Key takeaways
- Most AI RFP templates in circulation cover agentic automation or generic AI risk. None of the ones I found ask the questions that separate AI visibility platforms: how data is collected, which engines are covered, and whether the vendor can detect when AI engines change behavior.
- This template has 30 questions in six categories: data collection, coverage and metrics, citation and crawler analysis, action and execution, security and compliance, and commercial terms.
- The single most revealing question is whether the vendor collects from real AI interfaces or only from APIs. User-facing answers and citations can differ from API outputs.
- Ask for proof, not claims. Every question below includes a good answer and a red flag.
- Score vendors on a weighted sheet and run a short, structured pilot on your own prompts before signing.
Why AI visibility platforms need their own RFP
I read through several 2026 RFP templates while preparing this one. Kognitos published a good 30-question template for agentic automation vendors, with a heavy focus on audit trails, model version pinning, and EU AI Act documentation. Worqlo has a 40-question general enterprise AI vendor RFP. TrueFoundry covers AI platform infrastructure. All useful. None of them tell you how to evaluate a tool that measures how ChatGPT, Gemini, Perplexity, Claude, and Google AI Overviews talk about your brand.
That gap matters because AI visibility software is a measurement product sitting on top of volatile, non-deterministic systems. If the measurement is flawed, every decision downstream is flawed. The same brand can look dominant or invisible depending on how the vendor collects data, which prompts it runs, and how it handles the constant changes inside AI engines.
The governance sections of generic AI RFPs still apply to you, so I borrowed from them in the security and contract sections. But the first half of this template is specific to the category.
One warning from Rework's enterprise AI visibility review: in this market, "enterprise" often just means the price isn't published. Of the 12 platforms they checked, only two published an enterprise price that included SSO. Your RFP is how you force the details into writing.
How to run the process
A workable timeline is about eight weeks. Two for drafting and sending, two for vendor responses, two for demos and a pilot, two for references and contracting. Shorter cycles tend to miss contract and security issues. Longer ones usually mean the buying committee has lost focus.
Who should be in the room:
- Marketing or SEO owner, who defines the prompts and success metrics
- Security and procurement, who own the compliance sections
- Analytics or data lead, who will check the exports and API
- Legal, if you operate in the EU or regulated sectors
Send the same questionnaire to every vendor, in writing, and ask for answers in a fixed format. Pick three to five vendors from a longer list. If you need a starting list, the GEO software directory at bestgeosoftware.com is a reasonable place to scan the category.
Category 1: data collection (questions 1-6)
This is the section most buyers skip and the one that matters most. Promptwatch's own data is collected from the real interfaces of ChatGPT, Gemini, Perplexity, Claude, and AI Overviews, and the company says user-facing answers and citations can differ from API outputs. Whatever you think of any vendor's claims, ask about it directly.
1. Do you collect responses from the real user interfaces of AI engines, from APIs, or both? Which engines use which method? Good answer: a per-engine table. Red flag: "we use the latest models," with no method stated.
2. How often do prompts run, and can we change the frequency for launches or campaigns? Good answer: daily by default, with faster options for specific monitors. Red flag: weekly snapshots sold as tracking.
3. How many responses do you sample per prompt, and how do you handle variance between runs? AI answers are non-deterministic. A vendor running each prompt once will give you noise. Good answer: repeated sampling and a stated aggregation method.
4. Which countries, languages, and cities can we monitor, and can location be fixed per monitor? Good answer: country and language per monitor, with city or coordinate targeting if you have local needs. Red flag: US English only.
5. Can we define personas and prompt types (branded, competitor, organic)? Good answer: yes, with reporting split by persona. Red flag: a fixed prompt library you can't edit.
6. How large is your underlying dataset, and how do you use it to suggest prompts and benchmarks? Good answer: a stated dataset size with a refresh cadence, plus prompt volume or difficulty estimates. Red flag: prompt suggestions with no volume data behind them.
Category 2: coverage and metrics (questions 7-12)
7. Which AI engines are covered today, and which are on the roadmap? Look for ChatGPT, Google AI Overviews, Google AI Mode, Gemini, Perplexity, Copilot, Claude, and Meta AI at minimum. If coding agents or shopping surfaces matter to your business, ask about them by name.
8. How do you define each metric (visibility, share of voice, position, sentiment), and can we see the formulas? Good answer: documented definitions. Red flag: a single proprietary "AI score" with no breakdown. Promptwatch's Academy is an example of what published definitions look like.
9. How do you normalize across engines that behave very differently? Promptwatch Data's average sources per response report shows why this matters. ChatGPT cites about 5 sources per web-search answer, Google AI Overviews about 10, and Perplexity almost exactly 10 every day. Copilot swung from under 2 to nearly 17 within a few weeks. A vendor that blends these into one number without segmenting is hiding the differences.
10. How do you detect and annotate engine changes that move our numbers? Engines change behavior abruptly. Promptwatch's data shows ChatGPT began using the site: operator at scale on August 8, 2026, rising from about 0.4% to about 17% of fanout queries (report). It also shows reddit.com's share of ChatGPT citations falling from about 4% to 0.5% on August 14, 2026 (report). A good vendor flags events like these so you don't blame your content team for a platform shift. Red flag: no annotations, no changelog.
11. Do you capture query fan-outs, the searches the engine runs behind a response? Promptwatch's fanout data shows average fanouts per ChatGPT response falling from 2.15 in early December to about 1.84 by early March. Fan-outs tell you what the engine actually searched for, which is how you find content gaps. Good answer: fan-outs captured per model and compared over time.
12. Can you track sentiment and the specific claims AI makes about us? Good answer: claim-level extraction with themes like pricing and support, plus competitor comparison. Red flag: a single positive/negative label.
Category 3: citation and crawler analysis (questions 13-18)
13. Do you report which of our pages are cited, and where they land in the source list? Citation rank matters. Being the first source is different from being the ninth.
14. Do you classify citations by source type and content type? This tells you whether engines favor your docs, product pages, listicles, or third-party reviews. Promptwatch Data's content type report found product pages were 22.4% of ChatGPT citations in the week of Sep 28 to Oct 4, 2026.
15. Do you track Reddit, YouTube, LinkedIn, and other social sources separately? Social matters differently per engine. In that same October week, ChatGPT drew 0.46% of citations from social platforms while Google AI Overviews drew 12.2% (report). A vendor that treats all engines the same here will mislead you.
16. Do you provide AI crawler logs, and are the requests IP-verified? Promptwatch's AI crawler traffic report counts only requests whose IPs match each operator's published ranges, so spoofed user agents are excluded. It showed OpenAI at 79.8% of verified requests in the week of Aug 31 to Sep 6, 2026, down from 94.8% in mid-June. Good answer: IP verification, a split between training bots and answer-time bots, and ingestion from your CDN (Cloudflare, Vercel, Fastly, raw logs). Red flag: user-agent matching only.
17. Can you link AI visibility to traffic and conversions on our site? Good answer: a script, tag manager template, or plugin that identifies AI-referred visits, and a documented approach to referrer loss. Red flag: "correlation with branded search."
18. Can you show third-party pages that mention us without linking? Offsite mentions often shape what engines say about you. Good answer: a ranked opportunity list.
Category 4: action and execution (questions 19-22)
This is where the category splits. Some tools report a score and stop. Others close the loop.
19. What happens after you find a gap? Do you produce content, tasks, or only a dashboard? Good answer: a prioritized action list and content workflows tied to tracked prompts. Red flag: "our reports tell you what to do."
20. Can content be published to our CMS, and with what review controls? Look for WordPress, Webflow, or Framer integrations, draft versus live publishing, and an approval inbox. Red flag: copy-paste from a document.
21. How do you verify that a published page was crawled, cited, and drove traffic? Good answer: page-level tracking from publish to crawl to citation to visit. This is the difference between an optimization platform and a monitor.
22. Do you have an API and MCP server, and what are the rate limits? Ask for documented limits per hour and which endpoints are read versus write.
Category 5: security and compliance (questions 23-26)
These are adapted from the generic AI governance templates. The EU AI Act dates cited in the Kognitos piece (Article 11 from August 2, 2026) come from that vendor's article and I haven't independently verified them, so have legal confirm what applies to you.
23. Which certifications do you hold, and can we see the report? Ask for ISO/IEC 27001 or SOC 2 Type II documentation. Not a badge on a webpage. The actual report under NDA.
24. Where is data stored and processed, and who are your sub-processors? Good answer: named regions and a sub-processor list. Worqlo's point about data being routed to third-party LLM APIs applies here too. Ask whether your prompts or site content get sent to any model provider.
25. What access controls do you offer: SSO, roles, project-level permissions, scoped API keys, audit logs? Per Rework, SSO is often the thing that gets gated behind enterprise pricing. Ask exactly which plan includes it.
26. How do you handle AI-generated content governance? If the vendor writes content, ask about brand books, fact sources, review steps, and whether edits are revertible. This is the AI visibility version of the audit trail questions in Kognitos's template.
Category 6: commercial terms (questions 27-30)
27. What exactly is included at each tier, and what triggers overages? Get prompts, responses, projects, seats, crawler log volume, visitor events, and API limits in writing. Cost per response is a more honest comparison than headline price.
28. What are the contract terms, renewal rules, and exit provisions? Ask about data export on termination, notice periods, and price protection at renewal. Rework flagged vendor stability as a procurement concern. Ask about funding, customer count, and what happens to your data if the company is acquired.
29. What SLAs apply to data freshness, uptime, and support? Good answer: stated numbers. Red flag: "best effort."
30. Can we run a time-boxed pilot on our own prompts, and who owns the data we generate? Good answer: a trial or paid pilot with our prompts, full export rights, and no lock-in on historical data.
Scoring sheet
Weight each category by what you care about. A typical split for an enterprise marketing team:
| Category | Suggested weight | Must-pass questions |
|---|---|---|
| Data collection | 25% | 1, 3 |
| Coverage and metrics | 20% | 7, 8, 10 |
| Citation and crawler analysis | 20% | 13, 16 |
| Action and execution | 15% | 19, 21 |
| Security and compliance | 15% | 23, 25 |
| Commercial terms | 5% | 28, 30 |
Score each answer 0 to 3 (no answer, claim only, documented, demonstrated live). Anything scored 0 on a must-pass question is a disqualifier, whatever the total.
How the vendor types differ
The market splits into a few groups, and your RFP answers will sort them quickly.
| Vendor type | Typical strength | Typical gap | Examples from our catalog |
|---|---|---|---|
| End-to-end AI visibility platforms | Monitoring plus content, crawler logs, and traffic attribution | Broader product means a longer evaluation | Promptwatch, Profound |
| Monitoring-focused trackers | Fast setup, lower price | Little execution, limited crawler or traffic data | Otterly.AI, Peec AI, AthenaHQ |
| Enterprise SEO suites with AI modules | Fits an existing contract | Fixed prompt sets, shallower AI data | Semrush, Conductor, BrightEdge |
| Brand and enterprise suites | Strong procurement paperwork | Often demo-gated pricing | Brandlight, Bluefish, Adobe LLM Optimizer |
Tools worth putting on a longlist, depending on your needs:
Promptwatch is the one I would put first for teams that want the whole loop. It monitors real AI interfaces, traces citations and IP-verified crawler logs, writes and publishes content to WordPress, Webflow, or Framer, and then measures traffic and conversions. It is ISO/IEC 27001 certified and GDPR compliant, and publishes its plan limits at promptwatch.com/pricing, which makes questions 27 and 23 easier to score. It is also the platform 1001 SEO Media's team uses. Run it through this RFP like everyone else.
Profound is the main enterprise alternative with deep monitoring and a sales-led process.
Scrunch is worth a look if agent-ready pages for your own site matter to you.
For teams already inside an SEO suite, Conductor and BrightEdge add AI search insights to an existing contract.
Brandlight positions itself as an enterprise AI visibility operating system.
For a wider scan, the directory of AI rank tracking tools at ai-rank-tools.com lists many more.
Running the pilot
Responses on paper only get you so far. A two-week pilot with each finalist tells you what the paper doesn't.
- Give every vendor the same 30 to 50 prompts, including branded, competitor, and category questions.
- Ask each to run them across the same engines and countries.
- Compare their outputs against a manual check of the real ChatGPT and AI Overviews interface for 10 prompts. Gaps between vendor output and what you see by hand are the best signal of data quality.
- Test the crawler setup on a real CDN. Time how long it takes and note what breaks.
- Ask each vendor to explain one unexpected movement in your data. A vendor that can tie it to an engine change is worth more than one that shrugs.
- Export data through the API and confirm it matches the dashboard.
If you want a free first look before the RFP, a no-login scan like Promptwatch's free AI visibility report shows how ChatGPT, Gemini, and Perplexity currently describe your brand, which helps you write sharper prompts for the pilot.
Reference checks
Two calls per finalist. Ask what specific problem the platform solved, how long it took from contract to first useful report, what surprised them, and whether they would buy again. Avoid vague questions like "how is the data." Ask "what changed in your content plan because of it." References are pre-screened to be positive, but concrete operational questions still reveal a lot.
Common mistakes
- Treating prompt count as the main price driver and ignoring responses, crawler volume, and seats.
- Accepting "real-time" without asking what the collection method and frequency are.
- Skipping the crawler question, then discovering six months later that you can't tell an access problem from a content problem.
- Letting a vendor's demo account substitute for your prompts.
- Buying a dashboard when you needed execution, or buying execution when your team only needs monitoring. Decide which you need first.
Final checklist
Before you send the RFP, confirm you have defined your engines and markets, your must-pass questions, your pilot prompts, and who signs off on security. Then send all 30 questions unchanged to every vendor and score only what they can show you. The vendors who answer questions 1, 10, and 16 with specifics are usually the ones whose product holds up in production.
If you'd rather have specialists run the evaluation and the follow-up work, 1001 SEO Media runs AI search and GEO programs for brands and can help scope the pilot.