An AI visibility audit checks four layers in order — identity, background code, trust, and content. Each layer must pass before the next one matters. Most businesses fail at layer one.
When a business owner discovers they are missing from AI recommendations, the first question is always the same: why?
The answer is never one thing. It is a combination of signals, stacked in a specific order, where failing at layer one makes everything else irrelevant.
An AI visibility audit is the process of checking those signals in order — identity, background code, trust, and content — and finding exactly where the breakdown is.
How is an AI visibility audit different from a standard website check?
A standard website audit checks whether your site is easy for Google to find and rank. It looks at things like: how often your keywords appear, how fast your pages load, and how many other websites link to you.
An AI visibility audit checks something different: whether AI tools can identify you, verify you, and confidently recommend you.
Think of it like this. A Google audit checks whether your restaurant appears in the phone book and how prominently. An AI audit checks whether the well-informed friend — the one everyone asks for restaurant recommendations — actually knows about your place, trusts it, and would mention it without hesitation.
The signals are different. A business can rank well on Google and still be invisible to AI tools that cannot identify or verify it.
Layer 1: Can AI tools clearly identify your business?
This is the first layer every audit checks. Everything else depends on it.
The question is simple: can an AI tool tell exactly who you are, what you do, who you serve, and where you work — just from reading your homepage?
This sounds obvious. Most business owners assume their website communicates this clearly. In practice, many small business websites open with something like "Welcome to Smith & Co" or "Trusted local experts since 2009."
Neither statement tells an AI tool what Smith & Co does, who they serve, or where they operate. The tool has no clear identity to anchor a recommendation to.
The fix: A homepage headline that answers four questions in plain language.
- Who you are
- What you do specifically
- Who you serve
- Where you work (if location matters)
"Smith & Co: employment lawyers in Melbourne specialising in unfair dismissal claims for small business owners" gives an AI tool everything it needs.
This is checked first because everything else builds on it. Background code confirms an identity the tool already understands. Trust signals back up a business the tool has already identified. Content gives a recognised business more material to cite. None of it works if the tool cannot identify the business in the first place.
Layer 2: Does your website have background identity code?
Background code — known as schema markup (say it: "SKEE-muh") — sits in your website's code and describes your business in structured, machine-readable language. Visitors to your website never see it. AI tools read it every time they visit.
Think of it like the information printed on the back of a business card that only certain systems read. The front is for people. The back is for machines: business name, category, location, services, contact details — all in a structured format that does not require interpretation.
An audit checks for four types of background code.
Business identity code declares your business name, industry, description, and contact information. This is the first to implement because it confirms what the tool suspects from reading your homepage. Without it, the tool falls back on guesswork — and AI tools make conservative guesses about businesses they cannot confirm.
Location code applies when customers choose you partly because of where you are. It declares your address, the area you serve, your opening hours, and your phone number. Gemini (Google's AI tool) reads this alongside your Google Business Profile. Businesses missing this code but with a strong Google Profile often still appear on Gemini. Businesses missing both are consistently absent.
Services code declares what you sell. Most small businesses do not have this. Without it, AI tools have to infer your service category from your visible content — which produces less reliable results than a clear, declared service description.
FAQ code labels your question-and-answer section so AI tools know to extract from it. When paired with a well-formatted FAQ section, it lets tools pull specific questions and answers and attribute them to your business. This is the code type that produces the most visible improvement for most businesses.
Layer 3: Do outside sources confirm your business?
This is the layer most businesses skip — because it takes months, not hours. It is also the layer that compounds most powerfully over time.
AI tools do not rely only on your own website. They look for outside confirmation. Think of it like applying for a job. Your own resume says you are great. A reference letter from a credible third party says something far stronger. AI tools work the same way.
An audit checks three categories of outside confirmation.
Google reviews. An audit looks at how many you have, how recent they are, and how specific they are. A handful of generic five-star reviews from two years ago does not give an AI tool the confidence it needs to recommend you. A pattern of recent, specific reviews from real customers does.
An audit distinguishes between a stale profile (needs fresh reviews) and an absent one (needs to be claimed and built from scratch). The fix is different for each.
Mentions on other websites. An audit checks whether your business name appears on credible outside sources — industry directories, professional association websites, local media, supplier or partner sites. Three to five credible external mentions in relevant sources is the threshold that consistently changes audit outcomes.
Directory listings. Not all listings are equal. A listing in a relevant industry directory — a professional body's member directory, an industry-specific platform — carries real weight. A bulk submission to fifty generic directories carries almost none. An audit tells the difference.
Layer 4: Does your content give AI tools something specific to cite?
The final layer: when an AI tool recommends you, does it have something specific to quote? Or does it have to be vague because your content does not give it anything concrete?
A homepage and a services page establish that you exist. They do not give an AI tool specific content to cite when justifying a recommendation.
An audit looks for three content signals.
Question-led headings. Page headings written as questions — "What does an employment lawyer do for small businesses?" — match the format AI tools produce when answering queries. They extract from this structure reliably. Headings written as topic labels — "Employment Law Services" — are harder to extract from and tend to be skipped.
Answer-first paragraphs. The first sentence of each section should directly answer the heading. AI tools extract the first sentence of a section far more than any other part. Sections that open with background context before delivering the answer lose this advantage.
Fresh content. A website where all content was published two or more years ago signals an inactive business. AI tools with live retrieval capabilities — Perplexity in particular — weight freshness. An audit flags content that has not been updated or added to in the past twelve months.
Why the order matters
The four layers are checked in sequence because each one depends on the previous one working.
Fixing background code before the identity layer does not help — the tool cannot anchor code to a business it cannot clearly identify. Building trust signals before the identity and code layers are solid is wasted effort. Adding content depth before the first three layers are in place produces almost no improvement.
This is important because businesses commonly try to fix the most visible problem — "we need more content" — when the actual blocker is earlier in the stack — "our background code is missing and the tool cannot confirm who we are."
How to use the findings
Act on the layer that failed first, not the one that seems easiest.
- Identity failed: rewrite your homepage headline. One afternoon.
- Background code missing: your web developer can add it in a few hours.
- Trust signals thin: a sustained campaign over months — asking for reviews, claiming directory listings, earning mentions.
- Content depth weak: an ongoing publishing plan — FAQ pages, articles, updated service descriptions.
Start with the test. The article on how to check your AI visibility walks through running five customer-language queries across six AI tools in 20 minutes. That tells you where the problem is before you commit time to fixing it.
Frequently asked questions
How is an AI visibility audit different from an SEO audit?
A traditional SEO audit checks ranking signals — how often your keywords appear, how many other sites link to you, how fast your pages load. An AI visibility audit checks recommendation signals — how clearly you identify yourself, whether your background code is complete, whether outside sources confirm you, and whether your content is written in a format AI tools can extract from. A business can rank well on Google and still be invisible to AI tools that cannot identify or verify it.
How long does a full AI visibility audit take?
A manual audit across all four layers takes two to four hours for a typical small business website. The identity and content layers are fully self-auditable. Checking background code requires either reading your website's page source or using a free validator tool. The trust layer requires checking external sources, not just your own website.
What score do I need to be visible in AI recommendations?
There is no universal answer. What matters is how you compare to the alternatives in your field and location. A score of 60 out of 100 may be enough if your competitors score 40. The same score may not be enough if your competitors score 75. Context matters more than an absolute number.
Can I do an AI visibility audit myself?
Yes, for most of it. The identity layer is fully self-auditable — read your own homepage headline and ask whether it clearly names who you are, what you do, who you serve, and where. The content layer is self-auditable too — check whether you have a FAQ section and whether your page headings are written as questions. Background code requires a free online validator or a developer. The trust layer means checking your Google review profile and searching for your business name in external directories.
How often should I re-audit?
Audit when you make structural changes — a new homepage, updated background code, a new content push. Or run a check every 90 days if you are actively building trust signals. A quarterly check against the same test queries is enough to track progress over time.
