How Enterprise Teams Should Run an AI Visibility Platform RFP in 2026

Key takeaways

• Write a one-page scope before you send a single question. Without it, two vendors can answer "yes" to the same line and mean different products.
• Ask for evidence on every requirement, not a checkbox. A "yes" with no scope, dated proof or limitation should earn zero points.
• Run your procurement and security filter first. It removes more of the shortlist, faster, than any feature comparison.
• Normalize pricing. Vendors meter by prompts, responses, credits, domains or seats, and the headline numbers are not comparable.
• Finish with a pilot on your own frozen prompt set, run more than once on more than one engine, and pick the platform that gets your team to action, not just a prettier dashboard.

Why this RFP is different from a normal martech RFP

Most enterprise buyers have run an RFP for an SEO suite or an analytics tool. An AI visibility RFP looks similar on paper and behaves differently in practice. The thing you are measuring is probabilistic. Answers vary by run, by country, by session and by model version. The surfaces change under the vendor's feet, and the vendor then has to decide whether to tell you.

Promptwatch Data shows how fast this moves. ChatGPT began using the site: operator at scale on August 8, 2026, jumping from about 0.4% to about 17% of fanout queries overnight. reddit.com's share of ChatGPT citations fell from roughly 4% to 0.5% on August 14, 2026. And average citations per response dropped around the GPT-5.3 rollout on March 4, 2026. A tool that looked accurate in March could have been quietly measuring something different by September.

So the RFP has a job beyond comparing features. It has to find out how each vendor handles change, what they can prove, and what happens to your data when you leave.

One caution before you start. Most of the public RFP advice you will find is about RFP response software, the tools proposal teams use to answer RFPs. That is a different category. Some of its lessons transfer well (run a real, hard test, confirm certifications that exist today, count admin labor in total cost), and I borrow those below. The rest does not apply here.

Step 1: write the scope on one page

Mentio's published RFP framework starts in the right place: describe the intended use before asking vendors anything. Keep it to one page and cover these items.

• Brands and entities to measure, plus priority markets, languages and AI surfaces
• Question types: brand, category, product and competitor prompts
• Who administers the platform, who reads reports, who exports data
• Data you will supply (prompts, client names, labels) and data you cannot send
• The decisions that depend on the output: executive reporting, alerts, content planning, audits
• Retention period and what you need to recover when the contract ends

Two traps to avoid here. Do not write "all AI engines" as a requirement. Name the surfaces that matter to your decisions. And do not ask for an accuracy guarantee unless you define what counts as a mention, a recommendation, a citation and a valid response. Attach that data dictionary, or ask each vendor to supply theirs with examples and exceptions.

The stakeholders matter too. Marketing owns the use case, but procurement, security and data owners need to sign off on the requirements before the document goes out. Getting them in the room at this step saves a painful rework at step five.

Step 2: build the requirement table

Give every requirement a stable ID and the same response fields. For each row, ask vendors for:

A "yes" with the other fields blank gets no points. That single rule filters out a lot of marketing language.

Organize requirements into families. A workable set looks like this.

Add rows for the things your team will actually do with the platform: crawler visibility, AI-referred traffic attribution, content workflows, API and MCP access. If you will not use it, do not ask about it.

Define coverage precisely

"Gemini coverage" can mean API calls, a search-enabled interface, a specific mode, or purchased third-party data. Those produce different answers. Ask each vendor which surface it queries and how, how location, language, session and personalization affect results, and when the coverage matrix was last updated.

This is the UI-versus-API question, and it deserves its own row. User-facing answers, citations and shopping recommendations can differ from API outputs. Neither is wrong, but you need to know which one you are paying for. Platforms like Promptwatch collect from the real interfaces of ChatGPT, Gemini, Perplexity, Google AI Overviews and others, and track API models alongside to show what models believe from training data. Whichever vendors you evaluate, make them say it in writing.

Scores need denominators

Every vendor has a visibility score, and they are not the same thing. For any score, request the denominator, the exclusions and the method to reconstruct it from raw data. Do not average or compare numbers across vendors that use the same metric name differently.

There is a second trap inside scores. If a score is computed over the prompts you track, adding easy prompts inflates it. Agree the prompt set before the work begins, baseline it, and freeze it. Otherwise a rising line may only mean someone added branded queries.

Step 3: history, change logs and method drift

Promptwatch's data on content half-life in ChatGPT (pages cited on July 6, 2026 and tracked for 90 days) shows why snapshots are not enough. After 60 days ChatGPT still cited 69% of landing pages and 67% of docs, but news lost half its pages within 36 days. Citations decay at different rates by content type.

That has two RFP consequences.

1. The platform must retain history and let you export all of it. Ask about retention periods and full-history export, in the contract, not the FAQ.
2. The vendor must tell you when its own method changes. Ask for a change log and a policy: when ChatGPT changes retrieval behavior, how do they flag the break in your trend line? The ChatGPT query fanout data shows average fanouts moving between roughly 2.15 and 1.0 searches per response over a few months. Vendors who cannot annotate method changes will hand you trend lines you cannot trust.

Step 4: crawler logs and attribution

Monitoring tells you what AI says. It does not tell you whether AI bots can read your site, or whether any of it sends revenue. If these matter to you, write requirements for them.

For crawler logs, ask whether the vendor verifies crawler IPs against each operator's published ranges. That matters because spoofed user agents are common. Promptwatch's AI crawler traffic report counts only requests whose source IP matches the operator's ranges, and it found OpenAI at 79.8% of verified AI crawler requests in the week of August 31 to September 6, 2026, down from 94.8% in mid-June. Also ask which log sources are supported (Cloudflare, Vercel, Fastly, raw server logs, a CMS plugin) because your infrastructure team will care.

For attribution, ask how AI-referred visits are identified. This is a live issue: ChatGPT stopped sending a referrer on October 8, 2026, so vendors need a documented fallback such as utm_source handling. A vendor with no answer is selling you 2025 analytics.

Step 5: security, privacy and exit

This is where deals stall, so run it early. Mentio's advice is to trace the path from a submitted prompt to an exported report: where it is stored, in what location, who on the vendor's support staff can see it, which third parties touch it, where copies live, and how deletion works.

Things to ask explicitly:

• Is customer data ever used to improve models? Get the answer in writing.
• Which certifications exist today? ISO/IEC 27001 and SOC 2 Type II are common procurement gates. As the SiftHub guide on enterprise RFP tooling puts it, a vendor that promises certification next year does not clear your review today.
• What do SSO, audit logs and role-based access look like, and on which plan?
• What is the data residency position, and is the vendor GDPR compliant?
• Does a standard security questionnaire (such as CAIQ) come with a data-flow diagram? A questionnaire supports a security review. It does not replace one.

On SLAs, define what is measured. Dashboard uptime is not the same as prompt-run uptime or export-delivery uptime. Separate contractual terms from public documentation and from non-binding expectations.

Ownership is part of this too. In 2026, Adobe completed its acquisition of Semrush (April 28) and Sitecore announced its acquisition of Scrunch (June 3), per Agenzy's market roundup. Add change-of-control, roadmap and pricing-lock language to the contract, and consider keeping commitments with recently acquired vendors to 12 months or less.

Step 6: score evidence, not demos

Set knock-out criteria before scoring begins. If a vendor fails your security review or cannot export raw data, they are out. Do not bury those failures inside a weighted average where a good dashboard score can paper over them.

For everything else, use a simple documentary scale.

Do not turn "to be confirmed" into a 2. Score the documents before any demos so a charismatic sales engineer cannot move your numbers.

Weights are yours to set, but Mentio's illustrative starting point puts data and traceability at 25, security and privacy at 25, and coverage and method at 20. For a team that expects to act on the data, I would add a real weight for execution: content workflows, publishing, task management and measurement of whether fixes worked. Measurement is increasingly a commodity. Promptwatch's own comparison claims 18 of 21 platforms track prompts and citations, and that is a vendor claim, so treat it with caution. But it matches what I see: the differences are in what happens after the report.

Step 7: normalize pricing

Pricing pages in this category are a mess. Vendors meter by prompts, responses, credits, domains, checks or seats. API, MCP, exports and seats are often gated to higher tiers. Build a spreadsheet that converts every quote to the same unit, for example cost per prompt per engine per day, at the volume you actually need.

A few examples of how different the packaging is. These come from vendor pages and third-party roundups, several of which conflict with each other, so confirm everything on the live pricing page before you use it.

Promptwatch's current prices are on promptwatch.com/pricing, and every plan there includes unlimited seats, all models, Agent Chat, Brand Narrative and API and MCP access. Annual billing gives 12 months for the price of 10. Be skeptical of any comparison table, including this one, because the sources are partly vendors and partners. Ask for formal quotes against your scope document.

Then add the cost the license line hides. The SiftHub guide makes a point that applies here: over a multi-year contract, admin labor often exceeds the license. A cheaper dashboard that needs a full-time analyst to turn data into tasks can cost more than a pricier platform that tells your team what to do next.

Step 8: shortlist and pilot

A sensible sequence, drawing on the Pepper Content and Mentio advice:

1. Run a free diagnostic (several vendors and free tools offer one) to find which lever is actually stuck: coverage, prominence, crawlability or sentiment.
2. Apply the procurement filter and remove any vendor legal will reject anyway.
3. Compare the two or three survivors on the criteria that matter to you.
4. Run a time-boxed pilot, 14 days is reasonable, on a frozen prompt set drawn from your real buyer questions.

During the pilot, require more than one run on more than one engine. A single run establishes nothing, because engines are probabilistic. Check that the same prompt returns comparable results across repeats, that a failed run is flagged and not silently scored as "no mention", and that you can export the raw rows and recompute the vendor's score yourself.

Watch for the quiet red flags. "Your team will find this easy to use" is not an answer to the question of who does the work. If your constraint is execution capacity, a platform with agents or a service team attached will serve you better than any dashboard.

Test the action loop

The most useful pilot test is a single end-to-end task. Take one visibility gap and ask each finalist to take you from finding it to fixing it to measuring the fix. With a monitoring-only tool, that means exporting a CSV and doing the rest elsewhere. With a platform built around execution, it means a prioritized action, a draft grounded in citation data, publishing to your CMS, and then tracking whether the page gets crawled, cited and clicked. Promptwatch is built around that loop (monitor, trace, act, measure), which is why it tends to score well on this test, and why the 7-day free trial is worth using on your own prompts.

Shortlisting by category

The market splits into a few types, and your scope document should tell you which you need.

For head-to-head detail, see Promptwatch vs Profound, Promptwatch vs Peec and Promptwatch vs Semrush. To browse beyond these, the GEO software directory at bestgeosoftware.com lists a much longer field.

A note on honesty: Promptwatch's comparison page and the Agenzy roundup both have a commercial interest. Use them to build your question list, then verify claims in your pilot.

Common mistakes

• Asking for "all AI" coverage and getting a yes that means nothing
• Scoring a demo built on vendor-prepared prompts
• Letting the prompt set drift during the pilot
• Comparing scores across vendors that define them differently
• Treating a security certification on the roadmap as a certification
• Ignoring exit: no full-history export means you are renting your own baseline
• Buying a dashboard when the real constraint is people to act on it

A one-page checklist

Before you send the RFP:

1. One-page scope approved by marketing, procurement, security and data owners
2. Data dictionary for mention, citation, recommendation and valid response
3. Requirement table with IDs and the six response fields
4. Knock-out criteria written down
5. Pricing normalization sheet at your real volumes

Before you sign:

1. Documents scored before demos
2. Pilot on a frozen prompt set, repeated runs, multiple engines
3. Raw export recomputed against the vendor's score
4. End-to-end action test completed
5. Change-of-control, pricing-lock, export and deletion terms in the contract

If you would like an outside perspective on the strategy side, 1001 SEO Media works with enterprise teams on GEO and AI search, and uses Promptwatch as its AI visibility platform. But the process above works with or without an agency. Write the scope, demand evidence, and pick the vendor that proves it can change your numbers, not just report them.