We scanned 223 online stores in 7 countries. An AI agent could buy from none of them.
OpenAI's ACP and Google's UCP both shipped this year. Both let a shopping assistant discover a merchant and place a real order — if the merchant publishes a machine-readable path to one. We measured how many actually do. The answer did not change when we crossed the Atlantic.
The result
Of 223 e-commerce domains, 164 answered our probes well enough to assess. Zero exposed ACP discovery. Zero exposed UCP discovery. Zero advertised a checkout capability. Every one of the 164 scored grade D, between 25 and 40 out of 100, averaging 33.5.
| Market | Scanned | Assessable | Agent-ready |
|---|---|---|---|
| Czechia | 81 | 53 | 0 |
| United States | 45 | 36 | 0 |
| United Kingdom | 35 | 29 | 0 |
| Germany | 27 | 17 | 0 |
| Netherlands | 15 | 14 | 0 |
| Belgium | 12 | 9 | 0 |
| Slovakia | 3 | 2 | 0 |
The United States is not ahead
We expected the American sample to break the pattern. ACP is an OpenAI and Stripe specification, most of the agentic-commerce tooling ships from US vendors, and the merchants we scanned are well-funded DTC brands with real engineering teams.
36 of 45 US stores were assessable, and none of them exposed ACP or UCP either. The US, UK and Dutch sites are in fact better engineered on every conventional measure — HSTS passes on 130/164 across the whole sample and CSP on 89/164, both driven by those markets. They are better-built sites that are equally invisible to an agent.
This is not a European lag. Nobody has done it yet, anywhere in the sample.
Per-check results
| Check | Max points | Stores passing |
|---|---|---|
| ACP discovery | 25 | 0 / 164 (0%) |
| UCP discovery | 20 | 0 / 164 (0%) |
| HTTPS transport | 15 | 164 / 164 (100%) |
| Public site reachable | 10 | 164 / 164 (100%) |
| Checkout capability advertised | 10 | 0 / 164 (0%) |
| HSTS policy | 5 | 130 / 164 (79%) |
| Content Security Policy | 5 | 89 / 164 (54%) |
| AI-readable product context | 5 | 61 / 164 (37%) |
| Discovery response hygiene | 5 | not assessable — no discovery document to inspect |
A smaller finding, and a correction
An earlier draft of this page claimed that no store returns a clean 404 for a discovery path it does not serve. That was wrong, and it was wrong in the way that matters: it generalised one site we had looked at closely to all 164. Measured properly, 134 of 164 stores (82%) do return a clean 404 or 410 on /.well-known/acp.json. The majority behave correctly.
The real version of the finding is narrower and splits by path. 16 stores (10%) answer 2xx on the ACP path, and 62 (38%) answer 2xx on /.well-known/ucp — a soft 404, where the server hands back a normal page for a path it does not serve.
The gap between 10% and 38% is the interesting part. acp.json carries a file extension, so most stacks route it to static-file handling and miss cleanly. /.well-known/ucp has no extension, so it falls through to the application router and lands on a catch-all page. For an agent, that ambiguity is worse than a missing file: a 200 with marketing HTML cannot be distinguished from "the document is here and I parsed it wrong".
Method
Each domain was submitted to the public OrderCore readiness scanner, which sends read-only GET requests to the homepage and the standard public discovery paths. No authentication, no writes, no checkout mutation. You can reproduce any single result yourself in about twelve seconds.
The sample is 223 mid-market merchants across Czechia, Germany, the United States, the United Kingdom, the Netherlands, Belgium and Slovakia — fashion, outdoor, pharmacy, electronics, food and home goods — chosen for having real catalogs and real revenue rather than for readiness. It was collected in three passes on 10 September 2026; the second added the non-European markets specifically to test whether the first result was a European artefact, and the third widened every market that was already open.
What we are not claiming
59 of the 223 domains sat behind bot protection and returned 403 or 503 to the scanner. They are excluded entirely. A WAF blocking a scanner says nothing about whether the merchant is agent-ready, and counting them as failures would have made the headline number look better and the research worse.
A passing discovery check also does not prove an agent can complete a purchase — only that it can find the path. And the sample is not random: it is a convenience sample of mid-market European merchants, so it does not generalise to enterprise retail or to other regions.
What this means if you run a store
The gap is not a disadvantage yet, because your competitors have it too — all of them. It becomes one on the day a shopping assistant can complete a purchase at one store in your category and not at yours, and you will not get a notification when that happens.
The first step costs nothing: find out what an agent currently sees on your own domain.