AI visibility governance for regulated enterprises: who edits the AI profile, approvals and review

Until November 2026, a company had no official presence inside ChatGPT to govern. Business Hub, launched on November 10, 2026, changed that. A verified profile with a description, category, logo, policies and, for eligible US online businesses, a business agent is published content under your company’s name.

For a bank, insurer, medical device maker or industrial supplier, that raises familiar questions in a new place: who is allowed to say what, who approved it and can we prove it later. Our launch guide to ChatGPT Business Hub covers the claim itself; this article covers the controls around it.

For the wider content side, see our article on GEO for regulated industries.

OpenAI’s help page for businesses, read on November 12, 2026, sets out the facts a governance policy has to work with.

• Eligibility: the claimant must be the owner or an authorized representative, verify the connection and be approved by OpenAI.
• Verification: business phone, business email, a DNS TXT record on the website domain, or a Shopify login.
• Identity: Persona verification is required to publish changes, connect a product feed, view insights or create a business agent, and may require government ID, business registration information and proof of authority.
• Access: the admin who claimed can add teammates and grant an agency access; each person uses their own ChatGPT account.
• Changes: OpenAI reviews and publishes profile edits, which must follow the Businesses in ChatGPT policy, and ChatGPT may still use other sources when answering.
• Permanence: only unpublished drafts can be deleted; support cannot delete, unpublish or hide a published profile.
• Larger companies: each distinct brand is managed separately, there is no central management across a parent company’s brands yet, and managed claims go through an OpenAI account contact.

Our view is that the admin role should sit with a permanent employee on a company email address, never with an agency or a personal account. Agencies can be granted access; they should not own the claim.

1. Draft every profile field and agent answer from your approved claims register, not from scratch.
2. Route the draft to brand and legal or compliance, with the same service level you use for website copy.
3. Publish only from the admin account, after written approval, and record who approved what and when.
4. Keep a dated copy of the published profile and a weekly export of the 28-day insights, since the platform does not keep history.
5. Re-test a fixed set of buyer questions monthly and log any material error about products, pricing, regulation or safety, with the fix and the date.
6. Review access each quarter and remove teammates and agencies that no longer need it.

• Implied claims. A category or description can imply a licence, certification or indication you do not hold in every market. Write for the strictest market you sell in.
• Business agent answers. Agents answer from the information you provide; treat that information as approved advertising copy, with disclaimers where rules require them.
• Ownership disputes. A former employee, reseller or distributor may claim first. OpenAI offers a dispute ownership option that requires Persona verification, so prepare the documents now.
• Records. Regulators and auditors ask what was published and who approved it. Business Hub does not provide an audit trail, so keep your own.
• Multiple brands. With no central management across a parent company’s brands, each brand needs its own owner and approval path.

• Scope: which brands, business units and locations have profiles, and who owns each.
• Accounts: the company account used to claim, the named admin and the backup admin.
• Identity: whose identity is verified with Persona and how the documents are stored.
• Content rules: the approved claims register as the only source for profile fields and agent answers; prohibited claims by market.
• Approvals: who approves which fields, the expected turnaround, and how approval is recorded.
• Access: how teammates and agencies are added and removed, and the quarterly access review.
• Monitoring: the fixed question set, the weekly insights export and the monthly answer review.
• Incidents: what counts as a material error, who is told, and the correction steps, including the dispute ownership route.

Keep the policy next to your website and social media governance, so reviewers apply the same standards. The new part is short; the value is in naming people and dates.

Write a one-page AI profile policy before you claim: named owner, account, approvers, records and review dates. Then claim, verify and publish the first version through that process. Most of the policy reuses what your website governance already has; the work is in naming people and keeping records. Our article on AI governance for marketing teams covers the wider policy for AI tools.

Our generative engine optimization team can work with your legal and compliance reviewers on profile copy, claims registers and answer monitoring.

If you want a draft policy for your company, talk to our team and we will bring one to a free 30-minute pipeline plan.