How Can a Compliance Officer Tell Whether an AI Citation Comes From an Unapproved Webpage?

What does an unapproved source look like?

The last two are not unapproved pages at all, which matters for your records. The answer is wrong, but your content is not the cause. How to handle a real page being misrepresented is covered in whether AI can cite a real URL but misrepresent what the page says.

How do you check a citation step by step?

1. Capture the evidence. Record the assistant, the mode or model if shown, the prompt, the full answer, every cited URL, the date and time, and a screenshot or export. Answers change between runs, so you may not see the same one again.
2. Clean the URL. Remove tracking parameters, such as the utm_source=chatgpt.com that ChatGPT adds to many links, along with session IDs and fragments. Follow redirects to the final URL.
3. Identify the host. Is it your main domain, a subdomain, an old domain you still own, a staging host, a representative's site or a third party? Unfamiliar subdomains are a common source of surprises.
4. Look it up in the register. Find the approval record: approval ID, version, approver, approval date and any expiry. If the URL is missing, the page was never approved, or it was approved under a different URL.
5. Compare text. Put the claim from the AI answer beside the approved version, the live page and any archived copy. Your CMS revision history, your own crawl snapshots and public web archives help establish what the page said and when.
6. Check the logs. Server logs show which crawlers fetched the URL and when, such as Googlebot, OAI-SearchBot, ChatGPT-User or PerplexityBot. If the page changed after approval and before the fetch, the assistant probably saw the unapproved version.
7. Classify and act, using the table above, and record the outcome.

Why do assistants cite pages that were never approved?

• They read everything public. Assistants do not distinguish marketing pages from help articles, job ads, investor pages or old blog posts. Any page that makes a product claim can be quoted.
• Old content stays findable. Pages left live after a product change remain indexed and can be recrawled.
• Files sit outside the CMS. PDFs, slide decks and images uploaded to public folders often escape the approval workflow and the content inventory.
• Staging sites leak. A test environment without authentication can be crawled like any other site.
• Blocking indexing is not removal. A noindex tag or robots rule can stop some systems but not copies elsewhere, as covered in whether a noindex page can still be cited by AI.
• Crawling is not the same as citing. A bot fetching a page does not mean it will be cited, and a cited page may have been fetched months earlier. Logs tell you what was available, not what was used.

What do FINRA's rules and guidance imply?

For US broker-dealers, FINRA Rule 2210 requires an appropriately qualified registered principal to approve each retail communication before the earlier of its use or filing with FINRA. Records must include a copy of the communication, its dates of first and last use, and the name of the approving principal and the date of approval. That record is exactly what you need to answer "Was this page approved, and in this form?"

Other guidance is useful by analogy:

• Generative AI. FINRA's Regulatory Notice 24-09 reminded firms that its rules and the securities laws apply to their use of generative AI, as to any other technology.
• Third-party content. FINRA's guidance on social media and websites says a firm becomes responsible for third-party content if it adopts it, for example by endorsing it, or becomes entangled with it, for example by paying for or helping to prepare it. FINRA has not said how this applies to answers from public AI assistants. The practical point is that the pages those answers cite, if they are yours, are your communications.
• Proposed changes. In Regulatory Notice 26-14, FINRA proposed replacing the pre-use principal approval requirement with risk-based standards for supervising retail communications, citing changes in social media and generative AI. Comments were due by September 11, 2026. Until any change takes effect, the current rule applies.

Other sectors and countries have their own approval regimes, such as financial promotion rules in the UK and rules on prescription drug advertising. Map the check above onto whichever rules apply to you, and take advice on how your regulator views AI answers.

How do you stop unapproved pages reaching AI answers?

• Inventory every public URL, not just marketing pages. Crawl your own domains, subdomains and file stores regularly and compare the result with the approval register.
• Bring claim-making pages into review. Help centres, FAQs, blogs, careers pages and investor materials often describe products and fees.
• Retire pages properly. Remove or redirect expired content, rather than leaving it unlinked. Remove old PDFs from public folders.
• Lock down staging. Put test sites behind authentication, not just a robots rule.
• Monitor on a schedule. Run a fixed set of product and brand questions across the main assistants, capture cited URLs and match them automatically against the register. Flag any unknown URL for review. What to include in pre-launch checks is covered in which AI citation checks belong in a CMS launch sign-off.
• Keep records. Store the evidence, classification and action for each flagged citation with your other communications records.

What might an illustrative case look like?

Consider an illustrative asset manager whose monitoring flags a ChatGPT answer quoting an older, higher fee for one of its funds. The cited URL is a factsheet PDF in a public folder, uploaded three years ago and never in the CMS. The approval register shows the factsheet was approved for one quarter and then superseded. Server logs show OAI-SearchBot fetched the file last month. The compliance team removes the file, redirects its URL to the current factsheet page and records the incident. A crawl of the public folders then finds forty more superseded PDFs, which are removed the same way. Later runs cite the current factsheet.

What do people ask about AI citations and approved content?

Is an AI answer that cites our page our communication?

The answer is written by the assistant, not by you, and regulators have not settled how to treat it. The page it cites, if it is yours, is your communication and should be approved and current.

Should we block AI crawlers from unapproved pages?

Removing or correcting the pages is better. Blocking stops some systems but leaves the content live for people and for other crawlers.

How often should we check?

Monthly for your main question set is a reasonable baseline, plus a check after any product, fee or disclosure change.