The Future of Commerce

No AI Exemption: Why the U.S. Doesn’t Need a New AI Law

October 9, 2026 by Richard Douglas

Every few months someone in Washington says America needs a new law to regulate artificial intelligence. Some proposals target today’s chatbots and hiring tools. Others talk about “superintelligence,” systems that might one day outthink us.

I’ve worked in governance, risk and compliance for a long time, and I’ll be honest with you. I don’t think we need a new AI statute. Not because AI is harmless, but because the harms people worry about are already against the law.

Fraud is illegal. Discrimination is illegal. Misusing personal data is illegal. Hiding a breach from investors is illegal. None of that changes because a computer model made the decision instead of a person.

Regulate the conduct, not the tool

American law has a long habit of going after what people do, not the tools they use. We didn’t pass a “spreadsheet act” when businesses moved their books onto computers. Wire fraud was already wire fraud.

AI is the same. A misleading claim is deceptive whether a marketing team wrote it or a model did. A lending decision that shuts out a protected group is discriminatory whether a loan officer made it or an algorithm did.

The Federal Trade Commission has used Section 5 of the FTC Act against companies that overstated their AI, used biased facial recognition, and trained models on data they had no right to use. In some cases it ordered the models deleted. When the FTC announced a sweep of AI cases in September 2024, then Chair Lina Khan said:

Agentic AI: Risk and governance questions every business should be asking

October 8, 2026 by Richard Douglas

Most businesses are now comfortable with AI that answers questions. You type a prompt, you get some text back, and a person decides what to do with it. Agentic AI works differently, and that difference matters for how you manage risk.

What makes agentic AI different

An AI agent is given a goal and a set of tools, and it works out the steps on its own. It can read your inbox, update a customer record, approve a refund or call another company’s systems, often without anyone checking each step.

That is where the value is. It is also where the risk is. When software can act on your behalf, the question is no longer only “is the answer correct?” It becomes “what did it do, who allowed it, and can we undo it?”

If you are deploying agents, or your staff already use them, here is what you need to know.

How Agentic AI Is Changing Cybersecurity Threats

October 6, 2026 by Richard Douglas

For years the question was whether AI would help attackers or defenders more. In 2026 we got a clearer answer: it helps both, and it is changing how attacks actually happen.

The big shift is agentic AI. These are AI systems that don’t just answer questions. They plan tasks, use tools, log in to systems and carry out multi-step jobs on their own. It also means attackers now have tireless assistants, and every agent your own business deploys is a new account holding keys to your systems.

Let me walk you through what has changed, what the new risks look like and what you can do about them. Most of this comes from three recent research notes by the Cloud Security Alliance (CSA), plus guidance from NIST, Google and MITRE.

AI agents are doing real work now. Is anyone watching them?

October 2, 2026October 2, 2026 by Richard Douglas

A couple of years ago, most business AI was a chatbot. You asked it a question and it gave you an answer. That has changed. AI agents now read email, query databases, update records and run code, often with the same access as the person who set them up.

That makes them far more useful. It also makes them far riskier, and most companies haven’t caught up yet. I’ve been reading recent research from the Cloud Security Alliance (CSA) on this topic, and here’s what stood out, what you can do about it, and which standards can help.

The challenges businesses are facing:

Agents have too much access

Tools like Microsoft 365 Copilot inherit every permission the user already has. If a file was overshared five years ago and forgotten, an AI assistant can now find it and quote it in an answer. Varonis estimates that over 15% of business-critical files are at risk from oversharing.

There’s a second problem. When an agent acts, access is often checked against the agent’s identity, not the person who asked. So a user can get an agent to do something they aren’t allowed to do themselves, and no alarm goes off.

The Agentic Web and What It Means for Your Business

September 30, 2026September 29, 2026 by Richard Douglas

Remember when having a website was optional? Plenty of business owners I talked to in the early days thought the web was a fad. Then their customers started searching online, and the businesses without a site got left behind.

I think we are at a similar point again. This time it’s called the agentic web.

So what is it? Today the web is built for people. You open a browser, click around, fill in forms and hit submit. On the agentic web, a lot of that clicking is done by software agents working on your behalf. You tell an agent what you want, like “book me a flight to Toronto on Thursday for under $400,” and it visits the sites, compares the options and completes the booking.

Think of it as hiring an assistant who never sleeps and has a login to every site you use. That is the big upside. As you’ll see below, it’s also the big risk.

UCP in 2026: What Has Changed Since Launch

September 30, 2026September 22, 2026 by Richard Douglas

Google introduced the Universal Commerce Protocol (UCP) at the National Retail Federation show on January 11, 2026. It was built with Shopify, with Etsy, Wayfair, Target and Walmart as founding partners and more than 20 other backers at launch, including Visa, Mastercard, Stripe, American Express, Best Buy and The Home Depot.

Our earlier article covered the basics: what UCP is for, how a purchase works, and how to get ready. Almost nine months later, a lot has changed. The protocol has shipped four spec releases, added new features, set up a formal governance structure that includes some of Google’s biggest rivals, and started moving into grocery, food delivery and travel. This post brings the picture up to date.

The Protocols Powering Agentic Commerce: A September 2026 Update

September 30, 2026September 15, 2026 by Richard Douglas

Where things stand

A year after the first agent checkout went live, the protocols behind agentic commerce have settled into clear layers, most have moved to neutral governance, and real agent-led spending is still small. Our earlier article on the protocols powering agentic commerce laid out the standards that were starting to let AI agents shop and pay on our behalf. Since then, several of those protocols have changed owners, changed scope, or outlived the products they were first built for.

How the layers fit together

The protocols are best understood as layers that work together rather than rivals. Each one solves a different part of the same problem, from letting an agent talk to a store to proving a person approved the purchase.

The Machine Payments Protocol (MPP): An Updated Guide

September 30, 2026September 8, 2026 by Richard Douglas

What MPP is

The Machine Payments Protocol (MPP) is an open standard that lets software agents pay for things over the web without a human filling in a checkout form. Stripe and Tempo launched it together, and it works inside the normal request and response cycle that every website and API already uses.

The problem it solves is simple. Pricing pages, plan pickers and card forms were built for people. An AI agent that needs to buy one API call, one dataset or one browser session has no good way through them. MPP gives the agent a direct route: ask for the resource, get told the price, pay, and receive it.

Six months after its March 2026 launch, MPP has moved from an announcement to a working network with real, if still small, usage. This post covers how it works, what has changed since launch, and what to watch next.

MCP vs. RAG: Two Ways AI Gets Smarter

September 30, 2026May 12, 2026 by Richard Douglas

Your AI chatbot is only as smart as what it knows and how it’s allowed to act on that knowledge. That distinction is at the heart of two of the most important technologies shaping enterprise AI right now: Retrieval Augmented Generation (RAG) and the Model Context Protocol (MCP).

If you’re investing in AI tools, piloting copilots, or signing off on AI roadmaps, understanding the difference isn’t a technical detail, it is a critical one.

Large language models (LLMs) like the ones powering ChatGPT, Claude, or Copilot have a fundamental limitation: their knowledge is frozen at the time they were trained. Ask about last quarter’s sales figures, your internal HR policy, or a new regulation published last month, and without additional help, the model either guesses or says it doesn’t know.

RAG and MCP are two different answers to that problem. One improves what the AI knows. The other improves what the AI can do.

The Strategy – Risk Connection 75% of Boards Are Missing

September 30, 2026February 25, 2026 by Richard Douglas

Why are most Boards are failing at their number one job?

Many Boards spend two hours reviewing last quarter’s financials.

Fifteen minutes are allocated to “strategic discussion.”

This is not Strategy. This is planning theatre.

And according to McKinsey’s research, it’s happening everywhere. While 100% of corporations have formal strategic planning processes, fewer than 25% report these processes as key to making their most important decisions.

Let that sink in for a moment.