Product authentication for AI agents: how an agent checks that a product is genuine

TL;DR

• Product authentication for AI agents means checking three separate things: that the product identifier belongs to the brand, that the product data really comes from the brand, and that the physical item is genuine.
• The first two can be checked by software today with open building blocks: GS1 registry lookups, GS1 Digital Link resolution, and digitally signed data such as W3C Verifiable Credentials.
• The third is the hard one. A QR code on its own can be copied, so only serialised identifiers with item-level checks, or physical security features, say anything about the item in the box.

Product authentication for AI agents starts from an uncomfortable fact: an agent that buys or recommends a product almost never touches it. It sees a listing, some identifiers and whatever data it can retrieve, and it has to judge from that whether the product and the seller are genuine. Some of that can be checked with real certainty. Some of it cannot.

This guide takes our product authentication guide, written for people scanning packs, into the agentic case: which building blocks an agent can verify, what each one proves, and where the limits are. Everything below is stated as of October 2026.

What does "genuine" mean to an AI agent?

A person asking whether a product is genuine usually means one thing: is the item in my hand made by the brand on the label? An agent has to split that into three questions, because each is answered by different evidence.

The first two are questions about information, which can be looked up at its source and proven cryptographically. The third is about an object, and correct data about a product type proves nothing about a specific box.

In our report from the W3C/GS1 workshop in Zurich we argued that identity comes first: an agent cannot trust or pay for something it has not precisely identified. Authentication is the next step. Once the agent knows which product is meant, it needs to know the evidence for it is real.

How can an agent check that a product identifier belongs to the brand?

Most consumer products carry a GTIN, the number in the barcode, issued from a range that a GS1 Member Organisation licenses to a company. Anyone can print any number, so the first check is whether the GTIN in a listing was actually issued, and to whom.

GS1 answers that through Verified by GS1, the service that gives access to the GS1 Registries. According to GS1, a query tells you whether the number is a properly structured GS1 number, whether GS1 issued it, which company it is licensed to, and whether the GTIN data matches your own. The data comes from the owner of the identifier, typically the brand, through its GS1 Member Organisation. The answer always aims to include the licensee company, often adds a handful of core product attributes, and can include links to further data. There is a public search on gs1.org, and GS1 offices offer batch queries and API access.

For an agent this is the cheapest useful check. If a listing presents a well-known brand's product and the GTIN is licensed to someone else, something is wrong. If it is licensed to the brand and the core attributes match, the identifier is real and is being used for the right product.

It does not tell the agent whether the seller is authorised, whether the listing data is current, or whether the item is genuine. A counterfeiter can copy a real GTIN as easily as a real logo.

How can an agent get product data straight from the brand?

A marketplace listing, a comparison site or a model's training data are all second-hand. The authoritative source for product data is the brand.

GS1 Digital Link turns the GTIN into a web address, and a resolver answers it with the links the brand has set: product information, instructions, certifications, recall information and, where required, the Digital Product Passport. The GS1-Conformant Resolver Standard requires resolvers to support HTTPS and, on request, to return the full list of links for an identifier in a machine-readable linkset, which is what an agent needs. GS1 runs its own resolver at id.gs1.org.

Two details decide whether this step authenticates anything.

The domain matters. A GS1 Digital Link URI can be written on any domain, so a URI on an unknown domain proves nothing about who stands behind it. The agent should resolve the product on the brand's own domain or through id.gs1.org, and compare the result with the listing. A lookalike site serving convincing product data is exactly what this step must catch.

HTTPS has a limit. A valid certificate tells the agent it reached the domain it asked for and that nothing changed in transit. It does not prove the domain belongs to the brand, and once the data is copied to another site, that protection stays behind. Data that must keep its proof of origin wherever it goes has to be signed.

What do digital signatures and verifiable credentials add?

A digital signature binds data to the key of whoever signed it. Change one character and the signature fails; check the key against a trusted source and you know the issuer. The proof travels with the data, so a certificate copied into a marketplace feed can still be checked.

The open standard here is the W3C Verifiable Credentials Data Model v2.0, a W3C Recommendation since 15 May 2025. It defines an issuer that makes and secures claims, a holder that presents them and a verifier that checks them, and every credential must be secured by an embedded proof (Data Integrity) or an enveloping one (JOSE or COSE). A companion Recommendation of the same date, Bitstring Status List, lets an issuer revoke or suspend a credential, so a verifier can also see that a certificate has been withdrawn.

The specification is explicit about its limit. Verification proves who issued a credential and that it is unaltered. It does not prove the claims are true, and which issuers to trust is left to the verifier. An agent can be certain a certificate was signed by a given laboratory; whether that laboratory is accredited is a separate question.

GS1 has published how this could work in its own system. Its GS1 Digital Licenses documentation describes a chain of GS1 License Credentials: GS1 Global Office to a Member Organisation for a GS1 Prefix, the Member Organisation to a company for its Company Prefix, and the company onwards for its own identifiers and product data. GS1 states that this documentation is not a GS1 standard, and parts are marked as under development. In our reading it shows where a cryptographic "this GTIN is ours" could come from, but as of October 2026 an agent cannot expect to find one for most products.

There is also an EU option. Under the eIDAS Regulation (EU) No 910/2014, an electronic seal is data attached to other data to ensure its origin and integrity, created by a legal person. A qualified electronic seal carries a legal presumption of the integrity and correct origin of the data it is linked to. The ESPR does not mention eIDAS, so this is our reading: for a business that wants legally recognised proof of origin on its product data in the EU, a qualified seal is an existing tool.

What does the ESPR require on DPP data authentication?

The Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, sets essential requirements for the technical design and operation of every Digital Product Passport. Article 11 includes three that matter here:

• Point (f): the rights to introduce, modify or update passport data are restricted according to the access rights set in each delegated act.
• Point (g): data authentication, reliability and integrity shall be ensured.
• Point (h): passports shall be designed and operated so that a high level of security and privacy is ensured and fraud is avoided.

The Regulation sets the outcome and leaves the technique open: it names no signatures, credentials or seals. Article 13 adds that when the Commission decides which extra data the EU passport registry stores, it must consider the need to allow the authenticity of the passport to be verified.

For agents, this means passport data for a covered product is data the law requires to be authentic and protected against fraud. That makes the passport, reached through the product's data carrier, a natural source for checking claims about materials, substances, repairability or compliance. As of October 2026 no delegated act setting passport requirements for an ESPR product group has been adopted, so how authentication will be ensured in detail is still to come.

Can a QR code prove that a product is genuine?

No. A QR code is a printed pattern that anyone can reproduce. A copied GS1 Digital Link QR code on a counterfeit box resolves to the brand's genuine page, with genuine data and a valid certificate. Every check above still passes, because all of them are about the product type, and the counterfeit claims to be that type.

That makes the QR code one component of authentication, whose value depends on what sits behind it.

What does not stop a copied code:

• A static code that encodes the same URI on every unit, so every copy looks like the original.
• HTTPS, signed product data and registry verification, which prove the data is real and say nothing about the item.
• A batch number alone, which narrows things down but may cover thousands of units.

What makes copying detectable or harder:

• Serialised identifiers. GS1 Digital Link can carry a serial number together with the GTIN, giving each unit its own identity. A serial the brand never issued, or one that belongs to another product, fails the check.
• Item-level verification. The brand's system can record where and how often each serial is checked. One serial checked in several countries in a week signals cloning. This is a capability of the brand's system, it detects copies after the fact, and it does not prevent them.
• A standard way to ask. GS1's Lightweight Messaging Standard for Verification of Product Identifiers defines a request and response for checking an identifier and its associated data. It was driven by US pharmaceutical rules and designed for reuse in other sectors, and the GS1 vocabulary defines a verificationService link type so a resolver can point software to such a service.
• Physical security features. Tamper-evident seals, security inks and NFC tags with cryptographic chips work on the object itself. A chip that answers each challenge with a fresh signature is much harder to clone than a printed code, but someone has to be physically present to check it.

Before purchase, an agent can only check what the listing claims. After delivery, the user or a warehouse can check the unit, and the agent's job is to say what to scan, what a genuine result looks like and what to do if it fails.

Threats, checks and building blocks

The last row is deliberate. Whether a seller is authorised is a commercial relationship, and none of these standards answers it. An agent should treat it as unverified unless the brand states it somewhere the agent can trust.

If every other check passes, an agent can honestly say: this is a real product of this brand, the data is the brand's, and the item can be checked on arrival. It cannot say the item is genuine before anyone has checked it, and it should tell the user so.

What brands should do now

An agent can only check what the brand makes checkable.

1. Complete your GS1 registry data, so Verified by GS1 returns core attributes for every GTIN you sell, not just your company name.
2. Run your GS1 Digital Link resolver on a domain you control, with the linkset available so software can read every link in one request.
3. Publish machine-readable product data at the source, and keep retailer listings consistent with it. Discrepancies look like fraud to an agent.
4. Sign what matters, starting with certificates, declarations of conformity and passport data, with a way to revoke them.
5. Serialise high-risk products and give each serial a verification service that a scan, a retailer or an agent can query.
6. Add physical security where the risk justifies it, and explain on your product pages how a customer can check a unit.
7. Prepare for Article 11(g). Ask your passport service provider how data authentication and integrity will be ensured, and who can change what.

Digital Link is a GS1 solution partner, and our platform gives each product a standards-based GS1 Digital Link QR code, a resolver that serves both people and software, and pages that can be updated without reprinting packaging, down to batch or serial-number level where needed. If you want your products to be verifiable by AI agents as well as by the people who scan them, get in touch and our team will look at your case.

Frequently asked questions

Can an AI agent tell whether a product is counterfeit?

Not from a listing alone. An agent can verify that the identifier is real and licensed to the brand, and that the product data comes from the brand. Whether a specific item is genuine can only be checked on the item, with a serialised identifier, a verification service or physical security features.

What does Verified by GS1 check?

Whether a number is a valid GS1 identifier, whether GS1 issued it, which company it is licensed to and, where the brand has supplied it, core data about the product. It confirms the identifier, not the item or the seller.

Does a GS1 Digital Link QR code stop counterfeiting?

On its own, no, because a printed code can be copied. It helps when each unit carries its own serial number and the brand monitors how each serial is checked, so copies can be detected. It also gives buyers and agents a direct route to the brand's authoritative data.

What are verifiable credentials?

A W3C standard for claims that an issuer signs cryptographically, so anyone can check who issued them and that they are unaltered. Version 2.0 became a W3C Recommendation on 15 May 2025. A valid credential proves origin and integrity, not that the claim is true.

Does the ESPR require Digital Product Passport data to be signed?

Article 11(g) requires that data authentication, reliability and integrity be ensured, and Article 11(h) that fraud be avoided. The Regulation does not prescribe a technique such as signatures or seals; that will depend on the delegated acts and the standards they rely on.

Is HTTPS enough to trust product data?

It proves the data came from the domain the agent contacted and was not changed in transit. It does not prove the domain belongs to the brand, and the protection is lost once the data is copied elsewhere. Signed data keeps its proof of origin wherever it goes.

Can an agent check that a seller is authorised by the brand?

There is no open standard for this today. An agent can only rely on what the brand itself publishes, such as a list of authorised retailers on its own domain, and should otherwise treat the seller's status as unverified.