Five acronyms arrived in the last eighteen months or so and started deciding which businesses AI agents are able to buy from.
ACP. UCP. AP2. Visa Trusted Agent. Mastercard Agent Pay.
You do not need to love them. You do need to know what they are, because a merchant that supports only one of these protocols can be invisible to agents built on the others.
This is the plumbing of agentic commerce. Plumbing is boring right up until the day it decides whether you get paid.
Put simply, these protocols are the rules that let an AI agent prove who it is, read your product data and pay you. If an agent can't do all of that on your site, it buys somewhere else.
The problem all five are solving
An AI agent trying to buy something on your behalf hits three walls.
First, identity. It has no way to show it is a legitimate agent acting for a real person and not a bot scraping your inventory. Second, data. Every site structures its product information differently, so the agent can't read it reliably. Third, payment. Card systems were built on the assumption that a human is present with a card.
Each protocol tackles one or more of those walls.
The problem runs deep, because almost every part of a normal online store assumes a person is on the other end. Product pages are designed for eyes and checkout flows for fingers. Fraud systems flag anything that doesn't behave like a human. An agent trips over all of it, which is why a new layer of rules is being built underneath.
The last twenty years of ecommerce assumed a human with a browser. The next ten assume a machine with a mandate. Almost none of the infrastructure transfers.
The five, in plain English
ACP, the Agentic Commerce Protocol. The most visible one. It was built by OpenAI and Stripe, it sits behind shopping in ChatGPT, and it launched alongside Instant Checkout, the feature that let people pay inside the chat. OpenAI dropped that model in March 2026, saying it "did not offer the level of flexibility" it wanted. Today the assistant handles discovery and comparison, and the sale goes through the merchant's own checkout.
UCP, the Universal Commerce Protocol. Google's answer, launched in January 2026 and developed with Shopify, Etsy, Wayfair, Target and Walmart. It is pitched as one open standard for the whole journey, from discovery to buying to post-purchase support, so a merchant does not need a separate connection for every agent.
AP2, the Agent Payments Protocol. Also from Google, and focused on payment. It uses signed "mandates" as proof of what the buyer asked for, and sets out to settle three questions: did the user authorise this purchase, does the request reflect what they wanted, and who is accountable when it goes wrong.
Visa Trusted Agent and Mastercard Agent Pay. The card networks working on the same problem from their side. Visa's Trusted Agent Protocol gives merchants a way to recognise trusted agents and tell them apart from "malicious automation and rogue bots". Agent Pay is Mastercard's agentic payments platform. PayPal is already wiring it into its wallet.
The overlap is messy and the standards are still moving. Expect that at this stage, and don't use it as a reason to wait.
For a simple mental model, map each one to the three walls. ACP and UCP mostly cover data and discovery, meaning whether the agent can find and understand what you sell. AP2 and the card network programs mostly cover identity and payment. A business that is readable, reachable and payable is covered on all three.
Where the traffic is going
The early numbers show the game is not yet decided.
Similarweb data reported by Digiday showed ChatGPT made up less than 3% of Amazon's referral traffic in August 2025, down nearly 18% on the month, after Amazon blocked many AI crawlers. The same month ChatGPT drove about one in five of Walmart's referral clicks, more than 20% of Etsy's, nearly 15% of Target's and 10% of eBay's. Shopify says millions of its merchants can now sell to ChatGPT users, and both Walmart and Target have announced partnerships with OpenAI.
Amazon is the biggest name in online retail, and in that month it was the smallest name on this list. When the place people discover products changes, the incumbent does not automatically carry its position across.
A smaller business should like the sound of that. The shelf is being rebuilt and nobody has been handed their old spot. The bigger picture of how buyers are handing their research to machines is laid out in AI agents are shopping for your customers.
What to do, in the order that matters
Most businesses do not need to implement a protocol themselves. They need to be readable first, then supported, then integrated.
- Fix your structured product data first. Clean schema markup on every product and service: price, availability, specifications, shipping, returns, service area. This helps under every protocol and works today, whichever standards win.
- Check what your platform already supports. On Shopify, selling through ChatGPT, Copilot and Google's AI Mode is managed from the store admin. It is a setting and a feed, so find out before you scope a development project.
- Make sure agents can reach you. Aggressive bot blocking and login walls can shut you out of agentic traffic entirely. Plenty of businesses have banned the exact traffic they are trying to attract without knowing it.
- Write returns, warranty and shipping terms as plain readable text. Agents compare on these, and terms locked inside a PDF or an image are easy for them to miss.
- Then support more than one protocol. Each one makes you reachable by more agents, and it is too early to bet on a single standard.
To check reachability, ask whoever manages your site to open the bot protection settings in your firewall or CDN and list which categories of automated traffic are blocked or challenged. Then look at your robots file for rules that shut out AI crawlers. Defaults matter here. Since July 2025, Cloudflare has asked every new domain at sign-up whether to allow AI crawlers, with blocking as the default. Which agents get in should be a decision you made on purpose, and for a lot of sites nobody has made it.
A worked example: the online store that was invisible to agents
Say you run an online store in Perth selling outdoor furniture. Good products, decent Google rankings, a loyal customer base. You've heard about AI shopping and assume you're covered because you're on a major ecommerce platform.
Then you check. Your product pages have prices, but dimensions and materials sit inside an image of a spec sheet. Delivery costs only appear at checkout. Your returns policy is a downloadable PDF. Stock levels aren't marked up, so an agent can't tell if the table is available. And your CDN has a bot protection setting that challenges automated visitors, which turns agents away at the door.
From an agent's point of view, your store is a locked shop with the lights off. It can't confirm the price or compare the size. Delivery cost and returns terms are hidden, and it may not get in at all. When a buyer asks for "a weatherproof eight-seat outdoor dining setting delivered to Fremantle," the agent recommends a competitor whose data it can read.
The fixes are mostly unglamorous. Move specs into text and mark them up. Show delivery estimates on the product page. Turn the returns PDF into a plain page. Add availability to your product schema. Review the bot settings and allow the agents you want. Then check your platform's agentic commerce options and switch on what's available. You don't have to rebuild the store to do any of it.
If you do not sell products online
Most of this still applies, in a different shape. Service businesses are not exempt from agentic discovery. They are just at an earlier stage of it.
For a service business the agent is shortlisting and comparing, and sometimes booking. Your equivalent of product data is your service data. That covers what you do and where you do it, plus a price range and a guarantee if you offer one.
In practice that means a clear service page for each offering, a published service area, price ranges or starting prices in plain text where you can, online booking that doesn't hide behind a login, and consistent details across every listing. It also means knowing what the assistants currently say about you, which you can check in minutes using the method in what AI is telling your customers about you.
The three questions to ask your platform
You do not need to become an expert in any of this. You need three answers from whoever runs your website or store.
- What structured data are we publishing about our products or services, and is it complete and accurate?
- Which agentic commerce integrations does our platform already support, and are they switched on?
- Are we blocking legitimate agent traffic at the firewall or CDN without meaning to?
If your developer cannot answer those quickly, that is the project. The rest of this article can wait until they are settled, because no protocol helps if agents cannot read you or reach you.
The mistakes that cost agentic traffic
- Waiting for a winner. The groundwork pays off under every protocol, and waiting hands the early position to competitors.
- Betting on a single standard. Every protocol you skip is a group of agents that may not be able to reach you.
- Locking key facts in images and PDFs. Agents compare delivery costs and returns terms. If they can't read yours, you lose the comparison by default.
- Leaving security defaults unreviewed. Blocking every bot felt safe a few years ago. Now it can block buyers.
- Not measuring it. Set up tracking for visits referred by AI tools so you can see whether this work is paying off. We look at what that traffic does once it lands in why AI shoppers bounce and how to keep them.
The timing question
Yes, this is early. The standards are competing and changing shape, and I would not be surprised if some of these acronyms are gone in two years.
Everything on the practical list above is work you should do anyway. Clean structured data and terms a person can read without downloading a PDF help with conventional search and with human buyers too.
There is no version of the future where badly structured product data is an advantage. Do the boring layer now and you are legible to whichever protocol wins.
If you'd like a team to do the boring layer properly, that's squarely what our web development work covers: structured data, readable product and service pages, platform integrations and a sensible review of what your firewall lets through. Get readable, get reachable, then let the protocols settle.
Frequently asked questions
What is the Agentic Commerce Protocol (ACP)?
ACP is an open standard built by OpenAI and Stripe, and it sits behind shopping in ChatGPT. Today the assistant finds and compares products, and the purchase goes through the merchant's own checkout. The earlier Instant Checkout model, where people paid inside the chat, was dropped in March 2026.
Do I need a developer to support agentic commerce protocols?
Often not at first. If you're on Shopify or another major platform, much of the support comes through settings and product feeds, with no custom development. The groundwork that matters most is clean structured data and making sure agents aren't blocked. A developer becomes useful for custom stores, complex catalogues or reviewing firewall and CDN settings.
Is my website blocking AI agents?
It might be. Many firewalls and CDNs include bot protection that challenges or blocks automated visitors, and robots files sometimes exclude AI crawlers. Ask whoever manages your site to review which bot categories are blocked and what your robots file allows. Then decide on purpose which agents you want to let in.
Why should I support more than one agentic commerce protocol?
Because the standards are still competing and nobody knows which will dominate. A merchant supporting only one protocol can be invisible to agents and payment systems built on the others. Spreading your support means you're reachable through more assistants and payment systems, and you're not exposed if one standard fades.