Set the Rules for Publishing and Promoting Professional Expertise

4.1 Identify Applicable Obligations by Profession, Service, and Jurisdiction

Start with the practice included in the GEO program. Record the legal entity providing the service, the professionals whose qualifications will be promoted, the services offered, and the markets in which the firm intends to work. A multidisciplinary group may need different rules for its legal practice, accounting practice, and consulting subsidiary.

Ask the responsible professional or adviser to identify the applicable jurisdictions and authorities. The location of the firm, professional admissions or registrations, type of service, and intended audience can all be relevant. Do not assume that every rule applies merely because someone in a jurisdiction can view the website.

Separate four sources of obligation: laws and regulatory rules; professional and membership standards; contracts and other commitments; and the firm’s own policies. Record which source supports each requirement. A voluntary policy can be stricter than the legal minimum, but the team should know when that is the firm’s choice.

What differs across professions

Law firms. The American Bar Association’s Model Rules provide a framework used in developing jurisdictional rules. They are not a uniform rulebook governing every US lawyer. Check the rules adopted by the relevant authorities, including requirements affecting advertising, credentials, confidentiality, and recommendations. 

Accounting firms. AICPA membership carries an obligation to follow its Code of Professional Conduct. Identify the applicable professional code and licensing or regulatory requirements for the people and entities involved. Do not assume that a marketing practice used by a general business consultancy is appropriate for a regulated accounting service. 

Engineering consulting firms. The NSPE Code addresses truthful qualifications, accurate descriptions of responsibility for earlier assignments, confidentiality, and attribution. Treat it as a professional code and check the separate requirements of the relevant licensing authorities. 

Management consulting firms. IMC USA’s ethics code applies through membership and certification obligations; it is not a law governing all consultants. Its AI code, adopted in July 2026, also addresses professional responsibility, verification, and review of AI-assisted work. Membership commitments belong in the firm’s register alongside client contracts and applicable law. 

Create a short obligations register

For each relevant requirement, record its source, the people and material it covers, the practical publishing rule, the responsible reviewer, and the date checked. “Review required” is incomplete. Write the decision the reviewer must make: for example, whether a proposed credential description is permitted and correctly attributed.

Keep the register specific to the program’s scope. Resolve recurring questions once and convert the answers into reusable instructions. Escalate unresolved issues before the affected publication or upload; routine updates within established rules should not require a new legal opinion.

Revisit the affected entries when the firm enters a new market, adds a regulated service, changes professional memberships, signs an unusual client restriction, or learns that a relevant rule has changed. Assign someone to notice these events. A register without an owner will quickly stop guiding decisions.

4.2 Classify Public, Internal, and Confidential Information for Publication and Use in AI Tools

Classify the source material before someone pastes it into an assistant, uploads it to a content platform, or gives it to a GEO agency. The classification applies to prompts, attachments, screenshots, meeting notes, and supporting evidence as well as finished copy.

Use three practical categories. These are handling defaults; a professional rule, contractual restriction, or specific permission can change the decision.

When the classification is uncertain, treat the material as restricted until its owner resolves the question. Separate an approved public summary from the confidential evidence supporting it. Permission to publish the summary does not authorize uploading the complete engagement file.

Public availability does not settle confidentiality or reuse

For lawyers, the commentary to ABA Model Rule 1.6 describes confidentiality as covering information relating to a representation regardless of its source. It also warns about indirect identification through a hypothetical. A fact appearing in a public docket, or a story with the client’s name removed, therefore does not automatically clear the marketing decision under that model framework. Check the applicable local rules. 

Law firm example. A draft describes an unnamed regional hospital negotiating a dispute around the time of a widely reported local incident. Removing the client’s name may leave the engagement recognizable. Check whether a client, competitor, or informed reader could identify it from the combination of location, timing, parties, and unusual facts. If the story cannot be cleared, explain the relevant service in general terms or use a clearly invented scenario.

Approve a specific tool configuration and use

“We allow ChatGPT” is too broad to guide handling of client information. Approval should identify the product, account or workspace, permitted use, and information categories. A personal subscription and an employer-managed workspace should not be treated as interchangeable without reviewing their actual controls.

As checked in October 2026, OpenAI describes no-training defaults for specified business and organizational ChatGPT workspaces, and Anthropic describes no-training defaults for its commercial products. Their documentation also addresses circumstances such as feedback that can permit additional data use. Turning off training does not establish that information is never retained, that nobody can access it, or that the firm has authority to disclose it. 

Keep a tool approval record covering:

• The product, workspace, account owner, permitted tasks and information categories, and approved features such as web search, connectors, and file uploads.
• Relevant training, retention, deletion, access, and sharing terms and settings.
• Connected applications, outside providers, and subcontractors that may receive the information.
• Rules for feedback, support requests, uploads, and other actions that can change how information is handled.
• The reviewer, approval date, restrictions, and events requiring reassessment.

ABA Formal Opinion 512 illustrates why tool review and professional judgment both matter. It discusses confidentiality risks, evaluating provider terms, and circumstances requiring informed consent. It does not make client consent a prerequisite for every use of generative AI. Where informed consent is required, generic boilerplate may be inadequate. 

Accounting example. A marketing manager may be authorized to use an approved public service description to draft an FAQ in an approved workspace. That permission does not extend automatically to uploading a client’s ledger and engagement correspondence to make the FAQ more realistic.

Apply the same review to monitoring suppliers. Ask which providers receive submitted prompts and attachments, and under what arrangements. Until a proposed data use is cleared, build tests from approved public facts or clearly hypothetical scenarios. A question about a named client can disclose sensitive information even without an attachment.

4.3 Set Standards for Advertising, Credentials, Comparisons, Endorsements, and Disclosure

Review both the individual facts and the impression created by the whole communication. A technically accurate sentence can mislead when its heading, omissions, imagery, or placement suggests something broader. ABA Model Rule 7.1 expressly addresses false or misleading communications, including material omissions; check the applicable rules for your profession and jurisdiction.

Adopt the following claim standards for the GEO program. They give reviewers concrete questions to answer and make approved material easier to reuse.

Describe capabilities and credentials precisely

State the service, intended client, relevant geography or jurisdiction, and material boundaries. Distinguish work performed by the firm from work delivered through a referral partner. Describe an individual professional’s qualification as belonging to that person unless there is a sound basis for applying it to the firm.

Verify the credential’s exact name, issuing body, holder, current status, and any relevant limits. A designation in a biography should not silently become a claim that every team member holds it. For lawyers, ABA Model Rule 7.2 sets conditions for statements that a lawyer is certified as a specialist. Local requirements may differ; have the relevant reviewer approve the wording and any badge. 

Consulting example. A new partner previously led procurement engagements at another firm. The biography can describe that person’s role, subject to confidentiality and rights checks. A company case study should not present those engagements as projects delivered by the partner’s current firm. Identify the employer and contribution accurately where disclosure is permitted.

Support results without expanding what they prove

For a result, retain the source, definition of the measure, baseline, period, scope, and calculation. Distinguish observed outcomes from forecasts, estimates, and targets. Explain material client contributions or other circumstances needed to understand the result. A change that occurred during an engagement does not, by itself, establish that the firm caused the entire change.

Accounting example. Suppose approved records show that a client’s monthly management-reporting close fell from 12 to seven working days over four months. A defensible case description would identify the process measured, the period, the work performed, and the client’s role. “We cut finance costs by 42%” would substitute a different metric. “We will close your books in seven days” would turn one outcome into a promise.

A testimonial does not replace evidence for an objective performance claim. Review the claim even if the client enthusiastically approves the wording. Keep material qualifications beside the result so a reader can understand it without finding a separate disclaimer.

Make comparisons and endorsements intelligible

For a comparison, identify the feature or outcome compared, the providers or market covered, the evidence, and its date. “Lower cost” needs a defined service and a supportable comparison. A purchased directory package does not support a claim that the publisher independently selected the firm as the best provider.

Use quotations faithfully and obtain the required permissions. Do not edit a qualified observation into an unqualified recommendation. Establish whether the speaker is a client, employee, referral partner, investor, or paid participant, and whether that relationship needs to be disclosed.

The FTC’s Endorsement Guides explain its approach to honest endorsements and disclosure of material connections that an audience would not expect. These are interpretive guides, rather than a separate universal endorsement law. As a firm standard, make sponsorship and relevant affiliations clear where the endorsement appears; review the requirements governing the particular communication. 

Keep responsibility with the firm

An AI-assisted draft needs the same factual and professional review as other copy. Require a person to verify its sources, claims, quotations, and credentials before release. Whether AI assistance must be disclosed depends on applicable obligations and the use. Establish a policy for material uses; do not invent a universal requirement to label every grammar correction.

Maintain an approved-claims record: exact wording, supporting evidence, required context, permitted uses, owner, and review triggers. Reuse a current statement within those boundaries. Reopen review when an adaptation changes the meaning, drops a qualification, or extends the claim to another service, professional, or jurisdiction.

4.4 Document Permissions and Rights to Use Client Names, Work Products, Quotations, and Results

Treat permission as specific to the material and proposed use. Approval to identify a client does not necessarily cover its logo, a quotation from its CFO, the results of an engagement, or a photograph of its site. Permission to share a reference privately may not cover public advertising.

Check confidentiality obligations and the rights in each component. The client may not own a photographer’s image, a research publisher’s chart, or another consultant’s methodology. Identify ownership, a suitable license, permission, or another applicable legal basis. The US Copyright Office explains that fair use is context-dependent; there is no fixed word count or percentage that automatically makes a use permissible. 

As an operating standard, retain a written record of permission and its scope. This does not mean every mention legally requires a new signed release. Existing contracts or licenses may already authorize the use. Record the basis so the next employee or supplier can establish what is allowed.

Use a seven-part permissions checklist

• Material and version. Identify the exact name, logo, quotation, image, result, document extract, or approved draft covered.
• Authority. Record who authorized the use and why that person can do so. A helpful project contact may not control publicity or intellectual property rights.
• Other obligations and rights. Check engagement terms, confidentiality, personal information, third-party ownership, and relevant professional restrictions.
• Permitted uses. Specify channels, audience, attribution, adaptations, and reuse. Cover outside agencies and directory submissions where relevant.
• Final context. Obtain any required approval of the actual wording and presentation, including qualifications. A positive quotation beside an unsupported claim can create a different message.
• Duration and change. Record any end date, review condition, withdrawal arrangement, or event requiring renewed permission.
• Evidence and owner. Keep the approval, supporting agreement, approved version, and responsible person’s details in a controlled location.

Engineering example. A consultant assessed foundations on a development whose architecture and structural design were produced by other firms. Permission to name the development does not establish rights to the architect’s photographs or justify claiming responsibility for the whole design. The publication should describe the consultant’s actual contribution and clear the rights to each illustration separately.

Explain the intended distribution when requesting permission. A public case study may be indexed, quoted, linked to, or summarized elsewhere. Promise only the withdrawal actions the firm can control. Removing its own page does not guarantee that every independent copy or reference will disappear.

When permission is limited, preserve that limit in the content record. If a client approves a website case study but excludes paid promotion, a supplier should be able to see that restriction before reusing it. If permission expires, identify the publications the firm controls and the parties to contact.

When permission is absent, use another source of useful information: an explanation of the method, a public reference you may lawfully discuss, or a clearly hypothetical example. Do not disguise an identifiable client story as a generic scenario. Keep confidential source evidence restricted even when a separately approved public account can be published.

4.5 Assign Professional Review and Approval Responsibilities to Employees and Suppliers

Make reviews proportionate to what is changing. A corrected office telephone number and a new claim about litigation outcomes require different decisions. Give routine work a clear approval path and reserve specialist review for questions that need it.

Use the following matrix as a starting point. Name the people filling these roles and their substitutes. In a small firm, one person may hold several roles; the checks still need to be made.

The content owner should submit a complete review packet: the exact draft, supporting evidence, permissions, proposed channels, and unresolved questions. The reviewer should return an explicit outcome—approved, changes required, or held pending a named issue. Silence does not count as approval.

The publishing owner releases the approved version and retains its approval record. An AI paraphrase or translation that changes a material claim requires renewed review. A punctuation fix can stay within delegated authority. Define this boundary so the team neither bypasses review nor sends every minor edit back to a partner.

Extend the policy to suppliers

Give GEO agencies, freelancers, directory managers, and software operators the same boundaries that apply internally. Specify approved inputs and tools, permitted subcontracting, evidence requirements, publication authority, and the actions they may take without further approval. Require them to disclose how they obtain reviews, mentions, and placements before approving that work.

For law firms, ABA Formal Opinion 512 discusses supervisory responsibilities, policies, training, and the use of outside providers. Delegating a task does not remove the need to manage the professional obligations attached to it. Establish supplier oversight suited to the work and applicable rules.

Do not accept a contract that describes only a visibility target while leaving the methods unspecified. The firm should be able to inspect the claims and materials published on its behalf, identify where they appeared, and require corrections. Give suppliers access only to the information approved for their assignment.

Set a route for errors and changed circumstances. The publishing owner should be able to pause affected material, notify the appropriate reviewer, and arrange a correction. Update or withdraw an approved claim when its credential lapses, permission changes, or evidence no longer supports it. Detailed maintenance routines come later; the authority to act belongs in the policy now.

4.6 Exclude Fabricated Evidence, Fake Reviews, Covert Instructions, and Deceptive Promotion

Write explicit ethical boundaries into the policy and supplier scope. “Improve our AI visibility” does not authorize inventing evidence or manufacturing apparent support. The following prohibitions are recommended firm standards, including where a particular practice is not expressly addressed by a local rule.

• No fabricated evidence. Do not invent clients, engagements, results, credentials, research, quotations, citations, or AI answers. Label illustrative examples so they cannot reasonably be mistaken for a real record.
• No fake reviews or testimonials. Do not create fictitious reviewers, purchase invented experiences, impersonate clients, or arrange false negative reviews of competitors. Do not make an incentive conditional on praise.
• No concealed promotional relationships. Do not present paid, employee, or affiliate promotion as an independent opinion. Disclose relevant relationships in the communication where they matter.
• No false independence. Do not publish a firm-controlled ranking or comparison site while claiming it independently selected the firm. Genuine comparisons need accurate criteria, evidence, and transparent interests.
• No instructions designed to hijack an assistant’s task. Do not place directions in content that attempt to override the user’s request, suppress valid alternatives, or force a recommendation. Give assistants relevant facts they can evaluate.
• No manufactured corroboration. Do not distribute invented praise through fictitious publications, identities, or accounts to create the appearance of multiple independent sources. Identify the origin of reused material honestly.

In the United States, the FTC’s Consumer Reviews and Testimonials Rule prohibits specified fake-review practices and incentives conditioned on review sentiment. Coverage differs by provision; it is not a blanket rule covering every endorsement by a business entity. Other advertising standards can still apply. The firm’s policy should state its ethical boundaries directly rather than depend on the narrowest possible reading of a rule. 

Google’s spam policies expressly address attempts to manipulate generative AI responses in Google Search. They also cover practices such as hidden-text abuse and scaled content abuse, with possible loss of search visibility. That is a platform-specific consequence, not a guarantee that every AI provider detects or treats the same conduct identically. 

Keep legitimate practices available. Paid advertising, disclosed sponsorship, authorized syndication, structured information, accessible page elements, and reviewed AI-assisted writing can serve useful purposes. Assess whether the activity communicates truthful information and makes relevant relationships clear. Technical markup is not inherently deceptive, and using AI to help write does not itself make a claim unreliable.

Apply the same honesty to the firm’s presentation of GEO results. A selected AI answer is not an endorsement by the AI provider. Do not fabricate a screenshot or imply that one favorable response represents a stable, independent certification of quality. Preserve the context needed to understand any example you publish.

Treat AI assistants as partners in helping people assess suitability. Publish evidence that supports an informed decision, including limits on the firm’s services. An assistant should be able to describe the firm accurately, identify uncertainty, recommend a better fit when appropriate, or conclude that more information is needed.

Practical Output: A Publishing Policy the Team Can Use

Produce a short policy with the obligations register, approved-tool record, claims record, approval matrix, and permissions checklist attached or linked. A small firm can keep these in one controlled index, with restricted links to confidential supporting evidence. Use the following clauses as the policy’s starting structure:

1. Purpose and scope. We publish accurate, useful information about the specified services, professionals, and markets so people and AI assistants can assess our suitability.
2. Four checks. Publication and AI processing require the relevant disclosure, rights, accuracy, and tool-use decisions. Approval of one does not imply approval of the others.
3. Information handling. We classify inputs before use and permit only the information categories and tasks approved for the particular tool or supplier.
4. Claims and evidence. We retain support, attribution, required context, an owner, and review triggers for material claims.
5. Permissions. We document the basis and scope for using client information, names, quotations, results, and third-party material.
6. Authority. Named reviewers make the decisions in the approval matrix. Designated publishers release material within their delegated authority.
7. Ethical boundaries. Employees and suppliers follow the prohibitions in Section 4.6. Visibility targets do not override them.
8. Correction and review. A named owner can pause, correct, or withdraw affected material and reopen approval when evidence, permissions, services, credentials, tools, or obligations change.

Test the policy against three actual proposed tasks: updating a biography, publishing an experience example, and submitting a prompt from Chapter 3 to a monitoring tool. For each, identify the permitted inputs, supporting evidence, required decisions, and person authorized to proceed. Revise any instruction that leaves the operator guessing.

The policy is ready when routine work has a clear path and unresolved questions have a named decision-maker. Carry the approved prompt library and these handling rules into the baseline audit in Chapter 5.