Key takeaways
- • 100 out of 100 domains: FAILED. Not a single one of the highest-revenue German online retailers reaches CERTavia CERTIFIED status.
- • Average Compliance Evidence Score: 21.5 out of 100. CERTIFIED threshold: 70.
- • Best value in the dataset: 45.9 — 65.7 % of the CERTIFIED threshold.
- • Cluster D (Authority) is the only dimension with a market average above 70. All other clusters fall between 12 and 20.
- • Parallel scan with the SOVP protocol: also 0/100 CERTIFIED. Two independent protocols, one finding.
Thesis German e-commerce has internalized GDPR compliance and structurally neglected every other compliance dimension. Cluster D is the proof — it is the only one the market knows.
On June 17, 2026, CERTavia scanned the 100 highest-revenue German online retailers. The basis is the EHI/ECDB 2025 ranking, the authoritative benchmark study for the German B2C e-commerce sector. The result is unambiguous: 100 out of 100 domains: FAILED.
Dataset and protocol
The scan is based on the EHI/ECDB 2025 ranking of the highest-revenue B2C online retailers in Germany. Each of the 100 domains runs through the full CERTavia Compliance Evidence Score protocol (CES) with 80+ parameters across six clusters:
- Cluster A · Content: Transparency & governance
- Cluster B · AI Readiness: Technical documentation
- Cluster C · Infra: AI policy & explainability
- Cluster D · Authority: Data protection foundation
- Cluster E · Conformity: AI governance declaration
- Cluster F · Structure: Certification readiness
All scans were carried out on June 17, 2026. The CERTIFIED threshold is 70 points. In parallel, a SOVP infrastructure scan (Sovereign Validation Protocol) ran on the same 100 domains.
The finding
The average Compliance Evidence Score across all 100 domains is 21.5 out of 100. The CERTIFIED threshold is 70. Not a single retailer reaches it.
| Rank | Domain | CES score | Status |
|---|---|---|---|
| #1 | Retailer A | 45.9 | FAILED |
| #2 | Retailer B | 45.0 | FAILED |
| #3 | Retailer C | 40.2 | FAILED |
| Average (100 domains) | 21.5 | 0 CERTIFIED | |
The CERTIFIED threshold is 70 points. The best value in the dataset reaches 65.7 percent of that threshold. The 100 highest-revenue German online retailers generate combined net revenue of more than 80 billion euros per year.
Cluster analysis: where the market stands
CERTavia measures six clusters. Each cluster captures its own dimension of compliance readiness. The radar chart makes the structural asymmetry visible.
Cluster E (Conformity, avg. 13.5) and Cluster F (Structure, avg. 12.2), the dimensions directly relevant to the EU AI Act and NIS2, average below 14 out of 100.
What this means
The EU AI Act applies. NIS2 applies. DORA applies. The regulatory requirements for digital infrastructure and AI governance are binding.
The radar chart makes the asymmetry visible: a single cluster pulls the overall picture upward, because five other dimensions still show barely any contour. This is not a niche problem for individual companies. It is a structural market gap in Germany's highest-revenue e-commerce segment.
The cross-comparison: two protocols, one finding
In parallel with the CERTavia scan, a SOVP infrastructure scan (Sovereign Validation Protocol) ran on the same 100 domains.
SOVP result: 0/100 CERTIFIED. 100/100 NOT_READY in the FullScan. Two independent protocols. One finding. The gap exists at both levels simultaneously: the technical infrastructure level and the regulatory compliance level.
Notably, the scores barely correlate. Companies with strong infrastructure readiness show regulatory weaknesses. Companies with a higher CES score lag behind on infrastructure. Both dimensions are developing separately from one another in German e-commerce.
What comes next
This scan is the first ECOM100-DE benchmark. CERTavia updates this dataset quarterly. The next scan date is September 2026.
Companies that want to know their own CES score start with the basic report for their domain. The basic report delivers the full CES score, all six cluster values, and the sector rank position.
All 100 domains with gap analysis and executive summary
CERTavia analyzes technical infrastructure signals. The result is a machine-readable finding, not a legal opinion and not a certification within the meaning of the EU AI Act conformity assessment under Article 43. Data basis: EHI Retail Institute / ECDB, German e-commerce market 2025. Scan date: June 17, 2026.
