How are AI-built apps doing in Germany, Austria and Switzerland?

The radar measures what is discoverable. Targets come from five public sources: the builder platforms' directories, public certificate logs (certificate transparency) and the Internet Archive's web archive (Wayback Machine) for builder subdomains such as *.lovable.app or *.bolt.host, the open web index Common Crawl (German-language pages only) and the scanning service urlscan.io, which shows apps on their own domain that load a builder platform's script. On top come targets found by an earlier retrieval that are less than 90 days old. Apps on their own domain without such traces are under-represented. Before scanning, we check reachability and DACH connection with a single request to the start page: a .de, .at or .ch domain ending, German page language, or a link to Impressum and Datenschutz — only such apps enter the sample. The correct reading is therefore “x% of the n discoverable apps with a DACH connection”, never “x% of German Lovable apps”. Attribution to DE, AT or CH happens after the scan via domain ending and legal findings; whatever cannot be attributed counts as not attributable and serves as a control group.

The scan is passive and browser-equivalent: it loads what any browser loads when opening the site, clicks nothing, fills in no form and creates no account. The user agent names us and this page, and robots.txt is respected — anyone who excludes us there is skipped.

Only shares over groups of at least 20 apps are published. No hostname, no URL, no screenshot and no finding attributable to a single site. Internally the raw data carries a hash that never leaves the database; the target list expires 90 days after the last scan.

Before every new methodology version we check the scanner for false alarms on well-maintained professional sites — any severe hit there counts as a possible false alarm and is fixed first. Most recently on 7 September 2026 against 47 real sites: six kinds of false alarm, all fixed (methodology 2026.17). That is a false-alarm check, not a baseline. As a baseline, on 20 October 2026 we measured 16 well-maintained professional sites (including bsi.bund.de, admin.ch, heise.de, bahn.de, stripe.com) with the same pipeline, with the browser stage and twice each: 5 of 16 had no effective Content Security Policy (AI apps: 98 %), 10 of 16 no CAA record (AI apps: 99 %), 3 of 15 fired trackers before consent (AI apps: 15 %; AI values from run Panel 2026-10-01). The group is small and deliberately prominent, so it is an upper bound, not an average; we do not publish findings for individual sites. We do not yet publish a false-alarm rate per rule. The numbers here are shares over a sample, not proof about any individual app.

If you do not want your domain in the radar, remove it: prove control via DNS TXT, file or meta tag — we then delete all observations and the target and exclude the domain from every future run. Without DNS access, an email is enough.