What Is the Legal Context Protocol? The Legal Layer for AI Shopping

The Legal Context Protocol tackles a question most people have never had to ask: when software buys something for you, who agreed to the terms? Today, for example, you tick a box at checkout. However, as AI shopping agents start completing purchases, that box is increasingly ticked by a machine acting on your behalf.

So far, payment networks and AI companies have built protocols for paying, checking out and proving an agent’s identity. Yet none of them, the LCP’s authors argue, standardise the legal side: which terms applied, which country’s law governs the deal and where a dispute goes. This explainer therefore covers what the protocol is, how it works and what it could mean for you. It also builds on our guide to agentic commerce, the broader shift toward agents that shop.

Why does AI shopping need a legal layer?

Traditionally, online shopping law grew up around a person at a screen. First you see the terms, then you click, and that click is your consent. Agents break that model, because the agent reads the terms and you may never see them.

Recent reporting by PYMNTS, in September 2026, also highlights the gap. For instance, when you authorise an agent to buy within a budget, that approval does not obviously cover every choice the agent makes. Meanwhile, PYMNTS notes that some retailers, Target among them, treat an agent’s selections as the customer’s own decisions once authorisation happens.

So disputes could get messy. For example, suppose an agent accepts a no-refund clause you would have rejected. Proving which version of the terms it saw, and when, is then hard without a record. As a result, the LCP’s authors aim to create exactly that record.

What is the Legal Context Protocol, exactly?

According to its official website, the Legal Context Protocol is “the open standard for adding legal context to agentic commerce.” It does not move money and does not replace checkout systems. Instead, it sits alongside them as an audit trail of the agreement.

The American Arbitration Association (AAA) announced it on June 24, 2026, together with the technology company Integra Ledger. Together, the two organisations act as co-stewards. AAA-ICDR, the association’s international arm, brings dispute-resolution expertise, while Integra Ledger maintains the reference implementation.

Currently, the specification sits on GitHub as a v1.0 document with a JSON Schema, published under the Apache 2.0 licence with no fees. The project describes this as a first public introduction and invites community review, so details may still change.

How does the Legal Context Protocol work?

The core idea is simple. First, a merchant publishes its terms at a predictable web address, and a buying agent checks them before it pays. Here is the flow, step by step, based on the specification.

1. The merchant publishes a discovery file. It lives at a standard location on the merchant’s domain: /.well-known/legal-context.json. This mirrors how websites already publish files such as robots.txt.
2. The file points to the terms. Its only required field, terms, is a link to the terms document, which can be Markdown, JSON, plain text or PDF.
3. An optional fingerprint proves the version. A field called atrHash holds a SHA-256 hash of the terms. So if anyone changes even one character, the hash no longer matches.
4. The agent checks before buying. First, one web request fetches the legal context. Then the agent compares the terms against its user’s rules.
5. The record travels with the payment. Next, the agent stores the accepted terms’ fingerprint with the transaction, and both sides keep a copy of the terms.

Afterwards, either party can recalculate the fingerprint to show which terms applied. Overall, the AAA describes the result as tamper-evident, transaction-specific proof. Notably, no blockchain, API keys or third-party service is required, although blockchain networks can use it.

The four trust levels explained

Not every purchase needs the same proof. After all, a coffee and a business software contract carry very different stakes. For that reason, the protocol defines four optional levels, and a merchant implements only what suits its sales.

Level	Name	What it adds	Typical use
1	Informational	Terms can be found at the standard address; proceeding implies consent	Low-stakes purchases
2	Provable	A hash proves the terms have not changed	Everyday orders where a record helps
3	Signed	A digital signature binds a named party to specific terms	High-value deals
4	Integrated	Connects to dispute resolution, escrow and compliance systems	Enterprise and regulated sectors

In practice, most consumer shopping would probably sit at levels 1 or 2. That said, this is our judgement, not a rule in the specification. Meanwhile, signed and integrated levels look aimed at business purchasing. There, a Gartner projection quoted by the AAA expects AI agents to intermediate 90% of B2B purchases by 2028.

What is a buyer policy in the Legal Context Protocol?

For consumers, the buyer policy is the most relevant part. It describes the rules your agent applies before accepting a seller’s terms. Specifically, the specification lists five kinds of constraint.

Buyer policy rule	What it controls	Plain-English example
Spending cap	Maximum commitment per transaction	Never agree to more than $200 in one order
Acceptable jurisdictions	Which countries’ laws may govern the deal	Only sellers under my home country’s law
Human approval threshold	Amount that triggers a check with you	Ask me before anything over $75
Minimum trust level	Lowest LCP level the seller must offer	Only buy where terms are at least provable
Dispute methods	Resolution routes you accept	Courts or online arbitration only

Picture how that might work. Say you tell a shopping agent to reorder printer ink. However, the merchant’s terms say disputes go to arbitration abroad, which your policy rejects. So the agent stops and asks you, rather than silently agreeing. Of course, this scenario is illustrative; whether consumer apps expose these settings is up to each AI company. Similarly, our guide to AI agent payments explains the spending controls card networks are building in parallel.

How LCP fits with other agent commerce protocols

Agent shopping already has an alphabet soup of standards. Still, the LCP positions itself as a layer that works with all of them. The specification lists integrations it says are available today, while deeper, first-class support would need changes from each protocol’s maintainers. If you are new to this area, start with our explainers on the Universal Commerce Protocol and the Model Context Protocol.

Protocol	Main job	How LCP attaches (per the spec)
x402	Payments over the web’s HTTP standard	Inside the payment requirements’ extra fields
Machine Payments Protocol (MPP)	Machine-to-machine payments	Inside the signed request body
Agentic Commerce Protocol (ACP)	Agent checkout	In checkout metadata
Visa Trusted Agent Protocol, Mastercard Agent Pay	Verifying trusted agents	Through custom headers

The key point is division of labour. In short, payment protocols prove that money moved and who sent it. The Legal Context Protocol, by contrast, aims to prove what both sides agreed to when it moved.

Who is behind the Legal Context Protocol?

Backing matters for any standard, because adoption decides whether it becomes useful. Indeed, the AAA lists a long set of founding contributors. On the commerce side, they include Google, IBM, Circle, UiPath and Wayfair. Several blockchain networks also joined, including the Stellar Development Foundation, Ava Labs, Cardano, Hedera, Mysten Labs, Aptos Foundation and Sei Labs.

The AAA’s president and chief executive, Bridget McCormack, framed the need in a September 2026 interview with PYMNTS. She said “the agentic economy needs that same capacity delivered at machine speed,” referring to the documentation that courts and arbitrators rely on. She also co-wrote the protocol’s white paper with Integra Ledger’s chief executive, David Fisher.

What does it mean for everyday shoppers?

Right now, very little changes for you. For instance, there is no consumer setting called “Legal Context Protocol” in ChatGPT, Gemini or any shopping app we could find documented. The standard mostly affects merchants and agent builders first.

Still, the idea points to habits worth adopting today if you let an agent shop for you.

• Keep spending limits low. Use the budget and approval settings your agent already offers, and also require a confirmation for large orders.
• Save your own records. Keep order confirmations and screenshots of key terms, such as return windows.
• Check returns before repeat orders. Agents follow your instructions literally, so tell them which refund terms you will accept.
• Know your payment protections. Card chargeback rights and consumer law still apply, whatever an agent clicked. So check your own bank or regulator for details.

Limitations and open questions

A standard only works if people use it. As of October 2026, the main GitHub repository shows modest activity, which suggests implementation is at an early stage. Several further limits deserve attention.

• Proof is not fairness. The protocol proves which terms applied. However, it does not make unfair terms fair.
• Law varies by country. Whether an agent’s acceptance binds you depends on local consumer and contract law, which the protocol cannot settle.
• Adoption is voluntary. Instead, merchants choose whether to publish a discovery file, and agents choose whether to read it.
• Naming is still settling. Even so, the project’s materials describe the hash record in slightly different ways, a sign of a young specification.

This article explains a technical standard and is not legal advice. So if a purchase dispute matters to you, speak to a consumer adviser or lawyer in your country.

Legal Context Protocol: FAQs

Sources

• American Arbitration Association, “Introducing the Legal Context Protocol for Agentic Commerce” (June 24, 2026)
• Legal Context Protocol, official website (accessed October 2026)
• PYMNTS, “Legal Context Protocol Logs the Terms AI Agents Accept” (September 23, 2026)
• GitHub, legal-context-protocol specification repository (accessed October 2026)
• Cointelegraph, “AAA Launches Legal Layer for AI Agent Transactions” (June 25, 2026)