How Can Regulated Companies Measure AI Visibility Without Making Promotional Claims?

What makes AI visibility measurement risky for regulated firms?

• Results reused as claims. "Top-rated by AI" or "ChatGPT's pick for retirees" in marketing is a claim you would have to substantiate, and in some sectors a ranking or testimonial that carries its own conditions.
• Sharing AI answers. Reposting or quoting a favourable answer can make it your communication.
• Content changes outside review. Pages rewritten to "win" AI answers are still regulated communications.
• Sensitive data in prompts. Testing with real client, account or patient details exposes that data to a third-party tool.
• Tests that stray into restricted topics. Asking about unapproved uses or guaranteed returns is fine as monitoring. Publishing content to answer them may not be.
• Vendor storage. Tracking tools keep prompts and answers, which may fall under your recordkeeping and data policies.

Which metrics suit regulated companies?

Whether a cited page is one you approved is covered in how a compliance officer can tell whether an AI citation comes from an unapproved page.

Use neutral language in internal reports: "named in 34% of answers" rather than "recommended by AI". Neutral wording keeps the numbers accurate. It also stops a stray slide becoming a marketing claim.

How can FINRA firms measure AI visibility without treating recommendations as endorsements?

Treat AI answers as third-party content you observe, and avoid anything that makes them yours.

• Do not adopt or become entangled with AI answers. FINRA's guidance on third-party content says a firm becomes responsible for it if the firm adopts it, for example by endorsing it, or becomes entangled with it, for example by paying for or helping to prepare it. Liking, sharing, quoting or screenshotting a favourable AI answer risks adoption. Paying anyone to shape answers risks entanglement.
• Treat any public use as a communication. If results ever appear in material shown to retail investors, FINRA Rule 2210 applies. That rule generally requires a registered principal to approve retail communications before use, while interactive social media posts are supervised like correspondence instead, and all communications must be fair and balanced. In Regulatory Notice 26-14, FINRA proposed replacing pre-use approval with risk-based supervision standards, but the current rule applies until any change takes effect.
• Watch the SEC Marketing Rule for advisers. For investment advisers, the rule defines a third-party rating as a rating or ranking provided by an unrelated person who provides such ratings in the ordinary course of business. Advertising one requires a reasonable basis to believe any underlying survey was not designed to produce a predetermined result, plus prominent disclosures. Testimonials and endorsements have their own conditions. Whether an AI answer counts as a rating is unsettled, which is one more reason not to advertise it.
• Send content changes through approval. New or rewritten pages meant to correct AI answers are communications like any other.
• Follow your recordkeeping and AI policies. FINRA's Regulatory Notice 24-09 reminded firms that its rules apply to their use of generative AI as to any other technology.
• Supervise the testing itself: who runs it, from which accounts, with which approved question set.

What about pharmaceutical, device and healthcare companies?

• Content changes go through medical, legal and regulatory review, as any promotional material would.
• Stay on-label. Monitoring questions about unapproved uses is legitimate, but content created in response must stay within approved indications. How device status gets misdescribed is covered in whether AI can distinguish FDA-cleared from FDA-approved devices.
• Keep patient information out of prompts. Use invented scenarios, never real patient details.
• Measure fair balance. Record whether answers about your product include important safety information or limitations, as well as benefits.

How do you set up the programme?

1. Write a short charter: the purpose is accuracy and risk monitoring, results are internal, and no results will be used in marketing without compliance approval.
2. Agree owners. Marketing runs the tests, and compliance reviews the question set, the metrics and the reporting format.
3. Approve the question set, including risk questions such as "Does [firm] guarantee returns?" or "Can [product] treat [off-label condition]?"
4. Use dedicated test accounts with personalisation off, and no client or patient data.
5. Decide storage and retention for prompts and answers, in line with your policies and your vendor's terms.
6. Report in neutral terms, marked internal.
7. Escalate risky answers. A wrong fee, an implied guarantee or an off-label claim goes to compliance, with sources, for a decision on correction.
8. Correct through normal channels: approved page updates, publisher correction requests and platform feedback.

What might an illustrative case look like?

Consider an illustrative broker-dealer whose marketing team wanted to post "ChatGPT names us a top broker for beginners" after a round of tests. Compliance stopped it. The post would have adopted third-party content, making it the firm's own communication subject to Rule 2210's content standards, and the claim could not be substantiated. Instead, the firm set up an internal programme tracking inclusion, accuracy and risk flags across 50 approved questions. It found that 30% of answers quoted an old account fee from a retired page. The fee page was corrected through the approval process and the old page redirected. Accuracy on fee questions rose to 90% two months later, a result the firm reported internally without any public claim.

What do people ask about regulated AI visibility measurement?

Can we mention AI assistants in our marketing at all?

Only with compliance approval, and never as an implied endorsement or rating. Most firms find no need to.

Do we need compliance approval just to run tests?

Many firms involve compliance from the start, particularly to approve the question set and reporting format. Approval of the charter is simpler than reviewing every test.

Are AI visibility dashboards business records?

Check with your compliance and records teams. Prompts, answers and reports stored by a vendor may fall within your recordkeeping policies.

Should we try to change what assistants say about competitors?

No. Correct facts about your own firm through approved channels. Content aimed at competitors raises fair-and-balanced and disparagement concerns that monitoring does not need to create.