Key takeaways
- Write the RFP for your own team first. Most of the damage in a bad GEO purchase comes from requirements you never wrote down, not from vendors who lied.
- Keep the question count under 80. Longer RFPs lose the strong vendors first, and you still have to score every answer.
- Fix your weights and your 1, 3 and 5 definitions before proposals arrive, then score alone before any group discussion.
- AI engines change behavior within weeks, so require vendors to show how fast they detect changes and never accept guarantees tied to one engine.
- Separate the three things people call "GEO vendor": a measurement platform, a content and execution service, and an agency. Your RFP should say which one you are buying, or whether you want a combination.
Why a GEO RFP is different from an SEO RFP
GEO (generative engine optimization, also called AEO or AI visibility work) is young enough that vendors define it differently. One sells a dashboard. Another sells articles. A third sells strategy decks and calls it all GEO. If you send a generic SEO RFP, you will get answers that look comparable and are not.
Three things make this category harder to buy than classic SEO:
- The data is unstable. Promptwatch's data showed reddit.com's share of ChatGPT citations falling from about 4% to 0.5% on August 14, 2026. On August 8, 2026, ChatGPT began using the site: operator at scale, jumping from about 0.4% to about 17% of fanout queries overnight. A tactic that worked in July can be dead by September.
- Engines behave differently. Promptwatch's sources-per-response report (published September 2025, so treat it as a baseline) found ChatGPT citing about 5 sources per web-search answer, while Google AI Overviews and Perplexity sit near 10. Copilot swung from under 2 to nearly 17 within a few weeks. A single blended "visibility score" hides all of this.
- Measurement is still contested. Traffic is a weak proxy, because many AI mentions never get clicked. Seer Interactive's GEO RFP guide makes the point that vendors who only report traffic are defending low numbers instead of explaining impact.
So the RFP has to test method, not just capability.
Step 1: Do the internal work before you write a question
Siteimprove's piece on redesign RFPs makes a point that applies here: the red flags that hurt most are not in vendor proposals, they are in what your own team never required. Writing requirements down is how internal disagreement surfaces. If you skip that, you defer the argument to the build phase, when it costs real money.
Before drafting, get answers to these from your stakeholders:
- Who owns AI visibility: SEO, brand, content, or a new team?
- What does success mean in 12 months? Share of voice in named engines, assisted pipeline, citations on specific pages, sentiment on key claims?
- Which markets, languages and engines matter? ChatGPT, Gemini, Perplexity, Copilot, Google AI Overviews and AI Mode are not equally relevant to every business.
- Who can deploy changes to the site, and how often?
- What data can a vendor touch? Your security team will ask this anyway.
- Is the budget for software, services, or both?
If the answers disagree, you are not ready to issue the RFP. That is useful to learn now.
Step 2: Decide what you are buying
GEO vendors fall into rough categories, and a good RFP names the one you want.
| Vendor type | What you get | Typical gap | Examples in our catalog |
|---|---|---|---|
| Monitoring platform | Prompt tracking, share of voice, sentiment, citations | You still do the work | Profound, Peec AI, Otterly.AI, AthenaHQ |
| Optimization platform | Monitoring plus content gaps, content creation, publishing, crawler data | Needs internal review capacity | Promptwatch, Searchable |
| Enterprise SEO suite | AI tracking added to a classic SEO stack | Fixed prompt sets, shallower AI data | Semrush, seoClarity, BrightEdge, Botify |
| Agency or consultancy | Strategy, content, digital PR, reporting | Quality depends on the team, tools often resold | Agencies such as 1001 SEO Media, Seer Interactive |
Most enterprises end up with a platform plus either internal staff or an agency. That is a legitimate answer. State it in the RFP so vendors price the right thing.
If you want to browse options before building a longlist, the GEO software directory at bestgeosoftware.com and the AI rank tracking directory are good starting points.
Step 3: Structure the RFP
The Searchmaxxed SEO RFP template uses twelve sections, and the structure carries over well. Adapt it like this:
- About us: products, buyers, markets, languages, main competitors in AI answers.
- What we want AI search to do: a single business goal for 12 months and how you measure it today.
- Where we are now: current AI visibility if known, a Search Console export, past SEO and GEO work, known problems.
- Scope: what you would do, in what order, and what is not included.
- Technical environment: CMS, deployment process, CDN, who can ship changes.
- Engines and markets: named engines, countries, languages, local needs.
- Measurement and reporting: sample report, attribution method, bot filtering.
- Security and data: a questionnaire appendix.
- Team (for services): named people, share of their week, who presents.
- Commercials: budget range, pricing format, terms, exit.
- Timeline.
- Response format and scoring: page limit, order of answers, the weighted sheet attached.
Give a budget range. Without one, vendors guess and you cannot compare. Share every written question and answer with every vendor, and set a question deadline so people can adjust their submissions.
Step 4: The questions worth asking
Aim for roughly 30 to 40. Inventive AI's guidance is that RFPs over 80 to 100 questions see lower response rates, and the vendors most likely to walk are the strong ones with other options. Here are the ones that separate vendors in practice.
Method and philosophy
- How do you define GEO, and what is out of scope for you?
- If we need results in one month, one quarter and one year, what would you do and not do to hit each? (Adapted from Seer's speed question.) A vendor who promises fast results without describing trade-offs is selling.
- How do you handle the trade-off between speed and risk, such as publishing at volume versus quality control?
- What do you refuse to do, and why?
- Do you guarantee rankings or citations in any engine? (The right answer is no.)
Data collection
- Do you collect responses from the real consumer interfaces of each engine, or from APIs? User-facing answers and citations can differ from API output.
- How many prompts, how often, in which countries and languages, and can I fix the location of a monitor?
- How do you account for query fanout? Promptwatch's fanout data showed ChatGPT averaging about 2.15 web searches per response in December 2025, easing to about 1.84 by early March 2026, with fanouts returning at 1.0 per response in April. Tracking prompts alone misses the sub-queries that decide citations.
- How are prompts chosen? Do they reflect buyer personas and real demand, or are they a fixed list you picked?
- How do you report per engine, and how do you build any blended score? Ask them to show the formula.
- How quickly do you detect and report behavior changes in an engine, and can you show an example from the last 90 days?
Measurement and attribution
- Which metrics do you report, and what does each one tell us? Look for separate coverage, prominence, sentiment and citation measures instead of one number.
- How do you connect visibility to business impact after we are mentioned? Seer cites Profound's research that users visit a brand's site at 1.5 to 2.5 times their baseline rate in the 7 days after an AI mention. Ask how the vendor thinks about unclicked influence.
- How do you identify AI-referred visits? Note that referrer data is unreliable (ChatGPT stopped sending a referrer on October 8, 2026, so tagged links and server-side methods matter).
- Do your crawler analytics verify source IPs against operator ranges, or only read user-agent strings? Do they separate training crawlers from answer-time fetchers? Promptwatch's crawler report counts only IP-verified requests, and OpenAI's share fell from 94.8% to 79.8% of verified requests between June and early September 2026.
- How would you tell whether a page is not being cited because bots cannot reach it or because the content is weak?
- If our GEO performance is compared with similar clients in your portfolio, how long would it take to answer, and how? (Seer's question, and a good test of how agentic the vendor really is.)
Execution
- What would you change on our site and off it to get us named? Ask for three specific pages or topics from our own site.
- How do you find content gaps, and how is new content grounded in citation data instead of generic prompts?
- Can you publish into our CMS, and with what approval workflow? Is there a review inbox?
- How do you treat third-party sources such as Reddit, YouTube and review sites? Check this against current data: ChatGPT drew only 0.46% of its citations from social platforms in late September 2026 while AI Overviews drew 12.2%, so a one-size social strategy is wrong.
- How do you refresh content, given that news pages lose half their ChatGPT citations within 36 days while landing pages and docs last longest?
- How do you handle brand claims that AI gets wrong, and how do you trace the wrong claim back to a source page?
Security, data and AI use
- List every AI tool or subprocessor that will touch our data.
- What certifications do you hold (ISO/IEC 27001, SOC 2), and where is data processed and stored?
- What access do you need from us, and what can you do with read-only access?
- How is access controlled and audited (roles, audit log, SSO)?
Commercials and exit
- Price in this order: one-off costs, monthly cost, anything billed separately (extra seats, extra prompts, extra credits).
- What are the limits that cause overage: prompts, responses, projects, API calls?
- What do we keep if we leave: data exports, content, accounts, history?
For each question, write down in advance what a 1, a 3 and a 5 look like. That is the single most useful habit in the whole process.
Step 5: Build the scoring sheet
Worqlo's enterprise AI vendor guidance suggests scoring each answer from 1 to 5 (1 is evasive or incomplete, 5 is specific and verifiable), multiplying by category weight, and disqualifying vendors who fall below 3 in security categories before demos. That adapts well to GEO.
| Criterion | Suggested weight | A 5 looks like | Disqualifier? |
|---|---|---|---|
| Data quality and method | 20% | Real-interface collection, per-engine metrics, fanout handling, formula shown | No |
| Execution and output | 20% | Specific plan for our pages, output stated in numbers per month | No |
| Measurement and attribution | 15% | Ties AI visibility to leads, verified-IP crawler data, bot filtering explained | No |
| Security and data | 15% | Certified, AI subprocessors listed, roles and audit log | Yes, below 3 |
| Integration and workflow | 10% | CMS publishing, API, Looker Studio or BI export, Slack | No |
| Team and support | 10% | Named people, delivery team presents | No |
| Commercials and exit | 10% | Clear pricing format, data export, no lock-in | No |
Adjust the weights to your situation. A regulated bank might put security at 25%. A team with no content staff might put execution at 30%.
A worked example
Say a B2B software company scores three vendors. Scores are 1 to 5.
| Criterion (weight) | Vendor A | Vendor B | Vendor C |
|---|---|---|---|
| Data quality and method (20%) | 3 | 5 | 4 |
| Execution and output (20%) | 4 | 2 | 5 |
| Measurement and attribution (15%) | 3 | 4 | 4 |
| Security and data (15%) | 5 | 4 | 3 |
| Integration and workflow (10%) | 4 | 3 | 5 |
| Team and support (10%) | 4 | 3 | 4 |
| Commercials and exit (10%) | 3 | 4 | 4 |
| Weighted total | 3.70 | 3.65 | 4.15 |
Vendor C wins on total, but its security score of 3 sits right at the disqualifier line. That is worth a written follow-up before the finalist meeting. This is the kind of thing a weighted sheet makes visible and a gut feeling hides.
Score alone first
The Responsive RFP guide recommends that evaluators submit individual scores before any group debrief. Once people hear each other's opinions, scores converge because of social dynamics, not because the proposals improved. Independent scoring first surfaces real disagreement and makes the debrief useful. Budget as much time for scoring as vendors get for responding, since rushed scoring drives bad selections.
Step 6: Red flags in GEO proposals
| Red flag | Why it matters | What to ask |
|---|---|---|
| Guaranteed citations or "#1 in ChatGPT" | Engine behavior shifts in days and no vendor controls it | "What happens to the guarantee when the engine changes?" |
| One blended visibility score, no method | You cannot tell a coverage problem from a prominence problem | "Show the formula and the per-engine breakdown" |
| API-only data presented as what users see | Consumer answers and citations can differ from API output | "Where does each number come from?" |
| The proposal could be about any company | They did not look at your site or your AI answers | "Name three pages or topics you would change first" |
| Traffic is the only success metric | Misses unclicked influence, and traffic can fall while leads rise | "Show a report that ties AI visibility to pipeline" |
| Crawler data from user-agent strings only | Spoofed bots inflate the numbers | "Do you verify IPs against operator ranges?" |
| Output described in hours or activities | You cannot count what you are buying | "How many pages and fixes ship in month two?" |
| Bulk AI content with no review step | Quality and brand risk | "Who approves what, and can we see the workflow?" |
| Cannot list the AI tools touching your data | Your content may go somewhere unapproved | "List every subprocessor" |
| Delivery team absent from the pitch | The sellers will not be the doers | "Who works on this weekly, and can they present?" |
| Accounts, content or data held in their name | You lose history when you leave | "What exactly do we keep at exit?" |
Step 7: Where tools fit in the shortlist
Platform vendors are easier to test than agencies, because you can run a trial on your own brand. When your RFP includes a software component, a few names regularly make enterprise shortlists. Judge them against your scoring sheet, not against this list.
Promptwatch is an end-to-end AI visibility platform. It collects responses from the real interfaces of ChatGPT, Google AI Overviews, AI Mode, Gemini, Perplexity and Copilot, runs IP-verified crawler logs, and closes the loop with content gap analysis, the Content Agent and CMS publishing to WordPress, Webflow and Framer. It is ISO/IEC 27001 certified and GDPR compliant, which helps with the security block. The Content Agent, faster-than-daily tracking, local targeting and Fact Check start on the Business plan at $579 per month, so confirm current pricing at promptwatch.com/pricing. A 7-day free trial is available on monthly plans, and the free AI visibility report is a low-effort way to test the vendor against your own brand.
Profound is the name you will hear most often in enterprise conversations, with strong monitoring and a higher price point.
Profound
Peec AI and Otterly.AI are lighter-weight prompt trackers. They can pass a monitoring-only RFP, but check how they score on crawler logs, attribution and execution.
Otterly.AI
If your organization already runs an enterprise SEO suite, ask the incumbent what it covers for AI search, since fixed prompt sets and shallow AI data are the usual limits.
For a head-to-head view of how platforms differ, Promptwatch publishes a 2026 side-by-side comparison of GEO platforms. It is a vendor-authored page, so use it as a checklist of capabilities to ask about and verify the claims yourself.
If you need services on top of software, the full-service route is an agency. 1001 SEO Media, which publishes this site, is one option and uses Promptwatch as its GEO platform. Hold it, and every other agency, to the same weighted sheet.
Step 8: The timeline
A workable schedule for an enterprise team:
| Week | Step |
|---|---|
| 1 | Finalize requirements internally, agree weights and score definitions |
| 2 | Draft and approve the RFP, build the longlist |
| 3 | Send to three to five vendors, open written questions |
| 4 | Share all questions and answers with every vendor |
| 5 to 6 | Proposals due, independent scoring |
| 7 | Group calibration, pick two or three finalists |
| 8 to 9 | Finalist demos and a trial or proof of concept on your own site |
| 10 | Reference calls, decision, contract |
The trial matters more than the demo. Ask each finalist to run your real prompts for two weeks, then compare what they found with what you already know about your own market.
Final checklist
- Internal owners and success metric agreed in writing
- You know whether you are buying a platform, a service, or both
- Budget range stated
- 30 to 40 questions, each with 1, 3 and 5 definitions
- Weights fixed before proposals arrive
- Security disqualifier threshold set
- Independent scoring before group discussion
- A trial on your own brand before signing
- Exit terms and data export confirmed
The vendor who answers the method questions plainly, shows you where the numbers come from, and admits what they cannot control is usually the one worth hiring.