Legal approved 12 claims for Brand A. Each had a source document and a review date. Then an AI assistant used one of those claims to describe Brand B. The wording was approved, the brand wasn’t. For regulated businesses managing multiple brands, this creates a difficult question: how do you control what AI says when it can pull claims from different sources and use them in contexts your team never approved?
This guide explores how marketing and compliance teams can manage that risk with a shared claims register, risk-based reviews, AI answer monitoring, and a clear process for correcting errors. It also includes a worksheet to help teams put these controls into practice.
Where your control ends and your monitoring begins
You can approve every page, release and asset you publish. You cannot approve an answer an assistant writes. That split drives the whole design: control the sources you own, and monitor the answers you do not.
Regulators have said little that is specific to AI answers about a company, so be careful about what you read into what they have said. In June 2024, FINRA's Regulatory Notice 24-09 reminded member firms that its existing rules, including the content standards for communications with the public, apply whether a person or a tool produces a communication, and it stated that it creates no new requirements (FINRA Regulatory Notice 24-09). That notice is about a firm's own use of generative AI. It does not say whether a third-party engine's answer about your firm is ever your communication. That is a question for counsel. This post treats the pages and assets you publish as yours, and the answers as something to watch.
On the product side, FDA issued a draft guidance in July 2024 for firms that choose to address misinformation about their approved or cleared products. It revises a 2014 draft on correcting independent third-party misinformation on the internet and social media, it is marked as non-binding, and it describes voluntary action (Addressing Misinformation About Medical Devices and Prescription Drugs: Questions and Answers). We do not summarize its conditions here. If you make drugs or devices, read it with your regulatory team before you decide how to respond to a wrong answer.
What independent studies say about AI answers and their sources
Two findings matter for a compliance reader. The first is that answers can say things their cited sources do not support. A Stanford-led evaluation of five models on medical questions, run on 1,200 generated questions in January 2024, found that between about 50 and 90 percent of responses were not fully supported by the sources they gave. The best performer, a model with web retrieval, had 69.4 percent of statements supported and 54.3 percent of responses fully supported (Wu et al., arXiv 2402.02008). The models were the 2024 versions, and a model checked support, validated against doctors' judgments. Read the figures as evidence that a citation next to a claim does not prove the claim, not as a current rate.
The second is that the page that gets credit may not be the page you approved. In a test by the Tow Center for Digital Journalism, eight AI search tools were wrong on more than 60 percent of 1,600 queries asking them to identify a news article from an excerpt, and the authors found tools often cited syndicated copies instead of originals (Columbia Journalism Review). That was news, not regulated products. For a multi-brand company the lesson transfers in one respect: check which URL an answer cites, because it may be a copy, a partner's page or a sister brand's.
Together these say that monitoring has to check what the answer claims, not only whether your brand appears or is cited.
Step one: a register of approved claims
Most governance problems in a multi-brand setting come from the same gap: the approval lives in an email thread or a document no one can search. The fix is a claim register that every brand draws from.
| Field | What goes in it |
|---|---|
| Claim ID and brand | A stable ID, and the one brand it is approved for |
| Claim type | Performance or outcome, safety or risk, pricing or fees, comparative, eligibility or coverage, general description |
| Approved wording | The exact sentence, with any required qualifiers attached |
| Do not say | The common over-statements of this claim, so reviewers and monitors know what to flag |
| Substantiation | The document or reference that supports it, with its date |
| Approver and date | Who approved it and when |
| Markets | Where it may be used |
| Review-by date | Set from the claim type; shorter for numbers and outcomes, longer for plain descriptions |
Two details earn their place. The do-not-say line turns a vague worry into something a monitor can check. The review-by date means a claim expires instead of living forever, which matters because an old figure on an old page is exactly what an assistant may repeat.
Step two: review tiers that match the risk
If every page needs full legal review, nothing ships. If nothing needs it, something eventually breaks a rule. A tiered approach is our judgment, not a standard, and your policy sets the details.
| Tier | Examples | Who reviews |
|---|---|---|
| 1. No claims | Glossary entries, process explanations, how-to content with no product statements | Content lead against a short checklist |
| 2. Approved claims only | Product descriptions that reuse register wording word for word | Brand compliance contact, checking the wording matches the register |
| 3. New or changed claims | Anything about performance, safety, pricing, eligibility, comparisons or testimonials not in the register | Legal, compliance or medical review as your industry requires, then added to the register |
The register is what makes tier 2 cheap. A writer who copies approved wording does not trigger a new review, and a reviewer can check a page against the register instead of rereading the substantiation file. The content teams post covers gates that fit alongside these tiers, including naming the source for each claim and showing who wrote a page and how.
Many brands, one standard
Figure 1. One register, many brands. The monitor feeds differences back to the register.
Share the things that should not vary: the register format, the review tiers, the way answers are collected and scored, and the escalation path. Keep local what should: the pages themselves, market-specific claims and each brand's voice. Our rule is that a claim approved for one brand is not approved for a sibling until it is reviewed for that brand, because the product, the population or the market may differ. Assistants can blend similar brands, so the register should record, for each claim, the one brand it belongs to.
Shared wording across brand sites raises a technical point. Google says that when pages are duplicate or very similar it chooses one as the canonical, and that a rel="canonical" element is one of several signals for stating your preference (Consolidate duplicate URLs). If two brands carry the same text, decide which page should stand as the source, and expect that a different one may be shown anyway.
Ownership across brands is a design question of its own. The AEO team post covers who holds measurement, content and technical access, and a regulated company adds one more named owner: the person who runs the register.
Monitor answers for claim drift
Choose prompts that a buyer or patient would ask about each brand, and keep them fixed and versioned. How to design prompts for AI visibility tracking covers the design. Save each answer in full with the date and engine, then compare the claims it makes with the register. Score each as one of four results.
| Result | Meaning |
|---|---|
| Matches approved wording | The answer states the claim as approved |
| Differs from approved | The answer states the claim with a changed number, qualifier or scope |
| Not approved claim | The answer makes a claim that is not in the register for this brand |
| Not stated | The prompt's answer does not touch the claim |
Set severity from the result and the claim type. In the worksheet, a not-approved claim is always high severity, and a differing claim takes the severity of its type: outcome, safety and comparative claims high, pricing and eligibility medium, plain description low. Those mappings are placeholders, so set yours from policy. Give each severity a number of days an issue may stay open, and track age.
Answers vary from run to run, so one clean check proves little (why citations change between runs). If a misstatement appears in 10 percent of answers, a check of 10 answers sees it at least once about 65 percent of the time, and it takes about 22 answers to reach 90 percent. If it appears in 5 percent, 22 answers give about 68 percent and about 45 are needed for 90 percent.
Figure 2. Chance of seeing a wrong claim at least once. Independent answers are assumed, which is a best case, so real numbers are higher.
How often to collect is a separate question, covered in how often to track AI search. For a compliance purpose, collect on a schedule that matches how fast your claims change and how serious a wrong answer would be, and re-run after any claim change.
When an answer is wrong
Start by finding where the claim came from. There are three cases, and each has a different owner.
If the claim traces to one of your own pages, fix the page, using register wording, and log the change. If it traces to a third-party page, ask the owner to correct it, giving them the approved wording and the source. The PR and comms post covers the fact sheet and the order for fixing pages. If it traces to nothing you can find, record the answer, mark it escalated and ask counsel what, if anything, to do. Do not publish anything outside your normal review to "seed" a correction, and do not make a public corrective statement about a product without your regulatory team.
Engines may offer feedback channels, but we did not verify a process that produces a correction, so do not promise one internally. After a fix, save new answers to the same prompts a few weeks later and compare. An answer that still repeats the old claim means the old page is still being read or the claim comes from somewhere else, and either is worth knowing.
What to report to compliance and leadership
A single "AI accuracy" score hides what a compliance reader needs. Report at claim level and brand level instead. For each brand, show the number of saved answers, the share with an issue and its range, the open high severity issues, the overdue issues, and the claims past their review-by date. Show denominators. A line such as "7 saved answers about Brand B, 5 with an issue (71 percent, range about 36 to 92 percent)" lets a reader see that the sample is small. The worksheet's example numbers are invented. Also report the register's health: claims expired, claims due soon, and answers that were tested against an expired claim. If the register is stale, the monitor is comparing against old wording and every result is suspect.
Set up the register and the monitor in a worksheet
The worksheet has a claims register, an answer monitor and a brand summary. Grey rows are invented examples with invented brands and claims, so replace them before you read any output.
- On the Settings tab, set the as-of date, the days before a review-by date that count as due soon, your brand list, each claim type's review interval and base severity, and the days an issue may stay open.
- On the Claims register tab, add each approved claim with its brand, type, approved wording, do-not-say line, substantiation reference, approver and approval date. The review-by date and status are calculated.
- On the Answer monitor tab, log each saved answer with the claim it tests and the result. Set the handling status. Severity, days open and overdue flags are calculated, and an answer tested against an expired claim is flagged.
- On the Brand summary tab, read each brand's issue share with its range, open high severity issues and overdue issues. Use the detection calculator to size your checks.
Frequently asked questions
Can we get an AI engine to remove or correct a claim?
We did not find a verified process that produces a correction, so do not promise one. What you control is the set of sources: fix your own pages, ask third-party owners to correct theirs, then save new answers and compare. Bring counsel in before any public statement.
Does FINRA Rule 2210 apply to AI answers about our firm?
FINRA's notice says its content standards apply to communications whether a person or a tool produces them, and it addresses a firm's own use of generative AI. It does not address third-party answers about a firm. Whether such an answer is ever treated as your communication is a question for counsel, not for this post.
Should regulated brands stay out of AEO?
Publishing accurate, approved information is an ordinary marketing activity, and answers can be wrong whether or not you publish. A governed program has two parts: approved sources and a monitor. Staying out removes the first and keeps the second problem.
How many brands before we need a central register?
When any two brands share a claim, an audience or a regulator, a shared register saves duplicate review. With one brand you can run a simple version. The register format in this post works at both scales.
Do we need to say when AI helped write a page?
Google says disclosure of how content was produced is worth considering where readers would reasonably wonder, and your industry's rules may require more. Check with counsel, and record in the register which claims were reviewed by a named person.
Pick ten claims and write the do-not-say line for each
Choose the ten claims that would hurt most if an assistant stated them wrongly. For each, write the approved wording, the common over-statement, the source and the review-by date. Then pick two prompts a buyer would ask about each brand, save today's answers and score them against the ten. You will see quickly which claims are stated as approved, which drift, and which brand is most exposed.
If you want a first reading on one of those prompts before you build the log, the AI Search Visibility Checker gives you one. If you want to follow the same questions about each brand over time, AI Search Intelligence tracks individual prompts, so the questions stay fixed while the pages and claims change.