Blog · Running the work

Brand safety when a model is doing the talking

Published 14 August 2026 · Updated 12 October 2026 · 9 min read

Brand safety when a model is doing the talking
Photograph: Ümit Yıldırım / unsplash

The short answer: Brand safety used to mean controlling what your message sat next to. When a model is doing the talking, it means controlling what is said about you in a sentence you did not write and cannot edit. We have found no published takedown route on the five engines in our audit set. The levers that remain are the evidence the model reads, how reachable and unambiguous that evidence is, and how fast you notice when a wrong claim starts repeating.

That is a different job from the one most brand teams are staffed for, and the failure modes are specific enough to be checked.

The confident wrong sentence is the whole problem

The failure that matters is not a refusal. It is a fluent answer with the wrong fact in it. The Tow Center for Digital Journalism, writing in Columbia Journalism Review on 6 March 2025, ran 1,600 queries across eight generative search tools, asking each to identify the source of a news excerpt that a plain Google search returned in its first three results. The tools answered incorrectly in more than 60 percent of cases. The spread was wide: one tool was wrong 37 percent of the time, another 94 percent. The study measured news attribution, not claims about brands, so read it as evidence that confident error is common rather than as a rate for your own category.

The number that matters for brand safety is a smaller one in the same study. Across 200 responses, one tool misidentified 134 articles, signalled a lack of confidence fifteen times and did not decline once. The behaviour was not uniform: the Tow Center reports that one other tool in the set declined more questions than it answered. A system that is wrong often and hedges rarely will state your refund policy, your pricing tier or your compliance status in the same flat register it uses for things it actually knows. Your buyer has no way to tell the two apart.

OpenAI's Model Spec, in the version dated 12 September 2025, carries sections titled "Express uncertainty" and "Assume an objective point of view", which tell the model to lean on reliable sources and flag what it is unsure about. That is one developer's published intent for its own models, and published intent is not observed behaviour. The gap between them is where your brand risk lives.

Where the wrong sentence comes from

Four sources. The order is how often they come up in our own audit work, not a counted frequency, and we have not measured it.

Your own stale page. A pricing page that nobody updated, a help article from two re-platforms ago, a careers page describing an office you closed. Retrieval does not know which of your pages you consider current. It knows which one answers the question.

Your own contradictions. Marketing says fourteen days, the help centre says thirty, the terms say seven. An assistant picks one and asserts it. You will usually find out from a support ticket, not a dashboard.

Entity collision. Two companies share a name, or your product name is also a common noun, and the model merges them. The resulting answer is internally coherent and describes a business that does not exist. This is the hardest failure to fix because nothing on your site is wrong; the model simply cannot tell you apart from the other one.

Third-party grounding. A three-year-old forum thread, a comparison page written by someone selling against you, a review site with your old feature set. If that page is more retrievable than yours, it becomes the evidence, and your site becomes a footnote.

Knowledge cutoffs make the first two worse than they look. A model answering without retrieval is working from a frozen snapshot of the web, so a fact you corrected in March can still be asserted months later. With retrieval on, the same prompt may pull the live page and answer correctly. Running a prompt once and declaring the problem solved is how teams miss this entirely. The same mechanism explains what a model update does to your visibility: the snapshot moves, and so does what the model believes about you.

The opt-out trap

Legal teams, understandably, want to block the crawlers. The instinct is reasonable and the execution is often wrong, because one developer's agents can do different jobs under one robots file. OpenAI documents that split in detail. Other developers document their agents differently, and we are not claiming the same split holds everywhere; check each one's own documentation before you write the rule.

OpenAI's crawler documentation separates its agents explicitly. GPTBot is the training crawler; disallowing it signals that your content should not be used to train foundation models. OAI-SearchBot is the one that surfaces pages in ChatGPT's search features, and the documentation is explicit that an opted-out site is excluded from the answers ChatGPT's search produces, while remaining available as a navigational link. ChatGPT-User fires when a person asks the assistant to fetch a page, and the same documentation says it is not used for crawling the web in an automatic fashion and is not used to decide whether content may appear in search. Treat it as a separate decision from the other two.

Block the search agent and you do not leave the conversation. You leave your side of it. The model still has training-era claims about you and still has every third-party page that mentions you. What it no longer has is your current, correct page. The practical result of an over-broad robots.txt is an answer assembled from sources you do not control.

Google's AI features documentation has a parallel trap. It points site owners to nosnippet, data-nosnippet, max-snippet and noindex as the way to limit the information shown from their pages in Search, and its troubleshooting section is written for sites whose content still appears in AI features after those controls are set. Read together, that is a strong signal that a site-wide nosnippet applied to protect copy also narrows what AI Overviews and AI Mode can show from the brand. The same page states there is no special structured data needed to appear in those features, which is worth knowing before anyone sells you a schema rescue package.

A check you can run this week

Most monitoring watches whether you are mentioned. Brand safety needs the opposite posture: deliberately ask the hostile questions and read what comes back.

  1. Write twelve adversarial prompts. Not "best tools for X". Write "is [brand] a scam",

    2. "[brand] lawsuit", "why did [brand] raise prices", "[brand] data breach", "[brand] vs [category term] complaints", "can I get a refund from [brand]". Include two that presume something false and see whether the model corrects the premise or plays along.

  2. Run each three times, on at least two engines, retrieval on and off. Answers vary

    3. between runs. One run is an anecdote.

  3. Log three fields per run: the claim made, whether it is true, and the URL the model

    4. leaned on. The third field is the actionable one. A wrong claim with no source is a training artefact. A wrong claim with a source is a page you can fix or outrank.

  4. Diff your robots.txt against your intent. List every AI agent you disallow and name

    5. the person who decided it. Most teams find at least one rule nobody remembers adding.

  5. Build a claim ledger. Ten facts about your company that must be right: price, refund

    6. window, certifications, headcount band, founding year, what you do not do. Check each one against each engine in your prompt set, quarterly.

The self-check covers ten of these in a form you can run in an afternoon without tooling.

What to do when you find one

On the five engines in our audit set we have found no published correction route: no form, no ticket queue, no service level. If one exists and is simply unpublished, we cannot see it. What is left is to change the evidence and wait for the next crawl, which can take days and can take months.

In our audit work, the fix that has most often moved the answer is a page that states the correct fact plainly, in the words someone would use to ask about it, on a URL that clearly belongs to you. If the wrong claim is that you had a breach, a short dated security page answering the question directly beats a press release. If the wrong claim came from a third-party page, the page that gets cited is the one that is current and specific, not the one that is angriest.

Pace it properly. This is remediation work, and it belongs in the same queue as the rest of the first 90 days of AEO work rather than as a fire drill every time someone screenshots a bad answer. Who runs it is a resourcing question covered in in-house or agency for AEO. And if your category barely appears in assistant answers at all, read when answer engine optimisation is not worth doing yet before you fund a monitoring programme for a surface nobody is using.

In the European Union, regulation is moving in the direction of labelling rather than liability. Article 50 of the EU AI Act, which applies from 2 August 2026, requires that people are told they are interacting with an AI system and that synthetic audio, image, video or text is marked in a machine-readable format. Disclosure is not accuracy. Nothing in it obliges anyone to get your refund policy right.

Honest limits

We have no reliable half-life for a corrected fact. We have watched a fixed page change the answer within a couple of weeks and watched a stale claim stand for months, but we have not run that as a controlled measurement, so treat it as anecdote rather than a rate, and the same caveat applies to the ordering of the four sources above. The Tow Center figures are about news attribution on eight tools in early 2025, not about brand claims in your category, and the crawler behaviour described here is documented by one developer for its own agents. We also cannot price a wrong answer: Pew Research Center analysed the browsing of 900 US adults for March 2025, published 22 July 2025, and found that users who saw a Google AI summary clicked a traditional result on 8 percent of visits against 15 percent without one, which is Google only and US only, and fewer clicks means less of the behaviour analytics can see. The sample audit report shows how we attach evidence to each finding so that a claim about your brand can at least be argued with.

FAQ

Can I make an assistant stop saying something false about my brand? Not directly. We have found no published takedown or correction route on the engines we audit. You change the evidence the model retrieves, publish a clear correction on a page you own, and re-test over following weeks.

Should we block AI crawlers to protect the brand? Blocking the search agent removes your current pages from the answer without removing the conversation about you. Training and search crawlers are separate agents and deserve separate decisions.

How often should we run brand-safety prompts? Monthly for a short adversarial set, and immediately after a pricing change, a funding announcement, a security incident or a visible model update.

Does structured data stop the model getting facts wrong? It helps resolve who you are, which reduces entity collision. Google states that no special structured data is required for AI features, so treat schema as an identity aid rather than a correction mechanism.

Sources

Related reading

The first 90 days of AEO workIn-house or agency for AEOWhen answer engine optimisation is not worth doing yetWhat a model update does to your visibilityHow to buy an AEO audit without being sold a dashboardChoosing an AI visibility tool