We scanned 34 market leaders. Most of them haven't done it either.

What we actually did

On 28 August 2026 we requested a fixed list of URLs from 34 websites and read what came back. Zero AI calls, zero cost, no interpretation in the middle — this is a file-and-header scan, the same mechanical checks that run against your own site in the audit section of a report. That is also the limit of it, and we come back to that below.

The 34, in three groups:

• 16 SaaS and tech — Shopify, HubSpot, Notion, Stripe, Figma, Canva, Atlassian, Cloudflare, Zapier, monday.com, Semrush, Ahrefs, Mailchimp, Intercom, Klaviyo, Webflow.
• 8 DTC and retail — Allbirds, Glossier, Warby Parker, Patagonia, Nike, Gymshark, Away, Brooklinen.
• 10 China-based global brands — Anker, DJI, EcoFlow, Roborock, Insta360, UGREEN, Narwal, SHEIN, Temu, Lenovo.

For each one we asked for 10 AI-facing files (llms.txt, agents.md, ai.txt, an agentic-discovery sitemap, .well-known/mcp.json and others), read robots.txt and checked it against 22 named AI crawlers, and pulled the homepage to count its structured data, its h1 elements and how many words of readable text the HTML contains before any JavaScript runs.

Three of the 34 refused us. Warby Parker returned 403, Patagonia 404 and away.com dropped the connection — bot mitigation reacting to a datacentre IP address, almost certainly, not a statement about their sites. Their homepages are therefore unmeasured, not zero, and every count below is out of the 31 homepages and 30 robots.txt files we could actually read. Roborock's robots.txt also failed to load.

Finding 1: the file you are being told to write, most of them don't have

llms.txt is the flagship deliverable of a lot of GEO packages. Across the 34:

File	Found on
/llms.txt	22 of 34
/llms-full.txt	12 of 34
/agents.md (or /AGENTS.md)	9 of 34
/sitemap_agentic_discovery.xml	7 of 34
/.well-known/mcp.json	4 of 34
/.well-known/ai-plugin.json	1 of 34
/ai.txt	0 of 34
/.well-known/agents.md	0 of 34
/mcp	0 of 34

It splits sharply by industry. 13 of the 16 software companies serve an llms.txt; 4 of the 8 DTC brands and 5 of the 10 China-based brands do. Companies whose customers are developers publish developer files. That is a less exciting explanation than "the leaders are ahead of you", and it fits the data better.

Two of these deserve saying out loud because they get sold anyway: nothing in this sample served an ai.txt, and Google's own documentation says it does not read llms.txt. A file is not a switch.

Finding 2: over half of the "AI introductions" were written by the shopping platform

Nine sites carry an agents.md — the file that tells an AI agent who you are and how to deal with you. We read all nine. Six of them are the same file.

Allbirds, Glossier, Gymshark, Brooklinen, EcoFlow and UGREEN each serve a 4,129–4,311 byte document headed # Agent Instructions — {brand}, and each of the six points an AI agent at shop.app — Shopify's own checkout — exactly eight times. Compared character by character, Allbirds' copy and UGREEN's differ only in the brand name and one policy link. Five of the six also serve an llms.txt containing exactly five links.

We have seen this file before. It was also on the site of a one-person handmade skincare business we scanned while building the method — same template, same eight pointers to someone else's checkout. So a large athleisure brand and a soap maker working out of a spare room currently introduce themselves to AI with the same paragraph, and neither of them wrote it.

Three sites wrote their own. Shopify's runs to 12,522 bytes, Zapier's to 1,205, and Anker's to 6,610 — Anker being the only brand in the sample that took the platform default and rewrote it, dropping shop.app from it entirely and adding sections on regional markets and canonical product links.

The point for you is not that these files are worthless. It's that having one and having written one are different states, and any audit that reports the first as a green tick is measuring your hosting provider.

Finding 3: the hand-written ones are mostly a table of contents

Where a company clearly did write its own llms.txt, the dominant format is a plain annotated list of its own pages. Stripe's carries 288 links, HubSpot's 201, SHEIN's 190. The platform-generated ones carry five.

That is a description of what they did, not evidence that it worked. We did not measure whether any of these files changed how an assistant talks about the company, and we are not aware of anyone who has published that measurement either.

Finding 4: almost nobody is blocking AI crawlers

This is the question small-business owners ask us most: should I block the AI bots? Of the 30 robots.txt files we could read, only 7 mention any of the 22 AI crawlers we checked, and only 3 block one:

Site	AI crawlers fully disallowed
Canva	12
Figma	7
Notion	2
The other 27 readable sites	none

The three who do block are all companies whose product is a design or document canvas, i.e. companies with an obvious training-data reason of their own. Everyone else lets them in. If someone has told you to shut the AI crawlers out as a defensive measure, the top of the market is doing the opposite.

Finding 5: the basics aren't universal at the top either

This is the part that changed how we write reports. Out of the 31 homepages we could read:

Check	Head-of-market sites passing
At least one h1 on the homepage	21 of 31
Any JSON-LD structured data at all	20 of 31
Organization schema	14 of 31
AggregateRating schema	2 of 31
Review schema	0 of 31

Ten of these companies have no h1 on their homepage. Eleven publish no structured data whatsoever. And review markup — a standing item on essentially every SEO checklist ever written — appears on two sites out of 31 in the form of an aggregate rating, and on none at all as individual reviews.

Readable text is uneven too. The median homepage served 1,059 words of text in its HTML before any JavaScript ran; the largest served 40,745. Four served under 300: UGREEN 72 words, Gymshark and Narwal one word each, Temu none. Their pages plainly work for humans in a browser — but an AI system reading the raw HTML sees close to nothing, and we did not run JavaScript, so all this measures is what arrives in the first response.

So how far off is a small business?

Nearer than the marketing suggests, on the mechanical checks at least. The column on the right is the five small businesses we ran the full method against while validating it. We don't name them and we don't publish any individual result — that rule applies to everyone who buys a report, which is why the sample report is pseudonymised too. Five is a tiny sample and the numbers below should be read as a sketch, not a rate.

Check	Head of market	Five small businesses
h1 on the homepage	21 of 31	1 of 5
Organization schema	14 of 31	2 of 5
Review / AggregateRating schema	2 of 31	0 of 5
robots.txt naming any AI crawler	7 of 30	0 of 5

Read the rows in order. The first is a genuine gap and worth ten minutes of somebody's time. The second is a gap against a majority that isn't itself a majority. The third and fourth are not gaps at all — nobody is doing them, at any size, and a report that listed them as your failings would be padding.

That is now a rule in how we write: a check has to be compared against this benchmark before it can be called a problem. Below the benchmark is a problem. Level with it is at most an opportunity. Above it gets said out loud as a win. It removed two items from our audit list outright, and it is the reason your report will not be a 60-line sheet of things you have not done.

What this study does not show

It is a file scan. It measures what these companies have deployed, and that is all it measures.

• It says nothing about whether AI recommends them. Not one AI query was run in this scan. No figure on this page is a visibility figure, and nothing here shows that any of these files or tags caused an assistant to name anyone. The measurement that answers that question is a different one — it's the method we sell.
• 34 is a small sample, and a chosen one. We picked recognisable names in three industries. It is not random, it is not representative of your sector, and there are no local service businesses in it at all — no clinics, trades or restaurants — so if that's you, this page is context rather than a peer group.
• One request each, from one place, on one day. No repeat fetches, no second location. Three sites blocked us and we have counted them as unmeasured rather than guessing.
• Homepage only, no JavaScript. Word counts and schema come from the initial HTML of the homepage. A site that renders in the browser will look emptier here than it is to a person.
• It will drift. This is a snapshot dated 28 August 2026, published as BENCH-2026-08-34 — the stamp printed at the foot of every report we produce, so you can always tell which scan your comparison was made against. These sites change weekly. When we re-run it the stamp changes with it, and old reports keep the old stamp so they stay comparable to each other.

What to take from this if you run a small business

Three things, and none of them is "buy something".

1. You are not as far behind as the pitch implies. Over half of these companies have no dedicated AI file beyond an llms.txt, two thirds of the ones that do had it written by their shopping platform, and eleven of them publish no structured data at all. Anyone quoting you thousands to catch up with the leaders should be asked which leaders, and shown this.
2. Don't block the AI crawlers. 27 of the 30 sites we could read let all of them through. This is the single cheapest thing on the page: go and look at your own robots.txt, for free, right now.
3. Files are not the interesting question. Everything on this page is infrastructure, and infrastructure is the part you can copy in an afternoon. What it cannot tell you is whether an assistant says your name when a customer asks — and on that, being at the top of the market clearly does not depend on having any of these files, because several of these companies have none.

The only way to know the second thing is to ask the assistants, in your category, and look at what comes back. That's the measurement, and you can start it without paying us.