US debit and bank transfers fall under Regulation E, whose authorized-versus-unauthorized test was written for human-initiated payments and remains unresolved for AI agents as of August 2026.
Credit cards fall under TILA and Regulation Z, which allow a dispute over goods not accepted or not delivered as agreed, giving a route to a refund without arguing about authorization.
The EU AI Act high-risk rules that could cover autonomous financial decisions were pushed to December 2, 2027 by the Digital Omnibus, so nothing fills the gap this year.