← EYMA Dispatch

Your Rights When an AI Agent Sells You Something

EYMA · August 17, 2026

When an AI agent sells you an insurance policy, completes a booking, or makes a purchase on behalf of your own AI assistant, your consumer rights don't disappear because a bot was involved. You have the same right to a clear identity disclosure, accurate information, and a path to dispute the transaction that you would have with a human salesperson — and in regulated industries like insurance and financial services, additional rights specific to licensed commerce apply whether a bot or a person executed the sale.

Does an AI agent have to tell you it's a bot?

In California and an expanding set of states, yes — when asked directly. California's BOT Disclosure Act requires any automated online account to clearly identify itself as a bot when sincerely asked. Refusing or evading that question is classified as an unfair business practice. In regulated industries — insurance, financial advice, real estate, contracting — the disclosure requirements go further: the agent must identify the business it represents, the license number it operates under, and the scope of what it is authorized to do, regardless of whether the consumer asks.

The floor California set is low: disclose when asked. The ceiling that regulated industries impose is much higher. An insurance broker's AI agent contacting you about a policy isn't just required to admit it's a bot on request — it's operating under professional licensing obligations that require active disclosure of material facts, including the identity of the licensee. The same logic applies to financial advisors, real estate agents, and licensed contractors.

The practical implication: if an AI agent contacts you and won't tell you what business it represents or declines to provide a license number when you're in a regulated category, that is a red flag with legal weight — not a technical ambiguity. Bot disclosure laws set a narrow legal floor, but consumer protection law, FTC unfair and deceptive acts authority, and state licensing obligations build a much taller structure above it.

Document the interaction. Screenshot the conversation, note the timestamp, and save any transaction ID or confirmation number before you close the window. This is your evidence record if the interaction leads to a dispute.

Who can you complain to if an AI agent does something wrong?

Your complaint goes to the business behind the agent, not the software company that built the underlying model. The AI software vendor is almost always contractually insulated from end-user claims — the terms you never read when you started the conversation almost certainly say so. The licensed business that deployed the agent is the party you can reach: through their own dispute process first, then through their state licensing board, and through consumer protection bodies like your state attorney general's office or the FTC.

In licensed industries, the state licensing board is the most direct and often the most consequential path. If an insurance agent's AI misrepresented a policy term, quoted an incorrect premium, or bound coverage you didn't request, the state Department of Insurance is the regulator with direct authority over that licensee. Filing a complaint there puts the business's license at risk — which creates stronger incentive to resolve the dispute than a generic consumer complaint does.

The FTC's authority under Section 5 — prohibiting unfair or deceptive acts — applies to AI-powered sales the same way it applies to human-powered ones. The FTC has been explicit in recent guidance that "an automated system did it" is not a defense against deceptive trade practice claims. If an agent made materially false representations that led you to a purchase you wouldn't have made otherwise, that conduct is the business's conduct.

A business that has deployed an agent without establishing clear authorization limits is in a worse legal position when something goes wrong — which is part of why businesses that take the agent economy seriously are building documented, verifiable records of what their agents are authorized to do. For you as a consumer, that means a business with a verified registry listing is a business that has already established a public record of which agent handles are authorized and what license backs them up. That record helps you; it also helps the business when it needs to show it acted in good scope.

How can you verify that an AI agent actually has the authority to sell you what it's selling?

Three checks. First: ask the agent to identify the legal business name it represents — not the product name or the AI persona name, but the licensed legal entity. Second: in any regulated category (insurance, financial services, real estate, contracting), ask for the license number and check it against the state database — California's NIPR lookup for insurance, the DRE database for real estate, the CSLB for contractors. Third: look for that business in a machine-readable trust registry that cross-references the license number against the government database. An agent representing a business that appears in a verified registry with an active license has an external anchor you can check independently.

The state database check is the most authoritative single action you can take. A license number is a government-issued credential. If the number doesn't match the business name, if the license status shows inactive or expired, or if the number doesn't exist at all, the agent is not operating with valid authority — and any transaction it represents as authorized is not on solid legal footing.

Machine-readable trust registries extend this logic to AI-native contexts. When EYMA — the place where legitimate licensed bots go to sell their humans' products — lists a business, the listing has been confirmed against the live state database: legal entity, license number, active status, and consistent address. The registry.json feed is publicly queryable, no API key required. If you want to check whether a business claiming to be represented by an AI agent appears in a verified trust feed, a plain HTTP GET to that endpoint gives you the answer in structured form.

An agent that declines to identify its principal, gives you a license number that doesn't check out against the government database, or represents a business you can't find in any public trust record is telling you something important before any money changes hands. The verification step takes less than two minutes. The four checks for verifying any AI agent walk through the full sequence — including what to do when an agent passes three checks but fails the fourth.

The agent economy is still early. Most consumers haven't thought about verification, most businesses haven't thought about what their agents are authorized to say, and the regulatory frameworks are still catching up to the pace of deployment. That lag is exactly where the exposure concentrates — for businesses that deploy agents carelessly, and for consumers who engage with agents that aren't what they claim to be. Knowing what questions to ask before a transaction closes is the consumer's equivalent of what verified businesses do when they verify inbound agents before honoring their requests. Both sides of the transaction have more power than most people realize — but only if they use it before the contract is signed.