Agentic Commerce Protocols Explained: ACP vs UCP for Merchants

An agentic commerce protocol is an open standard that lets an AI assistant read a merchant's catalog, build a cart and complete a purchase through the merchant's own systems, with the merchant staying the seller of record. In October 2026 two of them matter: the Agentic Commerce Protocol (ACP) from OpenAI and Stripe, which now mainly feeds product data into ChatGPT after OpenAI moved away from in-chat Instant Checkout in March 2026, and Google's Universal Commerce Protocol (UCP), which powers a Buy button in AI Mode and Gemini for select US merchants. Microsoft Copilot Checkout uses pieces of both.

This guide is written for merchants, not protocol engineers. It covers what each protocol is (taken from the official specs and announcements), who backs it, what is live versus only announced, what you actually have to build, which AI surfaces support what, the risks to fraud, returns and margin, and a readiness checklist. Every status claim was checked against primary sources on October 18, 2026.

What is agentic commerce?

Agentic commerce is shopping where an AI agent does part of the work a shopper used to do: it researches, compares and, increasingly, completes the purchase on the shopper's behalf. The shopper states a need ("a carry-on under $200 that fits under a plane seat"), and the agent returns options, answers follow-up questions and, where the merchant allows it, checks out.

For a merchant, it splits into two very different jobs:

• Discovery - getting your products surfaced, described accurately and recommended inside the AI answer. This is where most real activity is today.
• Transaction - letting the agent create a checkout session, pass a payment credential and place the order without the shopper visiting your site. This is what the protocols standardize, and it is where adoption has been slowest.

A protocol matters because without one, every AI platform would need a custom integration with every store. Both ACP and UCP define a common set of API calls (create a checkout, update it, complete it, report order status) plus a way to hand over a payment token without exposing card numbers to the agent. Both also insist on the same principle: the merchant, not the AI company, remains the merchant of record, owns the customer relationship and handles fulfillment, returns and support.

If your immediate goal is simply being recommended by AI assistants, start with our guides to GEO for e-commerce and ChatGPT Shopping and getting products cited in ChatGPT. This article is about the layer underneath: the protocols that let agents buy.

Shipped vs announced: the status of agentic commerce in October 2026

The short answer: the specs are public and versioned, Google and Microsoft have live in-assistant checkout in the US, and ChatGPT has stepped back from native checkout. Most of what you read in launch coverage is announcement language ("soon", "in the coming months"), so we separated it out. Status as of October 18, 2026, from each company's own pages:

What is the Agentic Commerce Protocol (ACP)?

ACP is an open standard, co-developed by OpenAI and Stripe, that defines how an AI agent, a buyer and a business exchange product data, checkout state and payment credentials. OpenAI introduced it on September 29, 2025 as the engine behind ChatGPT Instant Checkout, and published it on GitHub under the Apache 2.0 license. The project site, agenticcommerce.dev, says any business or AI platform can implement it, and that "each AI platform will manage their own process" for which merchants they accept.

Who maintains ACP?

The ACP README still names OpenAI and Stripe as founding maintainers with joint, consensus-based governance and a stated future path to "neutral foundation stewardship." The repository's MAINTAINERS file now lists three lead maintainers: OpenAI, Stripe and Meta. The commit history shows Meta was added as a technical steering committee member on April 24, 2026. Microsoft also said it is "adopting open standards like the Agentic Commerce Protocol" for Copilot Checkout onboarding.

What does the ACP spec contain?

OpenAI's commerce documentation splits ACP into three flows a merchant or its payment provider implements:

1. Product feed. The merchant shares structured catalog data (identifiers, titles, descriptions, price, availability, media, variants). OpenAI recommends a full file upload once a day plus API updates during the day; promotions can only be sent by API. The 2026-04-17 version formalized a Feed API in which merchants push products to an agent-hosted endpoint rather than agents crawling the merchant.
2. Agentic Checkout Spec. REST endpoints the merchant hosts: create a checkout session, update it, complete it, cancel it and retrieve it, plus order webhooks. The merchant calculates tax and shipping, runs its own risk checks and accepts or declines the order.
3. Delegated Payment Spec. Implemented by payment providers. The agent prepares a one-time payment credential capped at a maximum amount with an expiry, and the merchant's PSP returns a token the merchant charges. Stripe's Shared Payment Token was the first compatible implementation.

The spec moves in dated versions: 2025-09-29 (initial), 2025-12-12 (fulfillment), 2026-01-16 (capability negotiation), 2026-01-30 (extensions, discounts, payment handlers) and 2026-04-17 (cart, feed, orders, authentication and MCP). Commits continued through July 2026, for example an optional product URL on checkout items.

Is ChatGPT Instant Checkout still available?

Not as a general merchant option. On March 24, 2026 OpenAI wrote that "the initial version of Instant Checkout did not offer the level of flexibility that we aspire to provide, so we're allowing merchants to use their own checkout experiences while we focus our efforts on product discovery." The ChatGPT merchants page now says shoppers "discover and evaluate products in ChatGPT, but purchases are completed on merchant-owned websites or apps," and that there are "no fees for purchases made on your site or app."

The reasons were reported in detail. CNBC (March 20, 2026) quoted a Forrester analyst saying roughly 30 Shopify merchants were available via Instant Checkout as of February 2026, against the "over a million" OpenAI had said were coming. Walmart said conversion was three times lower for products sold directly in ChatGPT than for those that sent users to Walmart's site. Shopify's help center now describes ChatGPT as "a discovery-focused referrer platform": shoppers complete the purchase on your own checkout in an in-app browser or a new tab.

What remains in-chat is the app route: retailers such as Walmart build a ChatGPT app with account linking, loyalty and their own payments. That is a custom build, not a protocol switch you flip.

What is the Universal Commerce Protocol (UCP)?

UCP is an open standard launched by Google on January 11, 2026 at the NRF retail conference. Google describes it as "a common language for agents and systems to operate together across consumer surfaces, businesses and payment providers," covering the whole journey from discovery and cart to checkout and post-purchase. It is Apache 2.0 licensed, with the spec on GitHub and documentation at ucp.dev.

Who backs UCP?

Google says UCP was co-developed with Shopify, Etsy, Wayfair, Target and Walmart and endorsed at launch by more than 20 companies including Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa and Zalando. Governance sits with domain Tech Councils. The UCP maintainers file lists the Shopping Tech Council as Google, Shopify, Etsy, Target, Wayfair, Amazon, Meta, Microsoft, Salesforce and Stripe. The last five joined on April 24, 2026. Separate councils now cover food ordering (DoorDash, Square, Toast and Uber Eats alongside Google), lodging (including Booking.com, Expedia, Hilton and Marriott) and payments (including Adyen, PayPal and Stripe).

What does the UCP spec contain?

UCP is layered. Shopify's engineering write-up describes a core "shopping service" (checkout session, line items, totals, status), capabilities that are versioned independently (Checkout, Cart, Catalog, Orders, Identity Linking) and extensions such as fulfillment, discounts and loyalty. The parts a merchant touches:

• A business profile at /.well-known/ucp - a JSON file declaring which capabilities, versions and payment handlers you support. Google reads it to negotiate what it can do with your store.
• Checkout APIs - native (checkout rendered on Google's surface) or embedded (an iframe of your checkout, for approved merchants with bespoke flows).
• Transports - REST and an MCP binding, with A2A also supported. Payments use tokenization and AP2 mandates, so authorizations carry cryptographic proof of user consent.

The release cadence is fast: v2026-01-11, v2026-01-23, v2026-04-08 (Cart, Catalog search and lookup, request signing) and v2026-08-25 (3D Secure flows, deposits and installment schedules, split payments, a loyalty extension and grocery readiness).

Where can shoppers check out with UCP today?

On eligible product listings in AI Mode in Google Search and the Gemini app, in the US, for participating merchants. Shoppers pay with Google Pay using cards saved in Google Wallet; Google's help page says the feature currently uses standard card numbers (FPANs) from Wallet. The Merchant Center help page is explicit that UCP-powered checkout "is available for select merchants at this time," and Shopify's documentation limits Google direct checkout to US-based stores selling to US customers. Everything beyond that in Google's May 2026 announcements is still marked "soon" or "in the coming months."

ACP vs UCP: how do they compare?

The core difference between ACP and UCP: ACP started as a checkout protocol for one assistant and has narrowed in practice to product feeds; UCP started as a full-journey protocol tied to Google's surfaces and Merchant Center. Both keep the merchant as merchant of record, and both are open source. The differences that affect a merchant:

The "ACP vs UCP" framing is less of a fight than launch coverage suggested. Stripe, Meta and Microsoft sit in both camps, and Microsoft's own documentation runs checkout on ACP while requiring a UCP-compliant feed in Microsoft Merchant Center. For most merchants the practical question is not which protocol to back but which surfaces your platform or PSP already connects you to.

Which AI platforms support which protocol?

Four consumer AI surfaces have merchant-facing shopping programs as of October 18, 2026. This table comes from each platform's own merchant documentation and Shopify's channel pages:

Two notes. First, "no fee" statements are worded as "today" or "at this time" on several of these pages; treat them as current terms, not commitments. Second, Shopify merchants are in a very different position from everyone else: agentic storefronts are active by default for eligible stores and syndicate products to ChatGPT, Google, Copilot and Meta through Shopify Catalog, with per-channel controls under Sales channels > Agentic.

What do merchants need to implement?

Three things, in order of effort: a clean product feed, a payment path your PSP supports, and published policies the agent can show at checkout. If you are on Shopify, most of the plumbing is done for you and your job is configuration and data quality. On a custom stack, the checkout API is the expensive part.

Product feeds

• For ChatGPT (ACP): a feed with stable product IDs, a unique ID per variant, variant-specific title, URL, price, availability and media, and factual descriptions. OpenAI suggests adding attribution parameters such as utm_medium=feed to product URLs. Shopify adds that legal disclosures should sit in the first 6,000 characters of the product description.
• For Google (UCP): a Merchant Center account in good standing with products approved for free listings. Each checkout-eligible product needs native_commerce(checkout_eligibility) set to TRUE (it defaults to FALSE). Products with regulatory warnings need a consumer_notice (legal disclaimer, safety warning or Prop 65). If feed IDs differ from your checkout API IDs, map them with merchant_item_id. Google's UCP Merchant Center guide recommends adding these through a supplemental data source rather than editing your primary feed.
• For Copilot: a UCP-ready Microsoft Merchant Center feed with native checkout eligibility, product warnings and a Merchant Item ID.

The same data quality issues hurt discovery even if you never enable checkout: a price on the page that disagrees with your structured data or feed is the most common reason an AI answer quotes the wrong price. AI Rank Lab's e-commerce AEO/GEO checker flags mismatches between visible and structured price or stock data on a product page, along with missing Product and Offer markup. (Disclosure: AI Rank Lab is our product.)

Payments

• ACP: if you process with Stripe, you accept Shared Payment Tokens, which carry usage limits such as a maximum amount and expiry. Stripe's SPT documentation says they are available in the US, Canada and select European countries, and can be resolved for use with a third-party processor. OpenAI warns that integrating directly with its Delegated Payment endpoints puts you in PCI scope and that it may ask for an attestation of compliance.
• UCP on Google: you need a Google Pay & Wallet Console account and a PSP integrated with the Google Pay API. You do not need a Google Pay button on your own site. Direct processing without a PSP requires encryption setup and PCI documentation.
• Copilot: one PSP checkout partner per merchant (Shopify, Stripe or PayPal). PayPal's Store Sync and Stripe's Agentic Commerce Suite are the non-Shopify routes Microsoft lists.

Policies and product eligibility

• Return policy with return cost, return window and a link to the full policy. Google treats this as a merchant-of-record requirement and shows it on the checkout screen.
• Customer support contact - at least one method in Merchant Center, used for the "Contact Merchant" link on the order confirmation.
• Excluded products. Google's checkout excludes subscriptions, installments, personalized goods, refurbished, used and final-sale items, pre-orders, freight or premium shipping, age-restricted items and services, among others. Shopify adds that subscriptions and product bundles are unsupported in Google's direct checkout. OpenAI's prohibited products policy keeps adult content, alcohol, nicotine, weapons and prescription-only medications, among others, out of ChatGPT.
• Store policies on Shopify - Terms of service, Privacy policy and Return and refund policy must be completed for Google direct checkout eligibility.

Which path fits your store?

What are the risks for merchants?

The main risks are fraud from agents you cannot verify, returns and chargebacks you still own, margin pressure from new discount formats, low conversion compared with your own site, and measurement gaps. None of them is a reason to ignore agentic commerce; all of them are reasons to switch it on deliberately.

Fraud and bot verification

An agent that can buy is also an agent that can be impersonated. Cloudflare noted in October 2025 that agent traffic has historically been classified by user agent and IP address, which "can be spoofed." Visa's Trusted Agent Protocol and Mastercard's Agent Pay both use Web Bot Auth, signed HTTP requests that tell you whether a registered agent is browsing or paying, with a nonce against replay attacks. On the payment side, ACP credentials are capped to a specific amount and merchant, UCP leans on AP2 mandates that record what the user authorized, and in ACP the merchant still runs its own risk checks and can decline any order. Practical step: know which agents are hitting your site now. Our list of AI crawler user agents covers the identifiers, and AI bot tracking logs AI bot visits per page.

Returns, refunds and chargebacks

You keep all of it. OpenAI's FAQ says the merchant "is responsible for handling refunds and chargebacks" and should send order updates back to the platform by webhook so order state stays in sync. Google requires your return policy to be shown at checkout and keeps final-sale items out of checkout entirely. ACP currently models one shipping address and one shipping option per checkout session, so split shipments must be consolidated into a single buyer-visible choice.

Margin and conversion

Platform fees are zero on most surfaces today, but the pressure is elsewhere. Instant Checkout charged merchants "a small fee" that OpenAI never published. Google's Direct Offers pilot invites retailers to show exclusive discounts inside AI Mode, and UCP checkout is coming to those ads. And the only hard conversion data point published so far is not encouraging: Walmart reported in-chat conversion three times lower than click-out to its own site. Start with a subset of high-margin, low-return SKUs rather than the whole catalog.

Measurement

Native checkouts break client-side analytics. Shopify's Google channel documentation states that Google Analytics and custom pixels "won't fire" in Google AI Mode and Gemini direct checkout; only server-to-server started and completed events fire. Orders still appear in Shopify admin with channel attribution, but your GA4 funnel will undercount. ChatGPT is the opposite case: because purchases happen on your site, you can measure them, as long as you capture the visit. Across 28 sites running the AI Rank Lab tracking tag (July 2025 to October 2026), 2,710 page views carried utm_source=chatgpt.com while 2,087 arrived with a chatgpt.com referrer, so a referrer-only setup misses part of ChatGPT traffic. That sample is mixed sites, not only stores, and counts page views, not users. Our guide to tracking AI referral traffic in GA4 shows the setup.

Control over your data

Opting out of a feed is not opting out of AI. Shopify warns that if you remove ChatGPT's access through Shopify Catalog, your products "might still be displayed or referenced" through web crawling. Feeds give you control over accuracy; robots rules and crawler access control what is crawled.

Agentic commerce readiness checklist

Work through this list in order. Steps 1-6 are worth doing even if you never enable agentic checkout, because they also improve how AI assistants describe and recommend your products.

Steps 1, 2 and 11 are where tooling saves the most time. AI Rank Lab's brand visibility tracking runs the shopping prompts you choose on ChatGPT, Claude, Gemini and Perplexity, stores every run, and records whether you are mentioned and which URLs are cited, and the AI Mode tracker does the same for Google AI Mode, which is where UCP checkout appears. If you are unsure how AI Mode differs from AI Overviews for shopping queries, see AI Mode vs AI Overviews.

How we researched this article

Every protocol fact above comes from the official spec, announcement or platform documentation, read on October 18, 2026: OpenAI's announcements and commerce docs, the ACP and UCP GitHub repositories (version history, maintainer files and commit logs), Google's blog posts and Merchant Center and developer documentation, Microsoft Advertising's Copilot Checkout pages, Shopify's Help Center and engineering blog, Stripe's documentation and the AP2 project site. Analyst numbers (Forrester, Walmart) come from CNBC's reporting and are labeled as such. We also read 12 of the top-ranking articles on agentic commerce protocols; several still describe Instant Checkout as a live merchant option.

Limitations: we did not run a live checkout integration ourselves, and we have no merchant conversion data of our own; the only first-party figures are the referral counts above. Platform terms on fees and regions are quoted as the platforms state them and can change without notice. Where two official Google pages disagree (Canada and Australia timing), we show both.

Agentic checkout will keep moving, but the work that pays off on every surface is the same: accurate product data, clear policies and measurement you trust. If you want to see where your products show up in AI answers today and what to fix first, run the AI Rank Lab e-commerce checker on your top product pages.