The booking that happens without you touching Booking.com
Picture the scene, because it's no longer science fiction. You tell the assistant on your phone: "I want three nights in Lisbon next month, a hotel with a pool, under €200 a night, near Alfama." Thirty seconds later, the agent has compared availability, applied your preferences from previous conversations, picked a hotel, confirmed the reservation, and paid for it with the card you authorised once, last week. You didn't open an app. You didn't see a results page. You didn't touch Booking.com or the hotel's site.
That, in essence, is what the Universal Commerce Protocol — UCP — promises. Google announced it on 11 January 2026. And ever since Google confirmed it's expanding UCP to hotel booking, the travel industry has been doing exactly two things at once: half of it writing obituaries for OTAs, the other half shrugging and saying "this will never work in travel."
Both camps are wrong. Worse, both are looking in the wrong direction.
This article has two halves. The first is the honest explainer you rarely get: what UCP actually is, why travel is different from a shoe store, and who realistically wins and loses. The second is the opinion nobody is writing: the real story isn't leisure, it's business travel — and there, things work exactly the opposite of what the headlines suggest.
What UCP is, minus the hype
Let's be precise, because the terms fly around mixed together.
UCP is an open standard that lets AI agents and merchant systems "speak the same language" — from product discovery, to purchase, to post-sale support. The idea: instead of each AI agent building a separate integration with each merchant, they all use a common protocol. Google launched it first on retail, co-developed with Shopify, Etsy, Wayfair, Target and Walmart, and endorsed by Stripe, Visa, Mastercard, American Express, Adyen and 20+ other players. Concretely, UCP powers checkout directly inside Google Search and Gemini, for eligible US retailers.
UCP doesn't work alone. It rests on three protocols that together form the "agentic commerce" stack:
- MCP (Model Context Protocol) — how an AI agent reads the context and tools of an external system.
- A2A (Agent2Agent) — how two agents talk to each other.
- AP2 (Agent Payments Protocol) — how an agent authorises and executes a payment. Remember that acronym; it's the key to the story I tell below.
For travel, the real status is far more modest than the headlines. Google's documentation for UCP for Lodging is, for now, announcement-level: "detailed onboarding and specs coming soon." There's a waitlist, three promised benefits (reach across Google's AI surfaces, reduced friction via in-conversation booking, and — importantly — the hotel stays "Merchant of Record"), and zero public technical mechanics. No hotel chain named. No date. Nothing in production.
So yes: the protocol is real, the momentum is real, but for travel we're at "PowerPoint with a waitlist," not "live tomorrow." That matters enormously for calibrating the panic.
Why travel isn't a shoe store
Here's the barrier the enthusiasts skip and that Phocuswire names directly: UCP, in its current form, is still unviable for travel. And the reason isn't bureaucracy, it's the physics of the product.
A shirt costs €40 now and €40 three minutes later, the time it takes you to hit "buy." Inventory is stable, price is stable, the SKU is identical across every channel. Travel is the exact opposite. Between the moment an AI agent "discovers" a flight or a room and the moment the user "confirms," price and availability can evaporate in milliseconds. Airfares recalculate in real time. The last room at that rate sold while the agent was summarising your options. There are fare rules, rate restrictions, cancellation conditions, taxes that vary by route and by residency.
In other words: agentic commerce assumes a catalogue. Travel isn't a catalogue, it's a market that bids in real time. For a protocol to work faithfully here, it has to solve not just "how do I pay," but "how do I guarantee that the thing I promised 800 milliseconds ago still exists when the agent hits confirm." Retail doesn't have that problem. Travel has all of it.
That doesn't mean "never." It means "later and harder than LinkedIn thinks." And that delay window is exactly the space where who-wins-who-loses gets decided.
Who wins, who loses — the realistic map
Let's get concrete, player by player. No obituaries, no hype.
Google. The structural winner, whatever the details. If booking moves into the chat inside Search and Gemini, Google becomes the control point of discovery — the place where intent is born. It no longer sells clicks to OTAs; it becomes the transaction surface itself. That's the underlying move.
OTAs (Booking.com, Expedia). The most exposed long term — but not how you think. Their historical value is twofold: aggregated inventory plus discovery (SEO, brand, reviews). UCP attacks the discovery half: if "decide and buy" moves upstream into the conversation with the agent, the OTA risks becoming just a back-end inventory pipe, not the destination. Booking does have two real shields: its loyalty programme (Genius) and direct relationships with hundreds of thousands of properties. It doesn't vanish. But the margin that comes from "we are the place you search" is exactly the margin UCP erodes.
Airbnb. Semi-protected, thanks to unique inventory. You can't book a specific home in Trastevere from another channel — the supply is proprietary and uncommoditised. A protocol that commoditises checkout hits someone whose product isn't fungible far less. Airbnb will integrate agentic as a channel, not experience it as an existential threat.
Direct hotels. Here's the nice nuance. UCP shifts their focus from "a beautiful site with professional photos" to product clarity, rate parity and trust. If the agent chooses based on structured data, not aesthetics, the hotel with clean rates, accurate descriptions and transparent policies beats the one with a spectacular but chaotic site. And Google's promise that the hotel stays "Merchant of Record" is a deliberate lure for direct booking — exactly the fight hoteliers have waged for a decade against OTA commissions.
Metasearch and GDS. Metasearch (Kayak, Trivago, classic Google Hotels) is the most directly cannibalised — it WAS the comparison layer, and the agent swallows it. GDSs stay in the back as inventory infrastructure; they're not on the consumer front line, but they'll need to become "agent-readable."
The honest conclusion of the explainer half: in leisure, UCP is a real threat to the discovery layer, tempered by the volatile-inventory barrier. It's a slow erosion, not an execution. Anyone selling you "the death of the OTA in 2026" is selling clickbait.
But everyone's writing the wrong story
Now the part you won't read anywhere.
Everything above — OTA vs direct hotel, Google vs Booking, the commoditisation of discovery — is the leisure story. It's the story written by the fifty explainers published in the last month, because it's the easy, visual one: the person booking their holiday by talking to their phone.
The problem is that leisure, while larger by volume (the global leisure travel market was ~$5.5 trillion in 2025, against ~$1.57 trillion for business, per GBTA — a ratio of almost 3.5:1), is also the easiest part to automate and the least loyal. There, the battle is about who captures intent first.
The hard story — the one with margin, contracts and lock-in — is business travel. And there, UCP doesn't do what you think. There, the logic flips completely.
Why business travel is (for now) immune to "buy in chat"
A consumer agent booking a room in Gemini solves a simple transaction: one person, one card, one night, no rules. A business trip isn't a transaction. It's a governed process. Let me list what a "buying agent" has to solve to even scratch the surface of a corporate trip:
- Travel policy. Permitted class by grade, per-city caps, preferred suppliers, banned routes. A retail checkout doesn't know what "directors fly business long-haul, everyone else economy" means.
- Negotiated rates. Corporate fares aren't public. They're the result of an annual RFP and live in contracts and fare codes, not in an open catalogue a generic agent can read.
- Approval flow. Many trips require manager approval before ticketing. That's a workflow, not a "buy" button.
- Duty of care. The company has a legal obligation to know where its employees are and to be able to extract them from a risk zone. An anonymous booking in chat enters no tracking system.
- Centralised payment and reconciliation. Lodge cards, virtual cards, central billing, ERP reconciliation, VAT recovery on eligible routes. A personal card authorised once solves none of that.
Notice the pattern. Everything that makes a business trip complicated is exactly everything a retail checkout protocol does not touch. And here's the reversal: in leisure, the TMC (or OTA) is a broker of discovery — precisely the function UCP disintermediates. In business, the TMC isn't a discovery broker. It's a layer of control, compliance and payment. And control and compliance don't get commoditised by a checkout standard. They get more complex.
The bigger the company, the deeper that complexity — and the more immune the management layer is to "the agent bought it on its own in chat." The managed segment dominates business travel precisely because that complexity exists and someone has to handle it.
AP2, payment, and the million-dollar question: who's liable?
Here's where the piece I asked you to remember comes in: AP2, the Agent Payments Protocol, announced by Google on 16 September 2025 with over 60 partners — Mastercard, Visa, PayPal, American Express, Coinbase.
AP2 isn't about "how an agent pays." It's about who authorised what. It works through three cryptographically signed "mandates," carried as W3C Verifiable Credentials: an Intent Mandate (the user's instruction — "book under €200"), a Cart Mandate (approval of the specific cart) and a Payment Mandate (execution of the payment). The protocol explicitly aims to solve three things: authorization (did the user allow the agent to buy?), authenticity (does the action match the intent?) and accountability (who is liable if something goes wrong?).
Read that third word again. Accountability. Who's liable.
For leisure, it's a technical nuance. For business, it's a legal bomb. If an AI agent books a flight out of policy, blows past the cap, or sends an employee into a zone under a travel advisory — who's responsible? The employee who gave the vague instruction? The TMC whose agent executed it? The company whose card was charged? The protocol provider?
This is where it all connects to the conversation I had about AI adoption under the EU AI Act. An agent making autonomous purchase decisions, with signed mandates and financial and duty-of-care impact, is not a cute chatbot. It's a system that lands squarely in the governance, liability and — depending on the use case — risk-classification conversation. Agentic commerce doesn't abolish the need for governance. It makes it urgent.
What a TMC actually does Monday morning
If you're in a TMC reading this hoping for either "we sit tight, it won't touch us" or "it's the end, Google disintermediates us" — both are wrong. Here's what the right positioning looks like:
Don't fear consumer disintermediation. Gemini won't steal your corporate client, because Gemini doesn't know travel policy, doesn't have your negotiated rates, doesn't do duty of care, and doesn't reconcile with the client's ERP. That front is protected by complexity, not by luck.
Fear the competitor TMC that wires up agentic first — internally. That's the real threat, and it's exactly the thesis of the previous article, transposed. Adopt agentic where it matters in B2B: automated servicing (fare re-shopping, exception handling, re-issue on schedule changes), an internal assistant that answers "what's the cheapest flight within client X's policy," a mid-office that understands the new protocols.
Become "agent-readable." As UCP, A2A and AP2 become the lingua franca, your inventory and capabilities have to be exposed in formats agents can consume — under your control, with guardrails, with logging. Whoever stays a black box to agents becomes invisible in a world where agents do the discovery.
Treat AP2 as a governance requirement, not a payment feature. If tomorrow an agent buys on behalf of a corporate client, you need a clear answer to "who authorised, what they authorised, who's liable" — exactly what AP2's mandates standardise. Whoever already has a governance framework maps it onto AP2. Whoever doesn't, improvises under pressure.
Leisure vs business, short and unambiguous
If you keep one paragraph from this article, make it this one.
Leisure is exposed to UCP at the discovery layer, tempered by the volatile-inventory barrier. OTAs and metasearch should worry now — not about a sudden execution, but about a multi-year erosion of their "place you search" position. Direct hotels, paradoxically, have an opportunity: product clarity beats a pretty site.
Business is structurally protected by the complexity a retail checkout protocol can't swallow — policy, negotiated rates, approval, duty of care, centralised payment. TMCs probably have 24-36 months in which the consumer front isn't the threat. But that window isn't for relaxing. It's for becoming the agentic control layer of corporate clients before someone else does.
Whoever inverts the two — relaxes on business because "it's complicated" and panics on leisure because "the press says so" — plays exactly wrong on both.
Conclusion: the protocol war is real, but not where the headlines point
UCP, AP2, A2A, MCP — the agentic commerce stack is the most serious infrastructure move in digital commerce since mobile checkout. It's not hype. Google doesn't line up Visa, Mastercard, Amex, Shopify and Walmart for a toy.
But in travel, the front line isn't where everyone's looking. It isn't the visual drama of the person booking their holiday by talking to their phone. It's the quiet move in the back: who becomes the layer of control, compliance and payment for governed travel — and who stays a black box that agents route around.
Leisure will automate loudly and publicly. Business will transform quietly and profitably. And the TMC that understands the difference — that doesn't fear Gemini, but hurries to wire up its own agentic with guardrails — won't be disintermediated by Google's protocol.
It'll be the one using it.
---
Marian Matinca is an IT Manager & TMC Specialist. The article reflects observations from three years at the intersection of travel management, digital commerce and AI governance. Counter-arguments and concrete examples are welcome at mmatinca.eu.