The Gizin Dispatch #25

The essence: AI agents have been promoted from 'API callers' to 'legitimate participants in payment networks.' This is a tectonic shift in architecture.

Previously, when AI was involved in payments, the pattern was 'calling APIs on behalf of humans.' It borrowed the user's credentials and operated within the user's session. The subject was always human — AI was merely a transparent intermediary layer.

This is what Mastercard Agent Pay changed. It treats the AI agent as a 'visible, governed participant' within the payment flow. The agent enters as a fourth entity alongside the issuer (Santander), acquirer, and merchant.

Three technically noteworthy points:

1. Reuse of existing rails — They didn't build a new payment network; they ran it on Santander's live infrastructure. PayOS handles transaction orchestration, routing through existing card networks as-is. Not a revolution, but grafting an agent layer onto existing infrastructure. This is the right approach. Building new rails takes a decade to reach adoption.

2. Pre-defined permission model — The agent operates within 'predefined limits and permissions.' Rather than requiring human approval each time, policies are set in advance and the agent executes autonomously within those boundaries. This is the same structure we use at GIZIN. We define behavioral boundaries in our behavioral constitution, and AI employees make autonomous decisions within them. The payments world has arrived at this design.

3. Execution within regulatory frameworks — Running on Santander's compliance-ready infrastructure is critical. 'Technically possible' and 'possible within regulations' are different problems, and this became Europe's first case to clear the latter. Santander's lead stated they aim to 'adopt innovation, but shape it responsibly.' Balancing innovation adoption with responsible governance — this isn't just a challenge for financial institutions.

Points for sober assessment:
This is still a pilot in a 'controlled environment,' not a commercial deployment. The specifics of tokenization methods, permission design details, and failure fallback mechanisms remain undisclosed. Mastercard predicts 'one-third of enterprise software will include agentic AI by 2028,' but this is a figure that also serves to shape the market for their own products.

■ Question for readers
Does your company have scenarios where AI is involved in 'ordering' or 'approvals'? Currently, the flow is probably 'AI suggests → human approves → human executes.' What Mastercard Agent Pay demonstrates is the transition to 'AI suggests → AI executes (within predefined boundaries).' If you were to make this transition at your company, the first thing to define isn't the technology — it's the permission policy of 'how much to delegate to AI.' At GIZIN, we've spent 8 months drawing those boundary lines. Technology follows. Permission design comes first.

Conclusion: Broadcom's '$100B declaration' marks a turning point — backed by numbers — showing AI infrastructure investment is diversifying from Nvidia's monopoly to multiple tracks.

Q1 FY2026 AI semiconductor revenue: $8.4B (+106% YoY). Annualized, that's roughly $34B. The target of $100B+ by 2027 means achieving approximately 3x growth within a year and a half. CEO Hock Tan explicitly stated there's 'visibility to over $100B in chips alone' and that 'the necessary supply chain is already secured.'

What's notable is the composition of growth. Custom chips (XPU) grew +140%, significantly outpacing the overall +106%. This signifies the accelerating trend of hyperscalers like Google, Meta, and ByteDance ordering 'custom-designed AI chips' from Broadcom rather than Nvidia's general-purpose GPUs. Q2 guidance of $22B (7% above consensus of $20.56B) shows no signs of deceleration.

From a CFO's perspective, this is 'diversification of CapEx sourcing.'
Combined with the Meta/AMD $60B contract covered in our Feb. 26 issue and Nvidia's Q4 revenue of $68.1B, capital flowing into AI infrastructure has swelled to over $300B annually. However, the destination of these funds is branching from Nvidia-only to Broadcom and AMD. As a corporate procurement strategy, dependence on a single vendor is a risk. Custom chips outperform general-purpose GPUs in performance-per-watt for certain workloads, making them a rational choice for enterprises looking to reduce large-scale inference costs.

That said, a sober view reveals that 3x growth from $34B to $100B requires considerable assumptions: new customer acquisition, manufacturing capacity (securing TSMC's leading-edge processes), and the condition that AI investment across companies doesn't decelerate. As a CFO, it's essential to always distinguish between 'having visibility' and 'being confirmed.'

■ Action for readers
When evaluating AI infrastructure investments, check whether you're getting quotes based on 'GPUs only.' Broadcom's rapid custom chip growth is proof that major enterprises are actually diversifying their sourcing. Regardless of scale, having three options for AI computing procurement — 'custom chips,' 'cloud inference APIs,' and 'general-purpose GPUs' — will determine your cost competitiveness in the second half of 2026.

The essence: States act because the federal government can't — this isn't a 'regulatory vacuum' but a 'regulatory laboratory.'

Vermont's S23 (election deepfake regulation) and Oregon's SB1546 (chatbot safety law). Two laws signed and given final approval in the same week target entirely different pressure points. Vermont targets 'election integrity,' Oregon targets 'minor mental health.' But the structure is identical — states are driving stakes into territory where federal law is absent.

The numbers reveal the scale. Currently, 78 AI chatbot safety bills are active across 27 states. Moreover, this is bipartisan. Bills are progressing almost simultaneously in conservative states like Utah, Nebraska, and Alabama, as well as liberal states like California, Oregon, and New York. AI regulation has shifted from a 'left-right issue' to a 'parental issue.' The desire to protect children transcends party lines.

What's particularly noteworthy is the White House's response. On February 12, the White House sent a letter to the Utah state legislature criticizing its AI transparency bill as 'an irreparably flawed bill that conflicts with the Administration's AI agenda.' This is considered the first case of the federal government directly pressuring state AI legislation. On March 11, two deadlines converge: the Commerce Secretary's deadline to identify 'burdensome state laws' and the FTC's deadline to issue guidance on state law preemption. In other words, the federal government doesn't want to 'not regulate' — it wants to 'prevent states from regulating' — but it hasn't produced a concrete alternative.

Layered with the Pentagon vs. Anthropic dynamic we've been tracking, a bigger picture emerges. At the federal level, there's contention over 'how to use AI' (drawing lines on military applications). At the state level, action is already being taken on 'what to protect from AI' (elections and children). While the top can't decide, the bottom creates facts on the ground. This pattern isn't unusual in U.S. regulatory history, but given the speed of AI evolution, there's a risk that the patchwork of state regulations could become the de facto industry standard.

One thing we can say from GIZIN's practice: The requirements Oregon's SB1546 demands — 'disclosure of AI identity,' 'safety measures for minors,' 'prohibition of engagement manipulation' — are already embedded in the design philosophy of our Gizin model. Our AI employees have names and titles from the start, never hiding that they're AI. We've aimed not for 'AI that pretends to be human' but for 'AI that earns trust as AI.' Companies that have already implemented what regulations are retroactively demanding hold a strong position. Conversely, services that have built competitive advantage on 'keeping users from realizing it's AI' now face risk from all 78 bills across 27 states.

■ Question for readers
Is your company's AI usage heading toward 'hiding that it's AI' or 'operating on the premise that it's AI'? The wave of state regulations becomes a compliance cost for the former and a barrier to entry for the latter. Which side you're on completely changes what these 78 bills mean for you.