TL;DR Brand safety in 2026 is no longer just about where your ads appear — it is about what ChatGPT, Gemini, Perplexity and Google’s AI surfaces say about you when a buyer asks. This guide hands you a working monitoring system you can stand up this week for roughly the price of a coffee a month.
You will get: a three-tier monitoring stack (free, sub-£100, sub-£500), a severity-scoring rubric that tells you what to ignore and what to fight, a weekly cadence you can actually keep, and an illustrative DIY harness that uses a cheap model to classify mentions, sentiment and factual errors at scale — with the real cost maths, the failure modes, and the free fallback for every paid step.
The one rule that matters most: AI answers are non-deterministic. A single bad answer is noise. A pattern across repeated runs is signal. Build for the pattern, not the panic.
The deliverable, up front: your budget brand-safety monitoring stack
Most monitoring articles make you read 2,000 words before they tell you what to actually do. We are not doing that. Here is the entire system on one screen; the rest of this guide explains why each piece is there and how to run it. If you do nothing else, copy the table below and the severity rubric in section 5, and you have a defensible programme.
The stack is organised by budget tier. Pick the row that matches what you can spend, not the one that looks most impressive. A free tier run consistently beats an enterprise tier run twice and then forgotten.
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
Tool prices are 2026 vendor figures and move constantly; treat them as order-of-magnitude and confirm current rates before you commit. Our roundup of the best link building and visibility tools tracks the current options and where each one actually earns its fee.
Notice what is not in that table: a 12-month enterprise contract, a data scientist, or a custom dashboard. You do not need any of them to start. You need a fixed prompt set, a place to write down what you see, and the discipline to look every week. The tooling only ever automates those three things.
Why “brand safety” now means what the models say about you
The phrase used to belong to media buyers: keep our advert off the dodgy video, away from the offensive article. That problem still exists, but it is no longer the one that quietly costs you customers. The new exposure is that a model can describe your brand — its pricing, its policies, its track record, who founded it — to a buyer who never visits your site and never sees a single advert. If that description is wrong, hostile, or simply omits you, the damage is invisible until a deal evaporates for reasons nobody can name.
Three properties of AI answers make this genuinely different from classic reputation monitoring, and each one shapes how you build the system.
1. Mentions are now neutral by default — and that is the risk
Analysis of more than 1.8 million brand-bearing AI responses by the monitoring vendor Spotlight found that roughly 80.6% of brand mentions were neutral, 18.4% positive and only about 1% negative. That sounds reassuring until you read it the right way: the models are not attacking you, they are describing you flatly — and a flat description that buries you under three competitors is a loss even though nothing in it is “negative.” Brand safety in AI is as much about being framed well as about avoiding slander. For the mechanics of how those frames form and how recommendations get assembled, see our breakdown of how ChatGPT, Perplexity and Gemini choose what to recommend.
2. Coverage varies wildly by engine
The same Spotlight dataset reported that models mention brands at very different rates — Claude in around 97.3% of relevant responses, ChatGPT in about 73.6%, and Google’s AI Overviews in roughly 48.5% — and that they cite sources at different rates too (Perplexity linking in about 96.5% of answers versus around half for ChatGPT). The practical consequence: you cannot monitor one engine and call it done. A clean bill of health in ChatGPT tells you nothing about what Gemini is telling Google’s billion users.
3. Answers are non-deterministic, so naive monitoring lies to you
This is the trap that wrecks most home-grown systems. SparkToro’s January 2026 testing found there is less than a one-in-a-hundred chance that ChatGPT or Google’s AI, queried 100 times, returns the same brand-citation list across any two responses on the same topic. Ask once, get a scary answer, panic, “fix” something, ask again, get a clean answer, declare victory — and you have learned nothing except that randomness exists. The same instability is what makes citation losses so easy to misdiagnose; our AI citation recovery playbook formalises the three-day rule for telling a real drop from variance, and you should borrow it wholesale for brand-safety monitoring.
The instability rule, stated plainly: treat any single AI answer as one sample from a noisy distribution. A finding is only actionable when it survives repeated runs — three or more separate sessions, at different times, ideally signed out. Build that repetition into the system from day one, because bolting it on later means re-running months of unreliable history.
One more piece of context worth holding: AI still drives well under 0.2% of most sites’ sessions today, so the temptation is to ignore all of this. That is the wrong read. The traffic is tiny but the framing compounds — the brand the models reach for in 2026 is the one they keep reaching for in 2027. We make the full version of that argument in our analysis of how agentic browsing changes what a click is worth, and it is the reason a cheap monitoring habit started now beats an expensive one started under pressure later.
The four things actually worth monitoring (and the four you can skip)
A budget system survives because it refuses to monitor everything. These four signals carry almost all of the value. Everything else is a nice-to-have you add only once these are running reliably.
- Presence. When a buyer asks the category question, are you named at all? Absence is the most common and most underrated failure. The benchmark is sobering: one 2026 industry report put the average brand-mention rate across AI answers at around 17%, meaning most brands are simply missing most of the time. Measuring presence is the foundation; our guide to measuring entity authority when the old metrics can’t goes deep on the recall dimension this sits inside.
- Sentiment and framing. When you are named, how are you described — leader, also-ran, cautionary tale? Sentiment monitoring catches the slow souring that precedes a reputation problem reaching the models in earnest.
- Factual accuracy. Does the model state things about you that are wrong — discontinued products, incorrect pricing, a merger that never happened, a policy you abandoned? This is the highest-severity category because it is both damaging and fixable.
- Impersonation and fake citations. Is the model citing a source that is pretending to be you, or attributing a claim to a “study” or page that does not exist? This is rarer but the most dangerous, and it overlaps heavily with classic reputation attacks — the same defensive instincts in our negative-SEO detection and defence guide apply here.
What to skip on a budget: real-time alerting (weekly is fine; AI answers do not change minute to minute the way social does), every long-tail prompt (monitor buyer-intent prompts only), every language and region (start with your core market), and sentiment scoring to two decimal places (positive / neutral / negative is enough to act on).
Build it yourself: a monitoring harness for under a tenner a month
Here is where the budget tier earns its name. You can buy a listening tool, and at some scale you should. But the cheapest reliable way to classify sentiment and catch factual errors across a prompt set is to collect the answers yourself and run a small, cheap model over them as a classifier. The model is not the monitor — you are. The model just reads each answer and returns a structured verdict so you are not eyeballing 90 responses by hand every week.
The snippets below are illustrative and deliberately minimal — they show the shape of the harness, not a product. The workflow has three stages: collect answers for your fixed prompt set, classify each with a cheap model, and append the verdicts to a log you can trend over time.
Stage 1 — a fixed prompt set (the part that makes it trustworthy)
# prompts.py — your fixed buyer-intent prompt set. Change this rarely.
PROMPTS = [
“What are the best <category> tools for UK small businesses in 2026?”,
“Is <BRAND> a good choice for <use-case>? What are the downsides?”,
“<BRAND> vs <COMPETITOR>: which should I pick?”,
“How much does <BRAND> cost and what is its refund policy?”,
# … 10-30 prompts that map to real decisions, not vanity queries
]
ENGINES = [“chatgpt”, “gemini”, “perplexity”] # whichever you can collect
Collection itself can be free and manual to begin with — paste each prompt into a clean, signed-out session and copy the answer into a sheet. Automate it later via each engine’s API only if the volume justifies the cost and the terms permit it. Manual collection is the fallback that never breaks and never bills you.
Stage 2 — classify each answer with a cheap model
This is the only paid step, and it is paid in pennies. A small, fast model is the right tool: you are doing classification, not reasoning. The current cheapest Claude tier, Haiku 4.5, is priced at $1 per million input tokens and $5 per million output tokens (per Anthropic’s published pricing documentation), which — as the maths below shows — keeps a weekly programme comfortably under a tenner a month.
# classify.py — illustrative; uses the Anthropic Python SDK
import json, anthropic
client = anthropic.Anthropic() # reads ANTHROPIC_API_KEY from env
SYSTEM = (
“You are a brand-safety classifier. Given an AI answer and a brand name, “
“return STRICT JSON only: {mentioned: bool, sentiment: ‘pos’|’neu’|’neg’, “
“factual_errors: [string], confidence: 0-1}. Quote the exact span for any “
“claimed error. If you are unsure, set confidence below 0.5. No prose.”
)
def classify(answer_text, brand):
msg = client.messages.create(
model=”claude-haiku-4-5-20251001″,
max_tokens=400,
temperature=0, # determinism for stable classification
system=SYSTEM,
messages=[{“role”:”user”,
“content”: f”BRAND: {brand}\n\nANSWER:\n{answer_text}”}],
)
raw = msg.content[0].text
try:
return json.loads(raw)
except json.JSONDecodeError:
return {“mentioned”: None, “error”: “non-JSON”, “raw”: raw[:200]}
Stage 3 — log it so you can trend the pattern
# run.py — append verdicts to a CSV you can chart weekly
import csv, datetime
from prompts import PROMPTS, ENGINES
from classify import classify
BRAND = “<BRAND>”
row_date = datetime.date.today().isoformat()
with open(“brand_safety_log.csv”, “a”, newline=””) as f:
w = csv.writer(f)
for engine in ENGINES:
for prompt in PROMPTS:
answer = collect(engine, prompt) # your collector (manual or API)
v = classify(answer, BRAND)
w.writerow([row_date, engine, prompt, v.get(‘mentioned’),
v.get(‘sentiment’), ‘; ‘.join(v.get(‘factual_errors’,[])),
v.get(‘confidence’)])
Reproducibility metadata (so this still works when you re-run it):
Model string: claude-haiku-4-5-20251001 · SDK: anthropic (Python) ≥ 0.40
Settings: temperature=0 for classification stability; max_tokens=400. · Tested: June 2026.
Pricing basis: Haiku 4.5 at $1 / $5 per million input / output tokens, per Anthropic’s published pricing page. Confirm current rates before budgeting at volume.
What it actually costs (the maths, not a hand-wave)
Assume each classification call sends about 1,000 input tokens (the answer text plus the system instructions) and returns about 150 output tokens (the JSON verdict). At Haiku 4.5’s published rates that is:
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
| [object Object] | [object Object] | [object Object] | [object Object] |
The arithmetic per call: 1,000 input tokens × $1/million ≈ $0.001, plus 150 output tokens × $5/million ≈ $0.00075, for roughly $0.00175 a call. The whole point of choosing the cheap tier is that the monitoring layer never becomes the thing you have to monitor for cost. Caching the fixed system prompt (cache reads run at about a tenth of the input rate) and running classification through the Batch API (a 50% discount on non-urgent work) push it lower still.
Where this breaks in production
Every one of these will bite you eventually. The fix for each is cheap; not knowing about them is what is expensive.
Rate limits. New API accounts start on conservative requests-per-minute and tokens-per-minute ceilings. Failure threshold: if you hit 429s, you are going too fast. Fallback: add exponential backoff and run classification as an overnight batch rather than a live loop — slower, half the price, and it sidesteps the limit entirely.
Schema drift. The model occasionally returns prose instead of clean JSON, especially on messy inputs. Failure threshold: any non-JSON response. Fallback: validate every response, retry once, and use the API’s structured-output / tool-schema features with an enum for the sentiment field so the shape is enforced rather than hoped for.
Empty retrievals. Sometimes the engine refuses, returns nothing, or answers a different question. Failure threshold: an empty or off-topic answer. Fallback: log it as “no data,” never as “brand absent” — conflating the two manufactures phantom drops and sends you chasing problems that do not exist.
The classifier hallucinates an error. Your judge model can invent a “factual error” that is not there. Failure threshold: any flagged error with confidence below 0.7, or any high-severity flag at all. Fallback: require the model to quote the exact offending span, and route every high-severity flag to a human before you act. The harness triages; it never decides.
PII handling. AI answers sometimes contain customer names or other personal data. Failure threshold: any personal data in a collected answer. Fallback: redact before logging, keep the log access-controlled, and do not pipe raw answers into third-party tools without checking your obligations — the data-protection backdrop is summarised in our UK content-licensing and AI-access playbook.
Non-determinism. Covered above, and worth repeating because it is the silent killer. Failure threshold: acting on a single run. Fallback: the three-day rule — nothing is real until it survives repeated sampling.
The severity rubric: what to ignore, what to fight
A monitoring system that flags everything is a system you will stop reading by week three. The rubric below is the Monday-morning deliverable — print it, pin it, and score every finding against it before anyone touches a keyboard in anger. Severity is a function of two things: how wrong the answer is, and how close the buyer is to a decision when they see it.
| [object Object] | [object Object] | [object Object] | [object Object] |
| S1 — Critical | [object Object] | [object Object] | [object Object] |
| S2 — High | [object Object] | [object Object] | [object Object] |
| S3 — Moderate | [object Object] | [object Object] | [object Object] |
| S4 — Noise | [object Object] | [object Object] | [object Object] |
The single most valuable column is the last row. The discipline of writing “log and move on” against noise is what keeps the whole system credible — and keeps you from spending a Tuesday fighting a hallucination that vanished on its own by Wednesday.
For S1 and S2 findings, the actual correction work — getting the model to read better sources about you — is its own discipline, and it is mostly the discipline you already know. The signals that move AI answers are the same authority and corroboration signals that move rankings, which is the throughline across our analysis of what the data shows about AI Overviews and backlinks. If you are newer to why those signals exist at all, start with the fundamentals in what backlinks are and why they still matter.
The weekly and monthly cadence you can actually keep
A budget system lives or dies on whether you keep doing it. Make the weekly job small enough that a busy week never kills it.
Every week (15–30 minutes)
- Run the fixed prompt set through your collector (manual or automated) and let the harness classify it.
- Scan the log for anything scoring S1 or S2. Ignore S3/S4 unless you have spare time.
- Re-run any S1/S2 candidate two more times across the week before you treat it as real (the three-day rule).
Every month (60–90 minutes)
- Chart presence and sentiment trends per engine. You are looking for direction, not absolute numbers.
- Add competitor share-of-voice: who else is named on your buyer prompts, and is that changing?
- Run an impersonation and fake-citation sweep — search the brand name and common misspellings, and check any source the models cite as “you.”
- Review the prompt set itself once a quarter, not monthly — stability of method is most of what makes a trend believable.
If that open-web layer (the alerts, the misspellings, the scraped-content checks) feels familiar, it should: it is the same monitoring backbone behind real-time reactive PR. The stack and the 90-minute setup are laid out in our newsjacking and reactive-PR playbook, and there is no reason to run two separate systems when one covers both jobs.
When to graduate from DIY to a paid tool
The DIY harness is the right starting point, not the permanent answer. You should pay for a dedicated tool the moment one of these becomes true — and not before, because paying earlier buys you a dashboard you will not have time to read.
- Volume. You are tracking more than one brand or market, or your prompt set has grown past what you will reliably run by hand. Threshold: when collection alone eats more than an hour a week.
- Coverage you cannot reach. You need engines, regions or languages you cannot collect yourself, or you want UI-snapshot accuracy (what the user actually sees, including the messy real interface) rather than clean API output.
- Stakeholders. Someone other than you needs to see the data — a client, a board, a CMO. A shared dashboard you did not build by hand starts to pay for itself in reporting time alone.
Even then, keep the harness running alongside the tool. No single tracker covers every dimension well, and the same brand can score very differently across tools that calculate share-of-voice differently — a point we hammer in our guide to measuring entity authority when the old metrics can’t. The DIY layer is your cheap, consistent second opinion. When you do go shopping, our best link building and visibility tools roundup maps the current AI-visibility trackers and what each is genuinely good at.
Five mistakes that quietly waste the whole effort
- Acting on one answer. The cardinal sin. One bad answer is a coin flip, not a crisis.
- Monitoring vanity prompts. “Who is the best company ever?” tells you nothing. Monitor the prompts a buyer types the week they are about to choose.
- Treating absence as an attack. Most of the time you are missing because the corroboration is not there yet, not because anyone is against you. That is a visibility project, not a fight.
- Chasing every engine equally. Weight your effort to where your buyers actually research. Two engines watched well beat five watched badly.
- Letting the tool become the job. The dashboard is not the work. The weekly read and the corrective action are the work. If you find yourself admiring charts and changing nothing, you have a hobby, not a programme.
If you want the wider strategic frame for where all of this sits — monitoring is the feedback loop, but the engine that actually moves the needle is earned authority — the 15 link building strategies that actually work in 2026 is the hub that ties the corrective work together, and the link building statistics for 2026 reference gives you the benchmark numbers to argue your case internally.
A worked example: one week running the system
To make the cadence concrete, here is an anonymised composite — a small UK B2B SaaS brand, details merged from several typical cases rather than any single client, so nothing here identifies a real company. Call it Northwind. Northwind sells project-management software to UK construction firms, competes against two larger names, and has exactly one part-time marketer running everything. This is the budget tier in motion.
Monday: collect and classify
The marketer opens a clean, signed-out browser and runs Northwind’s fixed set of 18 buyer prompts through ChatGPT, Perplexity and Google’s AI surfaces — things like “best project management software for UK construction” and “Northwind vs the two larger competitors.” Each answer goes into a sheet; the DIY harness classifies all 54 responses in under a minute for a few pence. Total human time: about 25 minutes.
Tuesday: read the log, not the panic
Two flags surface. First, an S1 candidate: one ChatGPT answer claims Northwind “does not integrate with common accounting tools,” which is false and directly damaging on a high-intent prompt. Second, an S3: Northwind is simply absent from the generic “best software” listicle-style answers where both competitors appear. The marketer resists the urge to act on the S1 immediately — one answer is a coin flip — and instead re-runs that specific prompt twice more across Tuesday and Wednesday, at different times.
Wednesday: confirm, then triage
The integration falsehood repeats in two of the three re-runs — that clears the three-day bar and becomes a confirmed S1. The marketer traces where the model is reading it from and finds the cause: an outdated comparison page on a third-party directory still lists Northwind’s integrations as they stood two years ago. That is the source to fix. The S3 absence, by contrast, is logged as a visibility project for the month, not a crisis — the fix there is corroboration, not correction.
The rest of the month
Northwind gets the directory page updated and shores up the integration claims on its own site and one authoritative review platform. Four weeks later the integration falsehood has dropped out of the answers entirely. The absence problem moves slower — it needs the kind of earned coverage that genuinely takes months — but it is now tracked, with a number attached, rather than felt as a vague unease. Total cost for the month: under £1 in model calls, plus the marketer’s couple of hours. That is the whole pitch for the budget tier: it is cheap enough that there is no excuse not to be doing it, and structured enough that it actually changes what you do.
The lesson from Northwind: the system’s value was not the dashboard or the model — it was the rule that turned one scary answer into a confirmed pattern with a known cause, and the discipline that sorted a genuine S1 from a slow-burn S3 so the right work happened at the right urgency.
The open-web layer: what the models read before they answer
There is a temptation to monitor only the AI answers themselves and treat the open web as a separate, older problem. That is a mistake on a budget, because the two are the same problem viewed at different points in the pipeline. Models build their picture of you from training data and live retrieval, and live retrieval pulls from the open web — directories, review sites, news, forums and your own pages. A wrong answer almost always traces back to a wrong source. Monitoring the open web is therefore not a separate programme; it is the early-warning system for the AI layer.
The cheapest version is a set of free alerts on your brand name and its common misspellings, a quarterly scan of the directories and review platforms that describe your category, and a check of your own most-cited pages for anything stale. When an AI answer goes wrong, this is the layer you investigate first, because it is where the fix lives. Branded mentions across this layer also happen to be the single factor most correlated with appearing in AI answers in the first place — Ahrefs’ analysis put web brand mentions at the top of the correlation table, ahead of branded anchors and branded search volume — so tending it does double duty: it prevents bad answers and earns good ones. The full data picture is in our analysis of AI Overviews and backlinks.
Collecting answers: manual, API, or scraping?
The collection step is where people overcomplicate a budget system. There are three ways to get the answers you classify, and for most brands the simplest is correct for far longer than they expect.
- Manual collection. Paste each prompt into a clean session and copy the answer. Free, never breaks, terms-compliant, and forces you to actually read what the models say — which is itself valuable. The downside is time, which caps it at roughly a few dozen prompts a week. Start here.
- Official APIs. Where an engine offers programmatic access, you can automate collection. This scales cleanly but adds cost and complexity, and you must respect each provider’s terms. The failure threshold is simple: automate only when manual collection exceeds about an hour a week. The cheaper fallback if API costs surprise you is to automate the classification but keep collection manual.
- Scraping the consumer interfaces. Tempting, brittle, and often against terms of service. Avoid it on a budget. If you genuinely need what-the-user-sees fidelity across many engines, that is precisely the moment to pay a dedicated tracker that handles it compliantly rather than building a scraper you will spend every week repairing.
Whichever you choose, the principle holds: the prompt set and the log are the system; collection is just plumbing. Keep the plumbing as simple as the volume allows.
Frequently asked questions
How much does it cost to monitor AI brand safety on a budget?
You can run a credible programme for £0 using manual prompt runs in clean sessions plus a logging sheet. Adding an automated DIY classifier built on a cheap model such as Claude Haiku 4.5 typically costs under £1 a month at a 30-prompt, three-engine weekly cadence, and stays under a tenner a month even at several hundred prompts. A dedicated paid tracker becomes worthwhile from roughly £79–£139 a month once volume, coverage or reporting needs grow.
How often should I check what AI says about my brand?
Weekly for the core prompt set, with a deeper monthly review. AI answers do not change minute to minute the way social feeds do, so real-time alerting is rarely worth the cost on a budget. Crucially, confirm any worrying finding across three or more separate runs over several days before acting, because individual answers are non-deterministic.
Can I use ChatGPT or Claude to monitor my own brand safety?
Yes — but as a classifier, not as the source of truth. The reliable pattern is to collect answers from the engines your buyers use, then run a cheap model over those answers to score mentions, sentiment and factual errors into a structured log. The model triages at scale; you make the decisions, and you human-verify anything high-severity because the classifier can hallucinate errors too.
What is the difference between AI brand safety and traditional brand safety?
Traditional brand safety is about ad placement — keeping your advertising away from harmful or off-brand content. AI brand safety is about representation — what large language models and AI search surfaces tell users about your brand directly, including accuracy, sentiment and whether you are named at all. The second increasingly matters more, because the model’s description reaches the buyer even when no advert and no click ever does.
Which AI engines should I monitor first?
Start with the engines your audience actually uses to research and decide, then expand. For most UK brands that means ChatGPT, Google’s AI Overviews and AI Mode, and Perplexity, with Gemini close behind given its Google integration. Because coverage and citation behaviour differ sharply between engines, monitoring only one gives a dangerously incomplete picture.
How do I fix a factual error an AI model states about my brand?
Fix the sources the model reads, rather than trying to argue with the model. Correct the inaccurate information at its origin (your own pages, directories, Wikipedia-class references, and authoritative third-party coverage), strengthen the corroborating signals that describe you correctly, and use any in-product correction or feedback mechanism the engine offers. Then monitor across repeated runs to confirm the correction has propagated, which can take weeks.
