Creating an Online Store in 2026: Vibe Coding Is Tempting, but the Core Still Belongs on Shopify

“Do I even need an agency anymore if AI can build me a store in five minutes?” This question has been on everyone’s mind ever since AI tools started turning a single sentence into an amazingly sleek store design, and it’s one that anyone looking to create an online store or modernize an existing one is bound to ask. The honest answer: Maybe not for the storefront. For everything behind the “Checkout” button, however, you’ll need something solid—and that starts with a platform, not necessarily an agency.

We wanted to know for sure. On October 1, 2026, we fed an AI a single sentence—just as a business owner might type it after work. After about four and a half minutes, an online store for a coffee roastery in Cologne was up and running—and when we saw it, we briefly considered our hourly rates. Then we took a closer look, and we decided to keep our hourly rates as they were.

This article walks you through the steps involved in choosing a shop in the order you’ll need them: experimentation, security, obligations, costs, weaknesses, alternatives, and a reasonable middle ground. The test shop is called “Rösterei am Rhein”; the name and content are fictional—it does not refer to a real coffee roastery. We cite sources within the text, and we retrieved prices and help pages on October 1, 2026.

In a nutshell (as of October 2026)

At most, let an AI build the storefront, and handle the checkout, payment, taxes, and order fulfillment on a platform like Shopify. In our experiment, a presentable store with a hosted checkout was up and running in four and a half minutes, but the legal texts were placeholders, the “Cancel Order” button—required since June 19, 2026—was missing, and there was nothing in place for invoicing, inventory, or returns. If you already have an AI-generated store, search the code today for “cancel contract” and “fonts.googleapis.com.” If you can’t find the first one but do find the second, the store can’t go live as is.

Vibe Coding in E-Commerce: What Has Changed by 2026

Plan on spending just a few minutes today to design your store, and put your time into everything that comes after that. Vibe Coding means describing an application in everyday language and letting AI write the code without having to read it yourself. Tools like Lovable, Replit, v0 by Vercel, or Bolt quickly turn that into something that looks like a finished online store—and according to Bolt’s own blog post from April 10, 2025, it even comes with Stripe integration.

Shopify is also embracing AI: According to Shopify, since the Summer '25 Edition released on May 21, 2025, an AI shop builder has been generating three designs based on a brand description. On the “Build with AI” page, Shopify lists direct integrations with v0, Lovable, Replit, and Manus, with a clear division of labor: The AI tool handles “design, layout, copy, and UI,” while Shopify manages “products, inventory, checkout, payments, taxes, and shipping.” To find out when an AI website builder is sufficient for a standard business website, check out our article “Building a Website with AI: Lovable, Framer, Agents, and When It’s Enough.”

Optimize your product data so that AI can sell it, because Shopify now passes it on to AI assistants. Through Agentic Storefronts, introduced in December 2025, Shopify Catalog—according to Shopify—delivers products to ChatGPT, Perplexity, and Microsoft Copilot, while the merchant remains the seller. On January 11, 2026, Google’s Universal Commerce Protocol was added; Shopify lists Google AI Mode, Gemini, Copilot, ChatGPT, and the Shop app as channels. According to Shopify Help, Agentic Storefronts are enabled by default for eligible stores, so check your admin panel to see if this applies to your store; details can be found in our post on ChatGPT Shopping, Google’s UCP, and Agentic Commerce.

Expect growth from the market, but don’t expect miracles. According to the HDE Online Monitor 2026, online sales in Germany totaled 92.3 billion euros net in 2025—an increase of 3.9 percent—with online sales accounting for 13.5 percent of total retail sales. If a store can be set up in minutes, so can your competitors’. So write down three things today that truly set you apart, because those are exactly what belong on your storefront—the rest belongs on the platform.

Who's responsible for what: a Vibe-Codeter store versus a Shopify store. Checkout, taxes, and operations are handled by the platform, but in both cases, you remain responsible for complying with German legal obligations.

Our Experiment: An Online Store in Four and a Half Minutes

Feel free to give an AI your one-sentence task, but check the result the way we do here. Our task was, verbatim: “Build me an online store for my small coffee roastery in Cologne with 6 types of coffee, a shopping cart, and credit card payment. It should look modern and be ready to go live immediately.” It was carried out by an AI agent—that is, an AI that independently creates files and writes code—in our case, Claude. Aside from the destination folder, it received no specifications and no browser tools.

Yes, that's the AI we work with every day. After about 4.5 minutes, there were roughly 36 KB of code in the folder: a homepage, six product variants in the data/products.json file, a shopping cart saved in the browser, shipping for €4.90 to Germany and Austria (free shipping on orders over €39), a thank-you page, and pages for the legal notice, privacy policy, terms and conditions, return policy, and shipping information. Payment is processed through a hosted checkout by Stripe—that is, a payment page provided by Stripe itself. We viewed the result on a local test server using Puppeteer, a tool that remotely controls a browser; the store was never live online.

The homepage of our AI test shop, “Rösterei am Rhein,” on October 1, 2026, built from a single sentence in about four and a half minutes. The name and content are fictional; the coffee roastery does not exist.

Do the same: Start an AI store locally first, and click through it completely once before anything goes live.

Creating an Online Store with AI: What Went Right in Four and a Half Minutes

First, take a look at the price information—that’s where the AI really delivered. For each item, the base price per kilogram is listed, such as “250 g · 47.60 €/kg,” along with “incl. 7% VAT, plus shipping”; in the shopping cart, it shows “Total incl. VAT.” These are the elements required by the Price Indication Regulation in § 4 for the base price and in § 6 for the disclosure of sales tax and shipping costs. No law firm has verified whether every detail is sufficient, but the elements are all there.

The shopping cart in the AI test shop: the base price per kilogram for each variety, shown here as “250 g · 47.60 €/kg” (1), followed by “Total incl. VAT” and the button that leads to Stripe for credit card payment (2).

For every custom checkout you build, follow the pattern the AI has chosen here: a hosted payment page, with prices fetched from the server. Instead of using its own card form, the agent has integrated the hosted Stripe checkout, so card data never touches its own server. The api/checkout.js interface retrieves prices from the product file on the server, not from the browser, where they could be tampered with. It also performs checks for an empty shopping cart, unknown product variants, and quantities exceeding 20.

The AI did not include a link to the EU’s discontinued OS platform, and in the placeholders it even noted that Section 312g of the German Civil Code (BGB) must be observed for coffee ground to customer specifications. Most importantly, however, the agent honestly listed at the end what was still missing before going live. Read this list in its entirety—for us, it was the most useful part of the entire response.

What Was Missing from the AI Store: Legal Text, a Cancel Button, and a Made-Up Story

Treat every legal page from an AI store as empty until a specialized source has filled it in. Our cancellation policy, sample cancellation form, terms and conditions, and legal notice consisted of placeholders highlighted in yellow with the note “replace before going live.” That’s honest, but anyone who ordered “online immediately” is quick to click “Publish.” For the policy and form, there are statutory templates in Annexes 1 and 2 of the EGBGB, to which Article 246a(1) refers; a correctly completed template is considered sufficient.

The KI Test Shop's cancellation page: instead of cancellation instructions, there is a yellow-highlighted placeholder (1) with a note to replace it before the site goes live.

Search the code for a cancellation button, because ours was completely missing. Since June 19, 2026, Section 356a of the German Civil Code (BGB) requires an electronic cancellation function labeled “Cancel Contract” or something similarly unambiguous, followed by a confirmation step labeled “Confirm Cancellation.” This requirement is based on Directive (EU) 2023/2673, implemented in the Federal Law Gazette 2026 I No. 28 of February 5, 2026; the law firm Noerr points out the risks of fines and cease-and-desist letters. Neither of these elements appeared in the code of our AI shop.

Remove any story or number that you didn’t provide to the AI yourselves. The “About Us” page read: “Since 2019, we’ve been roasting coffee in a former bike shop in Ehrenfeld. Our drum roaster handles 15 kilograms per batch …,” along with the statement that we pay “significantly above the world market price,” and key figures such as “2 roasts per week, 15 kg per batch, 6 varieties in our lineup.” We hadn’t specified any of that. If such information remains on the site and is inaccurate, it’s misleading.

The "About Us" page of the AI Test Shop: a fictional company history about a former bike shop in Ehrenfeld (1) and made-up statistics such as two roasts per week and 15 kg per batch (2).

That’s precisely what makes it dangerous—because it sounds so believable: A former bike shop in Ehrenfeld is exactly the kind of detail that no one questions when skimming through the text. Read every “About Us” page written by an AI as if it had been written on someone’s first day on the job by someone who’s never even met you.

Load fonts from your own server, not from Google. The AI Shop embedded the Fraunces and Inter fonts directly from fonts.googleapis.com, which means that when a page is loaded, each visitor’s IP address is sent to Google. Solution: Download the font files and serve them yourself. Be sure to include this in your order—the AI didn’t do it for us on its own.

After clicking "Pay": What a vibe-code-enabled store can't do

When designing any online store, first ask what happens after payment is made. In our AI store, the process ended in the Stripe dashboard: There, you can see that someone has paid, and that’s it. There was no inventory tracking, no custom order confirmation, no invoice, no shipping label, no returns, and no export for accounting. With three orders a week, you can handle that manually; with thirty a day, it becomes a second job.

Check the label on the final order button yourself, even if it is located on the payment service provider’s page. According to Section 312j(3) of the German Civil Code (BGB), the button must be labeled “with nothing other than the words ‘place an order subject to payment’ or an equivalent unambiguous phrase”; otherwise, according to paragraph 4, no contract is formed. In our store, this button is located on the Stripe page, and the agent has set the ` submit_type ` parameter to “pay.” We have not verified whether the resulting label is sufficient; this is a point for review, not a finding.

Keep in mind that you’re fully responsible for running the AI Shop. Hosting on Vercel, the Stripe account, updates, security, and any legal changes are the owner’s responsibility. According to the agent, they had never viewed the site in a browser; so, until our test, not even its creator had seen it. Therefore, click through an AI Shop from start to finish—from the homepage to the thank-you page—before you send the link to anyone.

The results of our experiment: what the AI got right in four and a half minutes, and what is still missing or risky before it goes live.

Vibe Coding and Security: What the Numbers Say About AI Code

Never deploy AI code without a security review, even if everything seems to be working. According to a Veracode report dated July 30, 2025, 45 percent of code samples from over 100 language models failed security tests and contained vulnerabilities from the OWASP Top 10, the well-known list of common web security vulnerabilities. Eighty-six percent of the relevant samples failed the cross-site scripting test—which detects malicious code injected into websites—while for JavaScript, the language used in our test shop, the failure rate was 43 percent.

A year later, the situation is hardly any better. According to the Veracode report dated July 28, 2026, AI models pass an average of 56 percent of security tasks—up from 55 percent in the previous report—with the best model, GPT-5.5, achieving 68 percent. Models specialized in code—at 51 percent—did not perform any better than general-purpose models, which scored 52 percent. They succeeded in 83 percent of tests against SQL injection, but only 15 percent against cross-site scripting and 12 percent against log injection.

According to Veracode, the frequency with which AI code passes security testing in 2026: it usually passes for SQL injection, but rarely for protection against cross-site scripting and log injection.

For every AI app with a database, first check who is allowed to read which tables. According to a Semafor report from May 29, 2025, 170 of the 1,645 apps that Lovable listed on its website allowed anyone to read their users’ data—from names and email addresses to financial information and API keys. The vulnerability is tracked as CVE-2025-48757, and according to the disclosure by Matt Palmer, one of the two researchers who discovered it, tables containing transaction and subscription data were also exposed, along with the ability to change payment status.

According to The Next Web on April 21, 2026, a bug in Lovable’s interface later exposed profiles, source code, and database access; existing projects remained unpatched for 48 days. In Germany, according to a t3n report dated April 29, 2026, an investigation by *Die Zeit* in collaboration with Christopher Helm found that among 670 German-language sites on Supabase—a database popular among AI development kits—nearly one in two had security vulnerabilities. And according to UpGuard on September 25, 2026, 16,326 Supabase databases had publicly readable tables—found among approximately 300,000 domains examined—with e-commerce and the restaurant industry identified as the sectors at highest risk.

To be fair: Our test shop didn’t have a database at all—the product varieties were listed in a single file. That changes as soon as customer accounts, newsletters, or order history are added. If the AI then explicitly asks whether any table can be read without logging in, have the answer verified by someone who understands access rules—at Supabase, they’re called row-level security.

Payment and PCI DSS: Why You Shouldn't Build Your Own Point-of-Sale System

Use a hosted checkout solution and keep the payment page free of your own scripts. PCI DSS is the card industry’s security standard, and according to Stripe’s security guidelines, anyone who processes card data themselves may have to comply with “more than 300 PCI DSS security controls.” Hosted solutions like Stripe Checkout send the data directly to Stripe and reduce these obligations. That’s exactly how our AI designed it—its best decision in the entire project.

According to the audit firm Schellman, as of January 30, 2026, the short self-assessment questionnaire (SAQ A) applies if the payment page or payment fields are provided entirely by the certified provider, either via an iFrame or a redirect. If the merchant serves the payment page entirely or partially on its own—for example, using its own JavaScript—it falls under SAQ A-EP, even if the card data is sent directly to the payment service provider. This involves a few dozen requirements, compared to well over a hundred.

Maintain a list of all scripts running on your payment page. According to Barr Advisory, requirements 6.4.3 and 11.6.1 have been mandatory since March 31, 2025: an inventory that includes approval, integrity checks, and justification for each script on the payment page, as well as detection of changes to scripts and HTTP headers. According to a PCI Council FAQ dated February 28, 2025, merchants submitting an SAQ A have also been required since April 1, 2025, to confirm that their site is not vulnerable to script attacks. Never ask an AI for “a custom card form that matches my store’s design,” because, based on our assessment, a vibe-coded checkout with a custom card form or tracking scripts can cause your compliance level to drop from SAQ A to SAQ A-EP—meaning you’ll be subject to an audit with significantly more requirements.

The tasks that no prompt can handle

Before going live, go through the mandatory checklist point by point, regardless of whether an AI, an agency, or you built the store yourself. The points are taken from the legal texts on gesetze-im-internet.de as well as from the Chamber of Industry and Commerce (IHK), Händlerbund, and the Federal Ministry of Finance, as of October 1, 2026. You’re already familiar with the “button solution” and the cancellation button. This is a summary and not legal advice.

Displays prices in full, including the base price, tax, and shipping. Section 3 of the Price Indication Regulation requires the total price to be highlighted; Section 4 requires the base price for goods sold by weight, volume, length, or area; and Section 6 requires a statement regarding sales tax and whether delivery and shipping costs apply. Our AI handled this surprisingly well. Nevertheless, check every variant, because the base price is only correct if the weight in the product file is also correct.

Update the legal notice and remove an old OS link. The legal notice is now based on Section 5 of the Digital Services Act, which replaced the Telemedia Act; an old reference to “Section 5 TMG” can be quickly corrected. The EU Online Dispute Resolution platform was discontinued on July 20, 2025, pursuant to Regulation (EU) 2024/3228, and the requirement to provide a link to it ended. According to the Osnabrück Chamber of Industry and Commerce (IHK), any remaining link may be considered misleading.

Check whether the Accessibility Enhancement Act applies to you before you spend money on it or ignore it. The BFSG has been in effect since June 28, 2025; however, according to Section 3(3), it does not apply to micro-enterprises that offer services—that is, according to Section 2(17), businesses with fewer than ten employees and an annual turnover or annual balance sheet total of no more than 2 million euros. According to Händlerbund and the Berlin Chamber of Commerce and Industry (IHK Berlin), an online store is considered such a service; however, this exception does not apply to BFSG-relevant products that you sell. You can find out what needs to be implemented in our article “Accessible Websites: What Companies Must Implement by 2026.”

Register with the LUCID Packaging Registry before you ship your first package. Anyone who sells packaged goods commercially in Germany must, according to the Central Packaging Register, register once in LUCID; this requirement is non-transferable, and failure to comply may result in a sales ban. No online store platform or AI can fill out this form for you. For coffee in a bag, this means: register first, then open your store.

Start planning for e-invoicing for business customers now—don’t wait until 2027. According to the Federal Ministry of Finance’s FAQs, as of March 23, 2026, you must be able to receive e-invoices as of January 1, 2025; an email inbox is sufficient. You’ll be required to issue e-invoices for transactions with other businesses starting in 2027 if your previous year’s revenue exceeded 800,000 euros, and starting in 2028, you’ll generally have to issue them for all transactions, in formats compliant with EN 16931 such as XRechnung or ZUGFeRD version 2.0.1 or later. Sales to private customers and small-amount invoices up to 250 euros are exempt.

For every cookie and every script, ask whether it may run without consent. According to Section 25 of the TDDDG, storing and reading data on the end device is permitted only with consent, unless it is absolutely necessary for an explicitly requested service, such as a shopping cart. Based on our interpretation, our AI shop’s shopping cart falls under this provision, whereas analytics and advertising scripts do not. Before going live, specify which tools will load only after the user clicks the consent banner.

The new requirements for online stores that have been in effect since 2025 or will take effect soon, along with what you specifically need to do in each case.

Why the Core Still Belongs on Shopify

Eliminate the components that don’t set your brand apart from others: checkout, payment processing, hosting, and peak traffic. According to Shopify, the platform is PCI DSS Level 1 certified by default for every store. According to the pricing page, every plan includes unlimited hosting, a custom domain, SSL, and the AI assistant Sidekick. This means the checkout process—including security maintenance—is handled by Shopify and not through your code.

According to Shopify’s press release dated December 2, 2025, retailers worldwide generated $14.6 billion in sales over the Black Friday weekend, peaking at $5.1 million per minute. Your coffee Advent calendar probably won’t come close to those numbers, but a self-hosted AI store will have to handle the rush generated by a single newsletter on its own.

Take advantage of what’s already included in your plan before you start looking for an app. According to Shopify’s Help Center, Shopify Payments accepts Visa, Mastercard, Maestro, American Express, and UnionPay in Germany; Apple Pay, Google Pay, and Shop Pay work automatically; you’ll need to enable Klarna manually; and you’ll need to integrate PayPal separately. As of April 2, 2026, B2B features are available in the Basic, Grow, and Advanced plans at no extra charge, including company profiles, up to three catalogs, volume discounts, and payment terms. For a coffee roaster that also supplies cafés on the side, this is exactly the kind of functionality a one-line store would never have built.

Shopify itself writes in its Enterprise Blog post from May 29, 2026, that tools like Claude Code or Cursor built functional storefronts in a matter of days, but payment processing, PCI compliance, fraud detection, taxes, and handling traffic spikes remained challenges for years. While this is a vendor source with its own agenda, we still agree with the rule of thumb it offers: buy what doesn’t set your brand apart; build what does. The fact that Lovable, v0, and Replit can now hand off checkout and payment processing to Shopify is, in our view, a sign that even their providers prefer to leave the operation of the checkout to a platform. So make two lists: one of what makes your store special and one of what simply has to work—and hand the second one over to the platform.

Shopify Costs in 2026: Plans, Fees, and German Extras

Be sure to factor in the subscription plan, payment fees, and the apps for legal documents and invoices—not just the subscription plan itself. According to the pricing page as of October 1, 2026, with annual payment, Basic costs €27 per month, Grow costs €79, Advanced costs €289, and Plus starts at €2,100. For monthly payments, the prices are 36, 105, and 384 €; the page doesn’t explicitly state whether these are net amounts, but we’re assuming they are. There’s a three-day free trial, followed by three months for 1 € per month—enough time to walk through the entire process of placing an order, issuing an invoice, and processing a return once.

The Shopify pricing page on October 1, 2026: Basic for €27 per month with annual billing (1) and, for the Plus plan, the note “Fully customizable checkout” (2), which is only available there.

Calculate the fees per order, as they increase with every sale. According to the pricing page, Shopify Payments charges 2.1% on the Basic plan, 1.8% on the Grow plan, 1.6% on the Advanced plan, and 1.3% on the Plus plan, plus €0.30 in each case. If you use a different payment provider, Shopify charges an additional 2% on the Basic plan, 1% on the Grow plan, 0.6% on the Advanced plan, and 0.2% on the Plus plan, on top of that provider’s fee. For an order over €30 on the Basic plan, that amounts to €0.93 with Shopify Payments; with a third-party provider, €0.60 is added to that provider’s own fee.

Be sure to factor in the German add-ons right from the start. Legal documents are available as apps, such as the Shopify Terms of Service package from IT-Recht Kanzlei for $9.90 per month or the legal documents from Händlerbund starting at €9.90 net per month with a 12-month minimum term. For invoices, for example, the Rechnungsprinter Pro app costs between $10.99 and $49.99 per month, depending on the number of invoices. A small shop on the Basic plan, using the Händlerbund legal texts and the lowest tier of Rechnungsprinter Pro, would thus end up paying 27 euros plus 9.90 euros plus 10.99 U.S. dollars per month before the first order incurs any fees.

Two more points regarding pricing: The Basic plan doesn't include any additional employee accounts; the Grow plan includes up to 5; the Advanced plan includes up to 15; and the POS Pro point-of-sale system for the store costs €79 per month per location. If you have a store and two people handling shipping, you should go with the Grow plan right away.

Shopify plans, payment fees, and the typical additional costs in Germany for legal documents and invoices, according to the pricing pages as of October 1, 2026.

Shopify Reviews: The Drawbacks You Should Know About Beforehand

Enable Shopify Payments whenever possible; otherwise, you’ll end up paying twice for every order. The additional fee of 0.2 to 2% charged by third-party payment providers is the most well-known drawback, and it hits small shops on the Basic plan with the full 2%. Be sure to review your billing statement line by line after the first month, especially for payments made via PayPal.

Use the checkout as Shopify provides it if you don't want to pay for Plus. According to Shopify Help, apps for the checkout's information, shipping, and payment pages are "available only to Shopify Plus"; beyond that, you can only customize the thank-you and order status pages. For most small shops, we think the default is the better choice anyway—above all, a checkout just needs to work.

Take into account the gaps in the German market that you can fill using an app. GoBD-compliant invoices, e-invoices in ZUGFeRD or XRechnung, DATEV exports, and legal documents are handled by German merchants through apps like InvoPass, sevdesk, Lexware Office, or easybill. According to Shopify, Managed Markets—where a partner acts as the seller and handles customs duties—is not available to German merchants. And themes in Shopify’s Liquid template language, as well as app subscriptions, do not transfer when you switch platforms—that’s a real lock-in.

Read the data processing agreement before your data protection officer asks for it. According to Shopify’s agreement, updated on July 7, 2026, Shopify International Limited in Ireland processes data from the EEA, which is transferred to Shopify Inc. in Canada based on the adequacy decision for Canada; according to the annual report, the platform runs largely on Google Cloud. If you specifically want a European provider, Shopify isn’t the right choice for you. Everyone else should submit the agreement to their data protection officer before going live.

Shopify, WooCommerce, or Shopware: Which One Is Right for You?

Choose the system based on who will be running it in three years, not on market share. According to W3Techs, as of October 2026, WooCommerce leads the global e-commerce platform market with 47.7%, followed by Shopify with 32.1%. Among the 1,000 German online stores with the highest revenue, according to EHI and ecommerceDB for 2025, Shopware leads with 11.5%, ahead of Adobe Commerce with 10.8%; Shopify ranks third and has gained 4.5 percentage points since 2023, while 40% are custom-built solutions. Market shares indicate what’s widely used, not what’s right for your team.

Go with WooCommerce if you’re already using WordPress and someone else is handling maintenance. The software is free and open-source; according to woocommerce.com, hosting costs $25 to $350 per month, and individual extensions cost $29 to $299 per year—all prices are in U.S. dollars. Updates, security, payment plugins, and peak traffic loads are then your responsibility again—just within the WordPress ecosystem instead of in AI code. In our experience, this is the more labor-intensive option without technical assistance.

Check out Shopware if your revenue and requirements are significantly higher than those of a small store. According to Shopware’s pricing page, the Community Edition is free and self-hosted; plans start at 600 € net per month for Rise, 2,400 € for Evolve, and Beyond is available upon request, depending on the store’s revenue “as well as other individual factors.” For a store that could start at €27 on Shopify, this is in a whole different league.

For small and medium-sized retailers who want to set up a new store or modernize an existing one, we usually recommend Shopify because it requires the least amount of work on your part. If you’re happy with WooCommerce, there’s no need to switch. Write “Who handles updates, checkout, and security?” at the top of a sheet of paper and fill in real names.

The Smart Middle Ground: An AI Storefront on Shopify

If you want a design that no theme offers, connect the AI storefront to Shopify instead of having a custom checkout built. According to its own blog, Lovable has been building the storefront since October 20, 2025, and Shopify handles “checkout, payments, subscriptions, and taxes.” According to Lovable’s documentation, accessed on October 1, 2026, this works for both new and existing Shopify stores. Development stores are free; after the takeover, there’s a 120-day free trial, after which you’ll need a paid plan, and stores that aren’t taken over expire after 30 days.

Be aware in advance of what you’re giving up with this setup. According to the comparison site Ecommerce-Platforms.com, updated on February 18, 2026, most Shopify apps for Liquid themes don’t work with a Lovable storefront; only the person who connected the store has write access, and you’re locked into the tool. Based on our assessment, the standard theme editor—where you can edit text and images yourself—is also no longer available, because the storefront is then embedded in the AI tool’s code. Therefore, connect the store to an account that belongs to the company—not to a freelancer or a nephew.

Use Vibe Coding where it shines: prototyping, storefronts, and support tools. On September 2, 2025, Practical Ecommerce called Vibe Coding the “new Excel of e-commerce”: great for support tools, but not for the core store. Feel free to test your next idea—such as a calculator for subscription quantities or an internal packing list—as an AI prototype first before investing money in its implementation.

Conclusion: today, this week, later

Today, you’ll decide what the AI is allowed to build and what belongs on the platform, and check an existing AI-generated store for a cancellation button, placeholders, and Google Fonts. Search the code for “Cancel contract,” highlighted placeholders, and fonts.googleapis.com. Remove any made-up numbers from the “About Us” page and take out an old OS link.

Here's the plan for your store: review and decide today, calculate and register this week, and switch to e-billing later.

This week, you’ll set up a test store on Shopify, run a test using your actual shopping cart to calculate pricing, Shopify Payments, and the apps for legal notices and invoices, and set up LUCID and the consent banner. If you’re already using WooCommerce or Shopware, instead make a note of who is responsible for updates, checkout, and security.

Later—depending on the previous year’s revenue, by 2027 or 2028—you’ll switch your B2B invoices to e-invoicing and verify each new legal requirement yourself, rather than relying on AI. If you’d prefer to have an online store built for you, you’ll find our offer at the very bottom of this page.

What Has Changed and What That Means for You

March 31, 2025: PCI-DSS requirements 6.4.3 and 11.6.1 regarding scripts on payment pages will be mandatory. For you, this means: Every script on the checkout page requires justification; a hosted checkout page saves you from having to deal with most of that.

October 20, 2025: Lovable integrates AI storefronts with Shopify. For you, this means that custom AI design and a verified checkout are no longer mutually exclusive—yet they cost as much as most apps for Liquid themes.

April 2, 2026: Shopify offers B2B in the Basic, Grow, and Advanced plans at no extra charge. For you, this means that if you also supply business customers, you no longer need the Plus plan.

June 19, 2026: The cancellation button required under Section 356a of the German Civil Code (BGB) is mandatory. For you, this means: Every online store must include a “Cancel Contract” option plus a confirmation step; our AI store was missing both.

July 28, 2026: Veracode reports a 56 percent pass rate for AI-generated code. For you, this means that newer models don’t automatically produce more secure code—review remains essential.

September 25, 2026: UpGuard finds 16,326 Supabase databases with publicly readable tables. For you, this means: Customer data does not belong in an unverified AI database.

October 1, 2026: The date of this post and the day of our experiment. For you, this means: An AI store built from a single sentence is cool, but it’s not ready to go.

Would you like us to plan your Shopify store or review your AI store before it goes live?

We plan and build online stores on Shopify and also review any store built for you by AI before it goes live. Specifically, this includes: the theme and design, German legal compliance via a legal text service, payment methods, invoicing and bookkeeping, site speed, accessibility, and a handover so you can manage the store yourself afterward. You can find more details on our page “Have an Online Store Built with Shopify.” We do not provide legal advice; the legal texts come from a specialized service.

Just send us a quick message through our contact form —a link to your store or a brief description of your idea is all it takes to get started. We’ll respond within 24 hours, personally and without any sales pitch.