UCP vs ACP vs AP2 in 2026: which agentic commerce standard merchants should build on

Summary. UCP, ACP and AP2 are not three competing answers to one question. Google's Universal Commerce Protocol (UCP) covers discovery, catalog and cart. The Agentic Commerce Protocol (ACP), from OpenAI and Stripe, covers checkout execution inside an AI surface. The Agent Payments Protocol (AP2) proves who authorised a payment. One purchase can use all three. The 2026 evidence points one way for most merchants: put the catalog work first and hold on to your own checkout. Google co-developed UCP with Shopify, Etsy, Wayfair, Target and Walmart, with more than 20 further companies endorsing it, per EMARKETER. ACP went the other way: OpenAI launched Instant Checkout in September 2025 and pulled native checkout in March 2026, roughly six months later, with only about a dozen Shopify merchants live. Google donated AP2 to the FIDO Alliance on 28 April 2026, alongside the v0.2 release, with 60 organisations signing off. The money is still small but moving fast: EMARKETER's December 2025 forecast puts AI platforms at 1.5% of US retail ecommerce sales in 2026, or $20.57 billion, nearly quadruple 2025.

The practical question is not which standard wins. It is which layer you pay engineers to build this quarter, and which one you let your commerce platform absorb for you.

The three standards solve different problems

The naming is unhelpful. UCP, ACP and AP2 sound like alternatives. They are closer to a stack.

UCP answers "what is for sale and how does the cart get built". It defines how an agent reads a merchant's catalog, assembles a cart, completes checkout, and handles orders and post-purchase support. Google describes it as a common language between consumer surfaces, businesses and payment providers, so a merchant does not need a bespoke integration per agent. Google's own developer documentation makes the interoperability explicit: UCP works with AP2, Agent2Agent (A2A) and Model Context Protocol (MCP).

ACP answers "how does a purchase execute inside an AI surface". Stripe and OpenAI published it as an open standard under Apache 2.0, with building blocks for agentic checkout, cart and product feed, delegated payment tokens, and delegated authentication over OAuth 2.0.

AP2 answers "who said yes, and can you prove it". It represents each agent purchase as three signed mandates: an Intent Mandate for what the user wanted, a Cart Mandate for what the agent assembled, and a Payment Mandate for what gets charged. Each is structured as a W3C Verifiable Credential, and the protocol targets three properties: authorization, authenticity and accountability.

Read those three sentences again and the overlap shrinks. UCP and ACP genuinely compete on discovery and checkout. AP2 competes with neither. It sits underneath both.

UCP: discovery, catalog and cart

UCP is Google's play, built with Shopify. The endorsement list runs through Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa and Zalando, alongside co-developers Etsy, Wayfair, Target and Walmart. Note that Stripe appears on both lists. That is a signal about how this ends: the payments layer refuses to pick sides.

Two design decisions matter to your engineers.

First, UCP's catalog model is a pull. Agents query merchant servers for live data. Freshness is guaranteed because the agent reads your system of record, but your API has to survive agent traffic. If your product API buckles at 50 requests per second today, agentic discovery is an availability problem before it is a revenue opportunity.

Second, the merchant keeps the relationship. Google's merchant documentation is direct about it: you remain the merchant of record, you keep customer data and relationships, you own your business logic and the post-purchase experience. UCP-powered checkout surfaces in Google AI Mode and the Gemini app, and Google states that UCP-powered checkout is available to eligible US-based merchants with global expansion planned through 2026.

The scale behind the discovery side is worth a number. Google's AI Mode draws on the Shopping Graph's 50 billion-plus product listings, per EMARKETER. That is the index your catalog is competing inside.

ACP: what survived Instant Checkout

This is where most 2026 comparison articles are stale, and where merchants get hurt.

OpenAI launched Instant Checkout in September 2025 with Stripe, letting shoppers complete orders inside ChatGPT. The Information broke the story in March 2026 that OpenAI had nixed it. Forrester analysts Emily Pfeiffer and Sucharita Kodali confirmed the mechanics on 7 March 2026: checkout moved into merchants' apps within ChatGPT or back to merchants' websites, which, as they put it, "makes the answer engine just a referral, as search engines always have been."

The failure was not conceptual. It was logistical. Per Modern Retail, only around 12 merchants ever went live, OpenAI never built sales tax collection or fraud prevention, and real-time inventory sync across merchants at scale did not work. Shopify told Forrester a month before the pullback that the live number was closer to 30 and climbing. Against Shopify's millions of merchants, both numbers say the same thing.

Forrester's inventory point is the one engineering leads should sit with:

"Inventory management has been disastrously absent from the plan. Because most product feeds into answer engines were either pulled in by the engine (via crawling merchant websites and scraping the product data) or via feed (like from commerce solutions such as Shopify), the engines usually only saw what was available for sale on the site." Emily Pfeiffer, Principal Analyst, Forrester

The protocol itself did not die. OpenAI and Stripe continue developing ACP, and the scope narrowed to app-based purchases with a smaller pool of large integrated retailers. OpenAI's own March 2026 position was to let merchants use their own checkout and focus ChatGPT on product discovery: visual browsing, side-by-side comparison of price, reviews and specifications, and image-upload search, with the shopper redirected to the retailer to pay. Per EMARKETER, ChatGPT now enables purchases via third-party apps that plug into the chatbot rather than a native checkout.

So ACP in mid-2026 is a discovery and app-surface protocol with a checkout capability that its own flagship consumer surface stopped using. That is not a reason to ignore it. It is a reason to size the investment honestly.

AP2: the authorisation layer, now at FIDO

AP2 started as Google's protocol and stopped being Google's protocol. Google announced the donation of AP2 to the FIDO Alliance to keep it platform-agnostic and community-led, releasing v0.2 on GitHub on 28 April 2026. Sixty organisations signed off, including Mastercard, Adyen, PayPal and Coinbase.

Governance now runs through two FIDO working groups, per The Paypers: the Agentic Authentication Technical Working Group, chaired by CVS Health, Google and OpenAI and vice-chaired by Amazon, Google and Okta, and the Payments Technical Working Group, chaired by Mastercard and Visa. OpenAI chairing a working group on the protocol Google built is the clearest available evidence that the payments layer is consolidating rather than fragmenting.

The mandate chain is the part worth understanding. Conceptually, a compliant purchase produces a signed chain like this:

            {
  "intent_mandate": {
    "user_instruction": "buy running shoes under $120, size 10",
    "constraints": { "max_price": 120, "currency": "USD" },
    "signed_by": "user_device_key"
  },
  "cart_mandate": {
    "items": [{ "sku": "RUN-3391", "price": 109.00, "qty": 1 }],
    "merchant": "example-merchant",
    "signed_by": "agent_key"
  },
  "payment_mandate": {
    "amount": 109.00,
    "currency": "USD",
    "method": "card",
    "signed_by": "user_device_key"
  }
}
          

Each mandate is a W3C Verifiable Credential, so the chain is independently checkable. For a disputed transaction this is the difference between "the agent says the customer wanted it" and cryptographic proof of what the customer actually authorised, at what price ceiling, before the cart existed. Chargeback teams should care more about AP2 than marketing teams care about UCP.

How the three compare

Who owns which step of the purchase

The pattern is hard to miss. AP2 is orthogonal. UCP and ACP overlap on two rows, and on both of those rows ACP retreated in 2026.

What the 2026 adoption data actually says

Hype and revenue are not the same number, and merchants keep budgeting against the first one.

Consumer adoption of answer engines for shopping is real but early. Per Forrester's December 2025 Consumer Pulse Survey, 23% of Gen X US online adults had used ChatGPT in the past month to search for products, rising to 32% of Millennials and 35% of Gen Z. Single digits for older generations. Forrester's March 2026 ConsumerVoices research found that among regular answer-engine users in the US, UK and Canada, completing a purchase inside the answer engine was their least-adopted use case. Asking general questions and researching products were the top two.

That ordering explains everything about Instant Checkout. Consumers came to answer engines to research, not to pay.

The transaction data still supports investment, just aimed at the right layer:

Two figures in that table should change your roadmap. Shoppers arriving from AI platforms convert roughly 30-40% better than non-AI traffic (Adobe: +31% over holiday 2025, +42% in March 2026), and only 11% of retailers say they are ready to scale AI. The traffic converts and almost nobody is prepared for it. That is a discovery investment, not a checkout investment.

The retail media number is the counterweight. US advertisers will spend $71.98 billion on retail media in 2026, and agentic discovery erodes exactly the sponsored placements and keyword ads that money buys. If you run a retail media business, agentic commerce is a margin threat before it is a channel.

The build order that makes sense for most merchants

The real cost is rarely the protocol client. It is the catalog data underneath it.

Whatever the row, the first line item is the same: your product data. Both protocols read the same catalog. Clean specs, accurate stock, full-sentence descriptions and indexable reviews serve UCP, ACP, AI Overviews and your own site search at once. That work does not get stranded if a protocol loses.

The engineering sequence we would run:

1. Audit catalog truth. Does your product API return real-time stock, or a nightly snapshot? Instant Checkout broke partly on this. Agents surfaced items that were not buyable.

1. Decide channel inventory deliberately. Forrester's point stands: engines saw only what the site showed, with no allocated assortment for the channel. Out-of-stock items got recommended and exclusives leaked into surfaces they were never meant for.

1. Harden the API. Rate limits, caching, and a load profile that assumes agent traffic is bursty and non-human.

1. Structure the data for extraction. This is the same work as generative engine optimisation, and it pays before any protocol ships.

1. Only then wire a protocol client, and prefer the one your platform already speaks.

Merchants who invert this order buy a UCP integration that faithfully serves wrong inventory to a very large audience.

India-specific considerations

The US-first rollout means Indian merchants are watching a different clock, and a domestic layer is forming underneath.

The National Payments Corporation of India (NPCI) is developing a Unified Agent Protocol (UAP) to authenticate AI agents and allow agentic AI-led UPI transactions, per Business Standard in July 2026. A working pilot already exists. Razorpay and NPCI announced agentic payments on 20 February 2026 at the India AI Impact Summit in New Delhi, letting a pilot group order food, groceries and everyday essentials from Zomato, Swiggy and Zepto inside a conversation.

The mechanism deserves attention from anyone reading AP2. Razorpay's flow is built on UPI Reserve Pay: the user gives a one-time, consent-based authorisation with a spending limit for a merchant, and agents transact within those limits. That is the same idea as AP2's Intent Mandate, expressed in UPI primitives instead of W3C Verifiable Credentials. India did not wait for the protocol debate to resolve. It shipped the consent model on the rail it already had.

Three consequences for Indian D2C engineering leads.

UPI is not a card rail, and AP2's mandate model was designed with card networks, stablecoins and real-time bank transfers in scope. A UPI-native agent flow will most likely settle through NPCI's framework rather than through AP2 directly, so an India-only merchant should track UAP more closely than AP2. Our UPI analysis for D2C merchants covers the rail-level mechanics.

Low-value repeat purchases such as groceries and daily essentials are the first agentic use cases in India, going by what the Razorpay pilot actually covers. That favours quick commerce and subscription catalogs over considered-purchase categories, and maps to the channel economics we set out in ONDC versus quick commerce.

Consent records are personal data. Under the Digital Personal Data Protection Act 2023 (DPDP), an agent's Intent Mandate captures a user instruction and constraints, and a Payment Mandate ties a person to a transaction. We design applications aligned with DPDP requirements, which means deciding retention and purpose limitation for mandate chains before you store your first one, not after.

What to do in the next 90 days

Forrester's advice to merchants was to diversify and hedge, and it holds up:

"No merchant should be 100% reliant on any one digital channel or partnership for their strategy. OpenAI's pivot is your reminder to spread risk." Emily Pfeiffer, Principal Analyst, Forrester

Concretely, for a mid-sized D2C team:

Weeks 1 to 3: catalog audit. Stock accuracy, price freshness, description completeness, review indexability. Fix what is wrong before exposing it to agents.

Weeks 4 to 6: API load and correctness work. Assume agent traffic patterns. Instrument what an agent actually requests.

Weeks 7 to 9: protocol decision. If you are on Shopify, confirm what your platform already exposes and configure it. If you are not, scope a UCP catalog integration and nothing else.

Weeks 10 to 12: payments conversation with your PSP about AP2 mandate support and dispute handling. Ask what evidence they will hold and for how long.

Deliberately absent: building your own in-chat checkout. The company with the largest AI consumer surface on earth tried it, shipped it, and withdrew it in six months. Our AI shopping agents guide for D2C brands goes deeper on the channel strategy, and the GEO platform playbook covers the discovery-side work in detail.

FAQ

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified, senior-led engineering organisation in Gurugram that builds and hardens the commerce APIs these protocols read. We audit catalog truth and inventory accuracy, load-test product APIs against agent traffic patterns, and scope protocol integrations that match your platform rather than the loudest announcement. For Indian merchants we design against DPDP requirements and track NPCI's agent framework alongside UCP and AP2. Talk to our team via /contact-us/ about an agentic commerce readiness review.

References

1. Google Universal Commerce Protocol (UCP) Guide. Google for Developers

1. Under the Hood: Universal Commerce Protocol (UCP). Google Developers Blog

1. About the Universal Commerce Protocol (UCP) and UCP-powered checkout. Google Merchant Center Help

1. New tech and tools for retailers to succeed in an agentic shopping era. Google

1. Building the Universal Commerce Protocol. Shopify Engineering

1. Developing an open standard for agentic commerce. Stripe

1. Agentic Commerce Protocol documentation. Stripe Documentation

1. Agentic Commerce Protocol specification. OpenAI and Stripe, GitHub

1. We're donating Agent Payments Protocol to the FIDO Alliance. Google

1. Announcing Agent Payments Protocol (AP2). Google Cloud Blog

1. Google donates the Agent Payments Protocol to FIDO Alliance. The Paypers

1. What It Means That The Leader In "Agentic Commerce" Just Pulled Back. Emily Pfeiffer and Sucharita Kodali, Forrester, 7 March 2026

1. FAQ on agentic commerce: How brands should act now. EMARKETER, 7 April 2026

1. What went wrong with ChatGPT's Instant Checkout. Modern Retail

1. OpenAI's first crack at online shopping stumbled. CNBC, 20 March 2026

1. OpenAI shifts checkout plans in its agentic commerce strategy. Digital Commerce 360, 6 March 2026

1. India may allow agentic AI-led UPI transactions under new NPCI protocol. Business Standard, July 2026

1. How NPCI should approach agentic payments. Medianama, July 2026

1. AP2 protocol documentation. Agent Payments Protocol

1. Agentic Commerce Protocol. OpenAI and Stripe

1. Razorpay and NPCI: agentic payments for UPI. Razorpay, February 2026

1. Razorpay and NPCI launch agentic payments. The Paypers

Last updated: 15 July 2026.