What an AEO budget actually buys

The short answer: An AEO budget buys three separable things. It buys diagnosis, which is finding out what the engines can and cannot see today. It buys engineering hours to fix what diagnosis found, and most of those hours land on access and markup rather than on writing. And it buys the slow, unglamorous work of getting sources an engine already trusts to repeat your claim. Software licences are the fourth line, and they are usually the smallest one that gets argued about the most.
Budgets for this work get built backwards. Somebody prices a dashboard, adds a content retainer, and calls the sum a programme. Then nothing moves for two quarters, because the money went to watching rather than to changing.
The four lines, in the order they pay back
Write the budget as four lines and the argument gets easier.
Diagnosis. A fixed prompt set, run across several engines, with the evidence kept so a finding can be argued with rather than believed. Our own audit is 45 prompts across five engines, run with retrieval on and retrieval off, for $500, with the report as the single deliverable. You can do a thinner version yourself for the cost of an afternoon. Either way, this line should be small and it should come first, because everything after it is wasted if you are fixing the wrong layer.
Engineering. This is where the real money goes, and it surprises people, because the work does not look like marketing. A bot rule in a firewall. A page that renders in the browser and arrives empty. A redirect chain. An organisation schema block that names the company three different ways. Someone with commit access has to change those, and the queue they sit in belongs to a team that does not report to marketing. That queue is the actual constraint, which is the argument made in who owns AEO inside a company.
Corroboration. Getting third parties to say the true thing about you. Review profiles, directories, documentation on partner sites, the places an engine already reaches for. This line is the slowest and the least predictable, and we have not found software that does it for you.
Licences. Tracking software. Useful once the manual version gets expensive to repeat, and a waste before that.
Why the engineering line is bigger than you budgeted
Here is a mechanism most budgets miss. Access is not one switch. The systems that fetch your pages arrive under several different user agents with different rules attached, and a fix aimed at one of them does nothing for the others.
OpenAI publishes separate IP ranges for each of its agents. On 8 October 2026 we fetched those two files and counted the entries in each, and we re-fetched them on 12 October 2026 and got the same counts: the list for OAI-SearchBot, the crawler behind ChatGPT's search feature, held 39 prefixes. The list for ChatGPT-User, which fires when a person in ChatGPT asks it to go and look at something, held 234. That is six times as many prefixes, though prefix count is not the same as address space, and the ChatGPT-User file carried a creation time of the previous day, 7 October 2026, while the SearchBot file was dated 2 January 2026.
Two consequences fall out of that. The first is that any allowlist built by pasting IP ranges into a firewall once will rot, and it will rot fastest on exactly the agent that carries a human being with a question. The second is subtler: OpenAI's own documentation says robots.txt rules may not apply to ChatGPT-User, because the request is user-initiated rather than a crawl. So for that one agent, a robots.txt fix does not necessarily govern the fetch, and a WAF rule may. We have not tested whether other vendors treat user-initiated fetches the same way, and we do not claim they do.
Budget for someone to re-pull those published ranges on a schedule and diff them. Pulling and diffing the two files above took us minutes, not days, so this is a small standing cost rather than a project. On client sites where access turned out to be the binding problem, we have seen fixing it move more than content work did in the same period. We have not run that as a controlled comparison and have no figure to quote for it.
What the money looks like over 90 days
Rough shape, from the programmes we have run and watched since 2025. This is our own experience across a few dozen engagements, not a survey of the market, and we have not published the underlying figures.
Weeks one and two go to diagnosis and almost nothing else. Weeks three to eight are engineering, and if your figure for this period is less than half the total, the plan is probably optimistic about how fast a backlog moves. Weeks nine to twelve are the first re-run, the first honest comparison, and the start of corroboration work that will not finish inside the quarter.
The sequencing matters more than the totals, and the first 90 days of AEO work walks the same period in more detail. Spending on corroboration before access is fixed is the single most common way to burn a budget here. An engine that cannot fetch your page has nothing of yours to quote from it, whatever else now mentions you.
Buy or hire, and what each actually costs
The spreadsheet comparison is salary against retainer, and it is the wrong comparison. The real difference is what each arrangement buys you access to.
An in-house hire buys continuity and someone who knows which internal queue to join. It does not buy cross-site pattern knowledge, and it takes months to arrive. An outside team buys the pattern knowledge immediately and buys nothing at all in terms of commit access, which means every finding still has to be handed to your engineers. Most programmes that work use both, and the split is argued properly in in-house or agency for AEO.
One budgeting trap worth naming. If the work is filed under the existing search line and handed to the search team as an extra duty, it competes with their quarterly targets and loses. The naming argument in AEO vs GEO vs SEO: what the three terms actually mean is mostly noise, but the budget-line question underneath it is not: work without its own line gets done last.
What a budget cannot buy
It cannot buy a certain mention, and nobody can sell you one. In our own audit runs we routinely see two identical prompts, sent minutes apart to the same engine, come back with different sources cited. We cannot see inside the engines to say why, so we treat any report built on a single run as an anecdote with a chart on it.
It cannot buy speed on the corroboration line. You can commission the outreach; you cannot set the date a third party publishes.
It cannot buy a clean revenue number. In the client logs we have looked at, a large share of assistant-driven visits arrive with no referrer we can attribute, so the attribution you build will be directional at best. We cannot measure the visits that leave no log entry at all, and we do not know how many those are.
And it cannot buy out of the engineering queue. Money converts into visibility only at the rate your deploy process allows, which is the uncomfortable thing nobody puts in a proposal.
Honest limits
This post does not establish how a budget should be split, in rupees or dollars or percentages. The 90 day shape above is our own pattern across a few dozen engagements, not a benchmark, and we have not published the underlying figures. The IP range counts are a reading of two OpenAI files on 8 October 2026, re-checked on 12 October; they describe OpenAI's agents on that day and nothing about any other vendor, and they will have changed by the time you read this. We do not have a defensible figure for how long an access fix holds before an engine changes something underneath it, so we re-run rather than assume. And we cannot separate the effect of corroboration work from the effect of a model update landing in the same month, which means any clean attribution split across those two is modelling rather than measurement.
If you want to see what the diagnosis line produces before you spend on it, the sample audit report is laid out section by section, including the evidence format that makes a finding arguable.
FAQ
What is the smallest useful budget? The cost of the diagnosis plus a few days of engineering time. If you cannot fund any engineering, spend nothing on tracking yet, because you will only be watching a number you have no means to move.
How much should go to content? Less than most plans assume at the start. Content matters, and it matters after the pages can be fetched, parsed and attributed to a resolvable company. Rewriting pages an engine cannot reach is expensive theatre.
Do we need to buy a tracking tool on day one? No. A question list, a spreadsheet and the discipline to re-run the same prompts gets you through the first quarter. Buy software when repeating the manual run costs more than the licence.
Is a monthly retainer worth it after the fixes ship? It is worth it if something is genuinely changing: new pages, new claims, engines shifting behaviour. If the site is static and the market is quiet, pause it. Ours is month to month for that reason.
Sources
- OpenAI, bots and crawler user agents, including the published IP range files per agent: developers.openai.com/api/docs/bots
- OpenAI, OAI-SearchBot IP ranges (39 prefixes, file dated 2 January 2026, retrieved 8 October 2026, re-checked 12 October 2026): openai.com/searchbot.json
- OpenAI, ChatGPT-User IP ranges (234 prefixes, file dated 7 October 2026, retrieved 8 October 2026, re-checked 12 October 2026): openai.com/chatgpt-user.json
- Google Search Central, Google crawlers and user agents, including Google-Extended and GoogleOther: developers.google.com/search/docs/crawling-indexing/google-common-crawlers
- Google Search Central, AI features and your website: developers.google.com/search/docs/appearance/ai-features