TLS certificates rotate. Platform updates change manifest shapes. Payment gateway configurations drift. When this happens, you won't get an error in your dashboard. You'll just stop appearing in AI shopping results. Monitoring catches these failures before they cost you transactions.

The Window Is Closing

McKinsey projects up to $1 trillion in US agentic commerce by 2030. Shopify reported 13x year-over-year growth in AI search orders before Agentic Storefronts shipped. Cloudflare reports bots now surpass human traffic online.

The protocol war is effectively settled. UCP has the discovery layer (Google), the storefront layer (Shopify), the payment layer (Mastercard + Visa), and now - as of this week - live transactions flowing through all three.

The stores capturing AI-driven orders right now aren't the ones with the best marketing. They're the ones with valid UCP profiles. The stores without them? The agents just spent their first real money this week, and they didn't spend it at those stores.

Run a free end-to-end validation and see if your store is visible to the agents that are now transacting with real money.