Agentic onboarding: how AI agents change the customer journey
Agentic onboarding is any moment where an AI agent, rather than a person directly, creates or extends the relationship between someone and a service.
Your next customer may arrive as an AI agent. The question is not whether to let them in. It is how much you need to know about who is on the other side, and the answer is different every time.
"Get me two tickets for Saturday." "Book the flight, I do not mind which airline." "Open an account with that bank for me." Every one of those sentences ends somewhere that used to need a person. A form. A checkbox. An address field. A passport held up to a camera. Somebody has to accept the terms, create the account, confirm they are old enough and prove who they are. AI agents can increasingly take on that whole range of steps.
Most conversations about this jump straight to the hard end: the regulated account opening with the document check. That is the smallest part of the problem and the part we already know how to solve. The interesting question sits everywhere else.
What does agentic onboarding include?
At the quiet end, that means accepting terms and conditions, acknowledging a privacy policy, making a cookie choice, opting in or out of marketing, or creating a minimal account with nothing more than a name and an email address.
In the middle, it means an address at checkout, an age confirmation on a restricted product, or the four separate forms one trip takes across an airline, a hotel and an insurer.
At the far end, it means a regulated account opening with an identity check and a signature. The common thread is that until recently a human did every single one of those steps. The mistake is to treat them as one problem with one answer.
Agentic onboarding at a glance
| Level | Example | Main issue |
|---|---|---|
| Contact details and nothing more | Name and email address | Duplicates, throwaway accounts and unreliable customer data |
| A consent you have to stand behind later | Terms, cookies, marketing consent | Being able to show who agreed, to which version and on what basis |
| An attribute that has to be true | Age, country of residence, address | A wrong answer can lead to a transaction that should not have been completed |
| A legally identified person | Regulated account, credit agreement, qualified signature | The applicable rules may leave much less room to choose how identity is established |
How much certainty do you actually need?
This is the question almost nobody has worked through, and it is the one that decides whether agentic onboarding helps a business or hurts it. There are roughly four levels, and each one fails differently when you get it wrong.
- Contact details and nothing more. A minimal account with a name and an email address. What goes wrong here is duplicates, throwaway accounts and a customer database you cannot trust. That can be annoying and expensive, but the stakes are relatively low.
- An acceptance or consent you have to stand behind later. Terms, privacy policy, cookies, marketing permission. You need to be able to show who agreed, to which version, and on what basis. "An agent ticked the box" is not an answer when someone disputes it two years later.
- An attribute that has to be true. Age for a restricted product, country of residence when it determines what you are allowed to sell, or an address that a contract or delivery depends on. Here, a wrong answer is not just untidy data; it is a transaction you should not have completed.
- A legally identified person. A regulated account, a credit agreement, a qualified signature. The law names the check and leaves you very little room.
Two further questions cut across all four, and they are genuinely open:
- Do you even need to know that an agent is involved? Or is it enough to know that a human authorised what the agent did? Those are different requirements and they lead to different designs.
- Does the agent itself need an identity, discoverable and verifiable in its own right? Sometimes yes. Often, understanding who is behind the agent is what matters, and the agent is just the channel.
The work is matching the level to the transaction. Demand the top level for a newsletter sign-up and the agent will quietly take its user to a competitor that asks for nothing. Accept the bottom level for a credit agreement and you will be explaining yourself to a regulator. These are not just compliance decisions; they are product decisions too.
Why businesses need to think about agentic onboarding now
Three things are happening at once, and none of them is speculative. First, businesses are inviting agents in on purpose. They are building agent-facing interfaces, publishing offers agents can read, and placing prompts inside their marketing messages, which turns out to work remarkably well. That is a sensible thing to do. It also means businesses can no longer design the journey on the assumption that a person will always be on the other side. If you invite the agent in, the journey needs to be ready for it.
Second, it is already happening whether you invited it or not. Browser plugins and agent-driven browsers complete ordinary journeys on ordinary websites today. In most places the law still allows a service to assume that whoever fills in the form is the person named in it. In practice, that assumption stopped holding a while ago. Plenty of us already sit on a website, decide we cannot face looking up the details, and simply ask an assistant to fill it in. It works perfectly well.
The consequences can be ordinary rather than dramatic: accounts nobody can attribute to a real person, consents that come apart when questioned, and a workaround that is spreading fast, which is measuring how much of your traffic looks agentic so you can block it when in doubt. Blocking it by default may be blunt and risks turning away legitimate customers too.
Third, standards and regulatory guidance are still evolving. That is the uncomfortable part. Businesses have to make product decisions now, while the rulebook is still taking shape.
Two challenges that still need to be solved
One sits with the user. Onboarding needs data, and the agent has to have it. Some assistants keep a memory, some keep none, and most people will end up using several. Data locked inside one assistant does not travel to the next one, and nobody wants to type their life in once per agent. Where that data lives, and how it moves, is not solved yet and it is worth saying so plainly.
The other sits with you. Once you know you are dealing with an agent, the next question arrives immediately: did the user actually authorise this agent to hand over this particular data? An address is one thing. Health information attached to a flight booking or a medical appointment is quite another.
Without an answer you are open to a complaint that is hard to argue with. "I never wanted that shared. You built an offer aimed at agents, so you invited it. I want this reversed." You do not need many of those to wish you had asked the question earlier.
What closes it is a scoped, revocable mandate together with evidence for each event. The person decides which data may be shared, which actions the agent may take, for which services and for how long, while the business receives evidence it can refer back to later. This is a topic we will explore in more detail in a follow-up article.
How the customer journey could change
Say "agentic onboarding" and most people picture an agent typing into the web form you already have. That is the first step: same journey, faster typing, with the same weaknesses still in place.
The second step is more interesting: the journey moves into the conversation. The person never leaves the assistant on their phone, the agent asks, the person approves what needs approving, the service answers, and there is no moment where anyone is thrown out into a separate web flow to start again.
The third step is the one that changes the economics. A handful of attributes the agent is likely to hold already – nationality, age, where the person currently lives – can tell you a great deal about which evidence that person can realistically produce. That can tell you which eID scheme is open to them, which document they are likely to hold, and which register or source can confirm the required attributes.
So you stop running one journey for everybody and start assembling the right one for each person and each use case. Many versions exist in parallel and the best route is chosen before the first question is asked. Someone with a suitable national eID may not need to scan a document, while someone without one should not be sent down a route they cannot complete.
One-size-fits-all onboarding is where conversion starts to suffer. A route picked for the person in front of you is simply a better product, and it can also help you meet the right compliance requirements.
Where should businesses start?
Start with the transactions where a human's acceptance is required by law. Regulated accounts, credit, age-restricted goods, prescriptions, high-value contracts. No competitor can skip the step either, so there is nowhere for an agent to route around to, and you learn the mechanics where the stakes justify the effort. A casual sign-up is the easiest thing in the world for an agent to avoid, which makes it the worst place to begin.
Then work back down the levels. For each thing you ask a new customer for, decide how much certainty you actually need. Most businesses have never written that down, but doing so is a useful first step towards understanding what agentic onboarding requires.
How Signicat is approaching agentic onboarding
Signicat is a qualified trust service provider, which means the evidence behind these interactions can be backed by regulated trust infrastructure. We have a working reference stack end-to-end, a user app, a relying party and a connector for the AI client, and the mandate protocol behind it has been filed as an internet draft. Document and chip verification, video identification, national eID schemes and the EUDI wallet are already in the portfolio, which is what makes the personalised journey described above buildable today rather than a thought experiment.