American Express AI Case Study: From 30% Faster Coding to Agentic Payments

Are Your AI Agents Under Control?

In March 2026, American Express reported that AI-assisted development tools had reached more than 11,000 engineering professionals and cut coding cycle time by over 30 percent.

That is the easiest Amex AI number to quote. It is not the story. The story is what the company built around its models so that a bank could trust them.

Behind the headline sit narrower, harder results:

• A frontline knowledge assistant answers colleague questions with 98% accuracy in the U.S., as of May 2025
• Card benefit setup that took three months or more now takes as little as 6 to 8 weeks
• AI-optimized search handles roughly one million mobile app inquiries a month
• 88% of travel counselors worldwide report high satisfaction with their AI assist tool

None of these came from one platform or one model. Each came from a decision about what the AI was allowed to see, what it was allowed to produce, and who or what checked the result before it reached a customer or a payment rail.

The Problem: A Business Where Every Answer and Every Charge Must Be Right

American Express is issuer, network, and acquirer in one closed loop. That gives it unusual data. It also means an AI mistake can land in a customer’s statement, a regulator’s file, or a merchant dispute.

Before the current generation of tools, the friction was spread across four places:

• Frontline knowledge: customer care professionals searched static help articles by hand during live interactions, then interpreted what they found.
• Product change: configuring a new Card benefit, offer, or reward took three months or more, because business logic lived inside application code.
• AI delivery inside a bank: every new generative AI application had to solve the same networking, enterprise authentication, proxy, and logging requirements again.
• Delegated transactions: an AI agent could be asked to buy something, but the issuer had no reliable way to know what the customer had actually authorized.

Amex had used AI in fraud and credit underwriting for years. What it lacked was a repeatable way to put generative AI into regulated workflows without creating a second, unreliable source of truth. So it built the content, integration, and control layers first, then applied models narrowly.

What American Express Delivered

Amex’s shareholder letter, its engineering blog, and its product announcements make the sequence reconstructible. The initiatives are distinct. They share a pattern, not a single platform.

Seven capabilities came out of that sequence. Each one constrains the layer above it.

How American Express Built It

Six stages. In each one Amex had a faster option. It chose the one that would hold up when a customer, an auditor, or a merchant asked what happened.

Stage 1: Make the plumbing reusable before scaling the models

Building a GenAI application inside a bank is mostly not about the model. Amex engineers describe the challenges of banking infrastructure: complex networking, enterprise authentication, observability, and production deployment, solved again by every team.

Their answer in April 2025 was ConnectChain, an open-source framework built on LangChain. It bundled what every internal app needed:

• One YAML configuration for deployment across environments
• Login integration with the enterprise authentication service, generating JWT tokens for model providers
• Model-level outbound proxy support for corporate network security
• Hooks for custom validation and sanitization of model output
• A swappable LLM interface, so no application was hardwired to one provider

The lesson has a second half. The public repository has since pointed users toward native LangChain capabilities for enterprise integration and guardrails. Custom integration code was the right call at one stage, and not a permanent architecture. Amex treated it that way.

Stage 2: Restructure the content before shipping the chatbot

Amex’s customer care professionals used to search static articles by hand, mid-call. The obvious fix was a chatbot over the help center. Amex did something slower first.

For Colleague Help Center Knowledge Assist, the team reformatted thousands of documents so that generated answers would draw only from approved content. The build followed a pattern the company now describes as its standard for frontline AI:

1. Approved content only: answers are grounded in restructured, governed material, not the open web.
2. Inside the workflow: the colleague asks in the tool they already use and stays with the customer.
3. Observability: monitoring, feedback loops, and human oversight drive continuous improvement.
4. Governed evaluation: every model is assessed under a framework for fairness and traceability before and after release.

The 98% is an accuracy rate, not an improvement over a baseline, and the rubric is unpublished. The 88% measures counselor satisfaction, not customer outcomes. Amex labels both that way itself.

Stage 3: Give engineers the tools, then redesign the lifecycle around them

The coding result came first. By the March 2026 shareholder letter, AI-assisted development tools had reached more than 11,000 engineering professionals, and Amex reported coding cycle time down by over 30 percent. The letter also says agentic coding tools are being scaled for end-to-end development.

What is not disclosed is as important as what is:

• The baseline, task mix, and measurement window
• Whether “coding cycle time” includes review and rework
• Which tools produced the gain

Amex’s engineers then published what the number does not cover. Their May 2026 account of AI-assisted software delivery argues that upstream ambiguity, not typing speed, is the largest drag on velocity. It describes four phases:

1. Envision and define: AI synthesizes inputs into prioritized capabilities, user stories, and Gherkin acceptance criteria; humans validate feasibility.
2. Verify and specify: AI acts as a second-pass auditor across the backlog, flagging ambiguity, dependency gaps, and architecture drift before sprint one.
3. Build and integrate: AI scaffolds code, unit tests, and contract validation; CI/CD pipelines become feedback engines for flaky tests and coverage gaps.
4. Test and release: test cases generated from acceptance criteria, regression suites pruned, release decisions driven by defect trends and rollback readiness.

The authors call AI “a force multiplier, not an autopilot.” The phrase is doing real work. A 30% faster coding step is only useful if the specification it implements was already correct.

Stage 4: Put business rules above the code, then let GenAI write the rules

The most tangible business-platform change sits in the 2025 U.S. Platinum Card refresh. Amex has completed more than 200 Card refreshes since 2019, averaging over 30 a year. The Platinum refresh was the largest.

The architectural move was to separate changeable business behavior from application code:

• Rules engine above the base code: benefits, offers, and rewards are decision rules, not deployments.
• GenAI generates the core decision rules: internal teams configure in real time through UI layers rather than waiting on a release.
• API-led exposure: enrollment, benefit tracking, and recommendations are reusable, AI-ready services.

Amex does not publish who approves a generated rule, or how rules are simulated and rolled back. Those controls almost certainly exist. This article does not invent them.

Stage 5: Make one governed data platform the substrate for everything

Each of the above sits on data. On the January 2026 earnings call, Amex’s chairman said the company now spends $5 billion a year on technology and is rolling out a third-generation data and analytics platform on the public cloud.

The claims attached to it are specific and scoped:

• Key marketing and fraud processes already run 90% faster on the new platform
• 100% of data and analytics processes are expected to migrate by 2027
• The platform is explicitly meant to enable new GenAI and agentic use cases
• Calls per account into service centers fell 25% over three years, credited to self-service and the app

Google Cloud separately reported that Amex is moving a core on-premises warehouse and hundreds of production applications to BigQuery. Amex has not said whether that migration and the 90% figure are the same program.

Stage 6: Let agents act, but make them prove what the customer authorized

Knowledge Assist helps a person answer. An AI agent that buys a flight acts. Amex’s position: the agent decides what to attempt, and the issuer decides whether the attempt is authorized.

In April 2026 the company announced the Agentic Commerce Experiences Developer Kit, available to select developers, with five services:

1. Agent registration: each AI agent is verified and assigned an ID before it can transact (in development at launch).
2. Account enablement: the Card Member enrolls a Card with a specific agent and sets usage controls.
3. Intent Intelligence: the customer’s purchase intent is captured and authenticated to support authorization and disputes.
4. Payment credentials: the agent pays with a tokenized, scoped credential, never the card number.
5. Cart context: merchants share cart details to support validation and dispute investigation (in development at launch).

The engineering account describes the controls under it: OAuth and mutual TLS on every API call, a zero-trust model that accepts no request on client-provided data alone, and signed, short-lived artifacts bound to one intent and checked at each step.

In October 2026 Amex published the Intent Intelligence framework in full. The engineering object is the authorized request itself:

Alongside the kit, Amex announced Agent Purchase Protection: if a registered agent that shared authenticated intent buys the wrong thing, Amex says it will protect the eligible Card Member from the charge. Sixteen companies, including Adyen, Google, Microsoft, OpenAI, PayPal, and Stripe, were listed as supporting partners. The company is also working with EMVCo, Google’s Agent Payments Protocol, and the x402 standard rather than building a proprietary rail.

Two things matter more than the tooling:

• Not everything is live. Two of the five services were in development at launch, SDKs and an MCP server were described as planned, and the protection policy was announced as forthcoming.
• No outcome number exists yet. Amex says it is completing AI-assisted transactions with platform partners, but has published no volume, dispute rate, or fraud result for agentic payments.

Business Outcomes in Numbers

Amex is careful about scope in its own disclosures. A 98% accuracy rate for one assistant in one country is a real number. A 98% rate for “Amex AI” would not be. The tables below keep each figure attached to its system, geography, and date.

Service and knowledge

The clearest results sit where AI retrieves approved information for a person who still owns the interaction.

Engineering and product change

These are the figures most often quoted, and the ones most often stretched.

Data and platform

Platform results are large. They are not AI results, and they should not be added to the tables above.

What is a target, a design, or an announcement, not a result

Several widely repeated Amex AI claims describe intent rather than outcome. They belong in their own table.

Amex draws most of these distinctions itself. An enterprise reading the case should draw the rest.

Conclusion

The American Express AI story is usually told as a list of launches and one engineering percentage. Read as a sequence of decisions, it is more useful. Amex chose to:

• Solve enterprise authentication, proxies, and output validation once, in a shared layer, before scaling GenAI apps
• Restructure thousands of help documents before putting a chatbot in front of them
• Ground frontline answers in approved content only, with monitoring and human oversight
• Measure coding cycle time narrowly, then publish a lifecycle model that puts specification before speed
• Move benefit logic into a rules layer above the code, so GenAI configures a platform instead of patching one
• Build one governed cloud data platform and set a dated migration target for it
• Let AI agents transact only with scoped credentials bound to authenticated, signed intent
• Label its own announcements as announcements

Each decision produced the content, the controls, or the evidence the next one needed. That is why Amex can publish a 98% figure with a date and a geography attached, and why it can underwrite purchases made by agents it did not build.

For leaders in financial services and other regulated industries, the transferable lesson is the order of operations. The same pattern underpins production generative AI programs and financial services platforms that survive audit: shared integration and data foundations, then narrowly scoped models with evaluation, then controls that move authority out of free-form model output and into signed, checkable requests.

The question worth asking is which of those layers is still missing. And whether the next AI agent in your stack can prove what it was told to do.

Disclaimer: This is an independent case study review, not a Zoolatech project. It is based on publicly available sources, including American Express’s annual report, earnings call, engineering publications, press releases, and partner announcements.