AI Visibility Analysis: Outside Your Business and Inside It

AI visibility analysis means two different things, and most businesses need both. The first is external: how often your brand is mentioned or cited when people ask ChatGPT, Gemini or Perplexity a question in your category. The second is internal: how much you can actually see of the AI tools your own staff use, what they put into them and where the risks sit. This guide covers how to run each, which metrics matter, and which ethics and confidentiality checks Australian businesses should apply along the way.

CalibreforumSee How AI Is Used Across Your BusinessCalibre Forum’s AI readiness assessment surveys employees and delivers a scored report with a clear 90-day action plan.Explore the AI readiness assessment

TL;DR

External AI visibility is measured by running a fixed set of buyer questions across several AI platforms on a schedule, then recording mentions, citations, accuracy and competitors.
Treat the numbers as directional. AI answers vary by platform, location and time, so a single score hides more than it shows.
Internal AI visibility is a separate job: knowing which tools staff use, for what, and with which data. An anonymous staff survey is the fastest way to map it.
Before you analyse or adopt AI tools, review privacy, oversight, transparency, security and accuracy, and keep personal information out of public AI tools.
If you only have time for one, start inside: you cannot manage what AI is doing in your business until you can see it.

What AI visibility analysis measures
How to measure your visibility in AI answers
Metrics worth tracking, and how to read them
Turning findings into a better presence
The other half: visibility into AI use inside your business
Our view: see first, then decide
What a ready-to-act assessment looks like
An ethics review process for AI tools and analysis
AI confidentiality guidelines for Australian businesses
A sensible order of work
FAQ
Sources

What AI visibility analysis measures

External AI visibility analysis measures how often and how well a brand, its products or its content appear in AI-generated answers, as mentions and as citations. Traditional search visibility is about where you rank in a list of links. AI models synthesise information and give a direct answer, so the question changes from “what position am I in?” to “am I in the answer at all, and what does it say about me?”

That shift is why a good Google ranking does not guarantee you are named by an assistant. A mention is your name appearing in the text. A citation is your website appearing as a source. You can have one without the other, and each tells you something different.

The second meaning is closer to home for most owners and managers. Internal AI visibility asks: which AI tools are in use across my organisation, who uses them, for which tasks, and what information goes in? Many leaders cannot answer that today. We come back to it below, because the two meanings connect: you cannot credibly manage how AI describes your business if you do not know how AI is used inside it.

What AI visibility analysis measures — overview diagram

How to measure your visibility in AI answers

You do not need an expensive platform to start. A manual baseline is enough for a first read, and it teaches you what to ask of any tool you adopt later.

Build a prompt library

Write 20 to 40 questions a real buyer would ask, in their words. Include category questions (“who offers X in Melbourne?”), comparison questions and problem questions. Practitioners recommend a defined library of buyer-representative prompts run across platforms such as ChatGPT, Gemini and Perplexity on a consistent schedule. Keep branded prompts (those containing your name) separate from non-branded ones, since branded prompts flatter you.

Fix the method before you run it

AI systems are probabilistic, so the same prompt can return different answers. One Australian framework says each reported figure should identify the platform, exact prompt, test date and repetition count. Also control for geography: an answer for a user in Sydney may differ from one for a user in Perth. Save dated answer text or screenshots so you can compare later.

Choose a cadence

Monthly testing suits reporting. After a major website, content or schema change, test weekly for a while. A fixed scorecard of customer questions tested across ChatGPT, Perplexity, Gemini and Google, recording mentions, citations, prominence, accuracy, sentiment and competitors, gives you something you can repeat and compare.

Metrics worth tracking, and how to read them

Four or five measures cover most of what a small or mid-sized business needs. Analysts commonly point to presence rate, recommendation rate, share of model, characterisation and source attribution. In plain terms:

Metric	What it tells you	Simple calculation
Mention rate	How often your name appears	Answers mentioning you ÷ answers tested
Citation rate	How often your site is a source	Answers citing your site ÷ answers tested
Competitive citation share	Your slice of the sources	Your citations ÷ citations for you and tracked competitors
Characterisation	What the model says about you, and whether it is right	Manual read of each answer
Source attribution	Which pages the model relies on	List of cited domains per prompt

The first three formulas follow the definitions in one Australian measurement framework.

Read the numbers with caution

Three habits stop you drawing the wrong conclusions.

Break results down by platform. An average can hide the fact that you appear in one assistant and not another, as engine-level breakdowns make clear.
Know what your method captures. Prompt simulation shows what users may see; panel-based methods capture real user interactions. They are not the same thing.
Treat outputs as directional. The professional body for communications measurement, AMEC, says what users see in AI outputs is directional evidence rather than a definitive performance score, and should be triangulated with reputation (earned media, reviews) and content readiness (crawlability, structured content).

Finally, separate exposure from commercial impact. Being named is not the same as winning work. Connect the findings to AI referral traffic, branded search and enquiries before you decide a gap is worth fixing.

Turning findings into a better presence

Once you have a baseline, look for prompts where competitors appear and you do not, then look at which sources the model cites instead. Semrush’s documentation on its visibility reports describes Topic and Source Opportunities for exactly this, and suggests choosing an action by source type: engaging with user-generated content, using competitor content as inspiration, or approaching non-competing media.

An Australian guide published in October 2026 gives practical direction for local businesses: make your category, audience and market explicit, answer buyer questions with comparison and constraint context, publish original evidence, find the domains actually retrieved for your prompts, and remove crawlability and access barriers. Its caution is worth keeping: technical access is necessary but not enough. The system must also understand your business and find your evidence relevant to the question.

In practice that means a clear page for each service, stating where you operate and who you serve, with specifics a model can quote: prices where you publish them, process steps, credentials you genuinely hold. Vague copy gives an assistant nothing to repeat.

Turning findings into a better presence — overview diagram

The other half: visibility into AI use inside your business

There is a blind spot that no external tracker can fix. While you measure what AI says about you, your staff may be pasting client emails, quotes, contracts or patient notes into whichever tool is quickest. Leaders often find out only after an incident, or never.

Internal visibility answers practical questions:

Which AI tools are in use, including ones nobody approved?
Which tasks do they support: drafting, summarising, analysis, customer replies?
What kinds of information go in?
Which teams are confident, and which are guessing?
Where are the gaps in policy, access and training?

Employee surveys are the most direct way to get honest answers, but only if staff trust that the answers are safe. That is the design principle behind our own assessment, covered in the next section. If you want the wider picture first, our guide to finding shadow AI in a security assessment walks through what leaders typically uncover, and our piece on how AI data leakage happens explains the most common routes.

Our view: see first, then decide

We built Calibre Forum around one belief: most small and mid-sized Australian and New Zealand businesses are not short of AI tools, they are short of visibility. Policies get written in a vacuum, security reviews cover systems IT already knows about, and the real picture lives in how people work day to day.

So we start with the people doing the work. Every staff member is invited to answer a structured, anonymous survey. We do not install software and we do not collect individual data, which is exactly why answers tend to be candid. A manager who asks “who is using AI?” in a team meeting hears the safe answer. An anonymous survey hears the true one.

We would also say plainly what a survey cannot do. It does not replace legal advice, and we make no compliance or legal claims. It gives you an honest map and a sensible order of work. Outward-facing AI visibility is worth pursuing, but it comes second: there is little point optimising how AI describes your business while you cannot say how AI is being used inside it.

— Anthony

What a ready-to-act assessment looks like

Our AI readiness assessment combines the anonymous staff responses into one scored report. It shows existing capabilities, highlights strengths and risks, and sets out a tailored 90-day action plan with concrete operational and security recommendations.

Calibreforum

The one-off Report is A$1,990. If you want to track progress, the Membership is A$2,388 per year and repeats the survey and report every quarter, so you can see whether the 90-day plan changed anything. We also tailor the assessment for sectors with specific pressures, such as medical clinics, recruitment agencies and managed service providers. How we protect what staff tell us is set out on our security and privacy page.

An ethics review process for AI tools and analysis

Whether you adopt a tracking tool, roll out an assistant or run a staff survey, a short ethics review keeps you honest. Australia’s privacy regulator, the OAIC, says an AI review should look at privacy risks and personal-information handling, product suitability, human oversight, transparency, security and accuracy, and include a Privacy Impact Assessment.

A workable version for a small business:

Purpose. Write one sentence on what the tool or analysis is for and who benefits.
Data. List what goes in. If any of it is personal information, say so and decide whether it needs to.
Accountability. Name who is responsible at each stage. The government’s AI Ethics Principles call for people responsible for different phases of an AI system’s lifecycle to be identifiable and accountable, with human oversight enabled.
Transparency. Tell staff and customers how AI is used. The OAIC advises that privacy policies and collection notices should reflect your use of generative AI where relevant.
Accuracy check. Before any visibility report goes to a board or client, check for incomplete data and add the caveats it needs, such as how many runs each figure rests on.
Review date. Set when you will look again.

The same Department of Industry page says its Guidance for AI Adoption sets out six essential practices for safe and responsible AI governance, building on the earlier Voluntary AI Safety Standard and the eight AI Ethics Principles. It is the right place to check the current official framework.

If your review turns up gaps in how data is handled, our guides to AI data governance and AI access control cover the next steps.

AI confidentiality guidelines for Australian businesses

The core rule from the OAIC is simple. As best practice, avoid entering personal information, particularly sensitive information, into publicly available generative AI tools. Assess privacy risks and data access before you adopt a tool, and be transparent about AI use in your privacy policy.

Two further points catch people out:

AI can generate personal information. The OAIC says AI-generated personal information, including hallucinations or deepfakes about identifiable individuals, must be handled under the Australian Privacy Principles. If a visibility test shows a model saying something false about a named person, that is a privacy matter as well as a reputation one.
Where the tool runs matters. The OAIC notes that systems running on-premises or on private cloud may carry fewer privacy risks, because they may avoid disclosing personal information to another entity. “May” is the operative word, so check each tool.

If your business handles health, client financial or employment records, speak to a privacy lawyer or your professional body before you set a firm policy. For staff-facing rules that work in practice, see our pieces on AI data classification and what staff need to know about AI security awareness.

Keep your marketing claims accurate

If your visibility work leads you to publish new claims about your services, remember that existing consumer protection law applies to new technologies, and marketing claims that do not match the product or service may be misleading. Models repeat what you publish, so accuracy helps twice.

A sensible order of work

For a business of 10 to 200 people, this sequence avoids wasted effort:

Weeks 1 to 2: map internal AI use with an anonymous survey, and agree what data must never go into public tools.
Weeks 3 to 4: run your manual external baseline with 20 to 40 prompts across at least three platforms, saving dated answers.
Month 2: fix the gaps: inaccurate pages, missing service detail, blocked crawlers, unsupported claims.
Month 3 onward: re-test monthly, repeat the internal survey quarterly, and report both side by side.

This mirrors the idea of a 90-day plan: a short window, a clear owner for each action and a re-measure at the end.

FAQ

What is the difference between AI visibility and SEO?

SEO aims to rank pages in a list of links. AI visibility looks at whether an assistant mentions or cites you inside a synthesised answer. The two overlap, since crawlable, clear content helps both, but a high Google ranking does not guarantee a mention in an AI answer.

How often should I check my AI visibility?

Monthly is a reasonable rhythm for reporting, with weekly checks for a short period after major content or technical changes. Always record the platform, prompt, date and number of repeats, because answers vary between runs.

Is it safe to put customer information into ChatGPT or similar tools?

The OAIC recommends, as best practice, avoiding personal information, especially sensitive information, in publicly available generative AI tools. If you have a genuine need, assess the privacy risks first and seek advice from a privacy professional.

Do I need a formal AI ethics review?

A formal Privacy Impact Assessment is part of what the OAIC recommends when AI touches personal information. For smaller uses, a one-page review covering purpose, data, accountability, transparency and accuracy is a sound start.

How do I find out which AI tools my staff already use?

Ask them in a way that feels safe. An anonymous, organisation-wide survey reveals tools and workflows that interviews and IT logs miss, and it is the basis of our assessment.