The AEO Standard for regulated practices.
This is a public specification for how a medical, legal, or wealth practice should be set up so AI answer engines can find it, trust it, and quote it correctly. Forty-nine numbered requirements in six parts, with a conformance checklist. It is free to read, free to adopt, and free to cite. You do not need to hire anyone, including us.
Somebody had to write it down.
People now ask an AI engine who to trust before they ask anyone else. The engine answers with a handful of names, and for most independent practices that answer is decided by things nobody in the practice has ever looked at: whether four directories agree on the suite number, whether the site answers the question a patient actually typed, whether the schema underneath says something the page does not.
There is no shortage of advice about this. There is a shortage of anything checkable. So we wrote down what we actually do, as requirements you can point at, argue with, and hand to whoever maintains your website.
The generosity is deliberate, and we would rather be plain about it than coy. Being cited is literally the business we are in. A specification that gets read and adopted proves the method better than any number we could publish about ourselves. If you work through all six parts on a Saturday and never speak to us, this document did its job.
- Independent medical and dental practices
- Law firms, solo through mid-sized
- Registered advisory firms and financial planners
- The web person, marketer, or office manager who maintains any of the above
- The record of who you are and where it lives
- The answers on your own site and the form they take
- The structured data underneath them
- Credentials, corroboration, and the regulatory constraints around all of it
- How to check whether any of it worked, honestly
Three words, and a stable number for every requirement.
Requirements are numbered by part. The numbers are permanent: 3.5 will mean the same thing in five years, so you can cite it in a scope of work or an email to your developer without ambiguity.
Required for conformance. A practice that meets every Must in version 1.0 conforms to version 1.0. These are the items where skipping one tends to undo the others.
Strongly recommended. Skip one when you have a reason, and write the reason down. Most Shoulds here are cheap and most practices simply have not gotten to them.
Actively harmful. These are not stylistic preferences. Each one either misleads an engine, breaks a rule your regulator enforces, or both.
Identity
An engine deciding whether to name you is doing one thing first: checking whether the web agrees about who you are. Part 1 is about producing one record and making every surface match it. The failure mode is not absence. It is contradiction.
One page, on a domain you control, stating the facts plainly: operating name, address, phone, hours, the services you provide, and the people who provide them. Every other listing exists to agree with this page. If you cannot point to the page, you do not have a canonical record, you have several drafts.
Pick the exact string, including punctuation and the presence or absence of a comma before a credential, and use it everywhere. "Riverside Orthopedic Associates" and "Riverside Orthopaedics" and "Riverside Ortho Assoc." look like three organizations to something reading at scale.
One suite format, one abbreviation convention, one phone number formatting. Use the number that actually rings your office. Call-tracking numbers that rotate per channel are a quiet, expensive way to make your own record disagree with itself.
Full name as it appears on the license, credential, role, and the jurisdiction where each person is licensed. In medicine, law, and money the individual carries most of the trust. A practice page with no named humans on it asks an engine to vouch for an address.
Choose them on evidence, not on volume. For most practices that is fifteen to twenty five surfaces: the general maps and business profiles, the field's real directories, the licensing and regulatory records, the hospital or bar or custodian pages that already carry your name. Fifty listings is not five times better than fifteen. It is fifty chances to disagree.
When two records disagree, fix or remove the wrong one. Publishing a third correct listing does not break the tie, it adds a vote. This is what agreement rather than volume means in practice, and it is the single most common reason a well-run practice reads as uncertain.
The same paragraph on your site, the directory profile, the hospital staff page, and the bar or adviser record. Different bios are not richness. They are four slightly different claims about one person's training.
A move, a departure, a new location, a dropped service. Stale records outlive the change by years, and an engine that finds your old suite number on three sites and your new one on one will often report the old one. Put this on a calendar, not on somebody's memory.
Answers
An engine cannot quote a paragraph you never wrote. Part 2 is about putting the actual questions your clients ask on your own site, in their words, in a shape a machine can lift without changing the meaning.
If the only place your practice explains its fees is a directory profile or a review reply, the directory is what gets cited. Publish the answer somewhere you own. Everything downstream in this standard assumes the answer exists on your domain first.
People search "toothache that wakes me up," not "irreversible pulpitis." They ask about "getting cut out of a will," not "spousal elective share." Lead with the plain phrasing, then name the professional term. Carrying both is how you stay findable without sounding like a brochure.
State the answer, then qualify it. Extraction takes the top of a passage. A paragraph that spends four sentences on background before it gets to the number is a paragraph an engine will summarize as background.
One question per heading, written the way somebody would ask it, with the answer directly underneath. "How much does a living trust cost?" beats "Fee Structure." This costs nothing and it is the most reliable formatting change most sites can make.
What it is, what actually happens, what it costs, how long it takes or what recovery looks like, and how somebody starts. Those five carry nearly every service decision in these fields. A service page missing two of them is a page an engine has to finish somewhere else.
A range with the factors that move it beats silence every time, and silence is what most regulated practices choose. If a number is genuinely impossible, publish the method: how you bill, what a consultation costs, what determines the estimate. Cost is one of the first things asked and one of the last things published.
A passage that begins "as mentioned above" or "this procedure" cannot be lifted without breaking. Write each answer so it survives being read alone, because being read alone is exactly what happens to it.
These queries arrive as "near me." Name your city and the areas you genuinely serve, in prose, once, where it belongs. Do not generate a page per suburb you have never worked in. The engines got good at spotting that, and so did the people reading it.
Every answer is a claim your license is attached to. If your site cannot support an answer, mark it a draft, get a qualified person to approve it, and publish it then. Filling a gap with plausible text is how a practice ends up defending a sentence nobody in the building wrote.
Structure
Structured data is how you hand a machine the facts instead of hoping it infers them. Part 3 covers the types that matter for these fields, how they should nest, and the line between describing your practice and decorating it.
A single JSON-LD block containing one graph, not four plugins each emitting their own organization. Competing blocks are the most common structured-data defect on practice sites, usually because a theme, an SEO plugin, and a booking widget all think they are in charge.
Medical practices have real subtypes: Physician, Dentist, MedicalClinic, and the specialty types beneath them. Firms have LegalService and Attorney. Advisories have FinancialService. A generic LocalBusiness is the floor. Being specific is free and it is the difference between "a business" and "a dermatology practice."
Each practitioner gets a Person node with a stable identifier, referenced from the organization rather than described again on every page. This is what lets an engine understand that the Dr. Alvarez on the bio page and the Dr. Alvarez on the service page are one person.
Define your organization once, with one identifier, and point at it from everywhere else. Redefining the same entity on twelve pages with small differences reproduces the Part 1 problem inside your own site, where you have no excuse for it.
Every question and answer in your FAQ markup appears on the page, in the same words. Markup describing content a visitor cannot see is not optimization. It is a claim about your page that your page contradicts, and it is treated accordingly.
Service and procedure types for what you do, a proper postal address and coordinates for where you do it, opening hours in the machine-readable form. All of it identical to the canonical record. Structured data that disagrees with your own listings is worse than none.
No ratings you assembled yourself, no reviews the page does not display, no awards nobody gave you, no credentials nobody issued. Self-serving aggregate ratings are the classic version of this and they are both a markup violation and, in most of these fields, an advertising-rule problem.
If your fees only appear after a script runs, assume some readers never see them. Accordions and tabs are fine when the text is in the document; content fetched on click often is not. View the page with scripting off and check that the answers are still there.
A published date and a last-modified date, both real. Recency matters for anything a rule or a price can change. Automatically bumping the date every night because a plugin touched the file is a lie told 365 times a year.
Evidence
In these three fields, the question underneath every question is whether you are actually qualified. Part 4 is about stating credentials precisely and pointing at the public record that backs them, so a claim on your site is checkable rather than asserted.
Degree, the certifying body named in full, the year, the jurisdiction, and the license number where it is public. "Board certified" without the board named is not a credential, it is a mood. Precision is what makes the claim verifiable, and verifiable is the whole point.
These records exist and they are free: state medical and dental license lookups, certifying board verification, state bar member directories, the SEC's adviser search and Form ADV, FINRA BrokerCheck. Linking the claim to the registry turns your bio into something a machine can confirm rather than merely repeat.
A hospital staff listing, a university faculty page, a court admission roll, a bar committee roster, a byline in a professional publication. Independent mentions carry weight your own site cannot generate for itself, and most practices already have several they have never pointed at.
An accreditation held by the facility is not a certification held by the physician. A firm's memberships are not an attorney's admissions. Blurring the two is one of the easiest advertising-rule problems to create by accident on an about page.
This includes implication by adjacency: a certification logo next to a practitioner who does not hold it, a membership presented in the visual language of a board certification, a training course described so it reads as a credential. See also 5.5 on the words themselves.
Clinical, legal, and financial explainers should name the person who wrote or reviewed them, with credential and review date. Anonymous authority is the weakest kind, and in these fields an unattributed medical or legal explanation raises a question rather than answering one.
One document listing every factual claim your site makes and where each can be substantiated. It takes an afternoon. It is also, not coincidentally, the first thing you would want in hand if a board or a regulator ever asks about your marketing.
Compliance
This is the part most AEO advice skips, and it is the part that decides whether the rest is usable. Part 5 states the constraints these fields operate under, and why a compliant page and an extractable page turn out to be the same page.
We are not lawyers, and nothing here is legal or compliance advice. Rules differ by state, by board, by bar, and by registration type, and they change. Every item below is written as a constraint to go and check, not as a conclusion about your practice. Take them to your own counsel or compliance officer. Where a rule is genuinely uncertain, we say so rather than guessing on your behalf.
Medical boards, state bars, and the securities regulators all start from the same place: a communication may not be false or misleading. Superlatives are where practices usually fall down, because "best," "leading," and "top" cannot be substantiated by anyone. They also add nothing an engine can use. Cutting them satisfies your regulator and your extraction at the same time.
Many state bars require a disclaimer that prior results do not guarantee a similar outcome, and some go further. Investment advisers face detailed requirements when performance appears at all, including presenting net of fees alongside gross and prescribed time periods. Check what your jurisdiction and registration require before a single number goes on the page.
Some medical boards restrict patient testimonials outright. Some state bars restrict them or require specific disclaimers. The SEC's marketing rule, effective for advisers since November 2022, permits testimonials and endorsements only with clear disclosure of whether the person is a client, whether they were compensated, and the material conflicts involved. FTC endorsement rules apply on top of all of it. Nothing in this standard requires a testimonial.
There is no exception for a patient who posted first. Confirming publicly that a named person is a patient is itself a disclosure, which makes review replies the most common way a practice creates a HIPAA problem while trying to be responsive. Reply generically or reply privately.
Specialist, board certified, expert, certified, fiduciary, and fee-only each carry a controlled meaning in at least one of these fields, and several are restricted in ways that vary by state. Using one of them loosely is the fastest way to turn a marketing page into a complaint. Confirm what each means where you practice before you use it.
Some states require attorney advertising to be labeled as such. Retail communications from broker-dealers carry principal approval and, in some categories, filing requirements under FINRA's communications rule. These obligations attach to your website the same way they attach to a mailer, and they are routinely forgotten on the website.
Your Form ADV, your bar registration, your license record, and your website should describe the same firm, the same services, and the same people. A regulator reading both at once is looking for the gap. So, in a different way and for a different reason, is an engine.
Treat the compliant version of a page as the target version, not a watered-down one. Where a rule forces you to be more specific, more attributed, or more qualified, the page gets better for extraction at the same time. Practices that write two versions and reconcile them later end up with a page that serves neither reader.
The convergence is the useful discovery in this whole document. Regulators and answer engines reward the same things: specific, verifiable, attributed, dated, plainly worded. They punish the same things: unsubstantiated superlatives, vague authority, borrowed credentials, claims with nothing behind them. The compliant page and the extractable page are the same page. Once you see that, the compliance department stops being the obstacle to this work and starts being the specification for it.
Measurement
Most reporting in this category is one screenshot of one engine on one good day. Part 6 is about measuring in a way that survives being repeated by somebody who does not work for you.
Write down the exact questions, in the exact words, before the first run. Twenty to forty is plenty for most practices. Changing the wording between runs turns a measurement into an anecdote, and it is usually done unconsciously, in the direction of a better answer.
These systems are not deterministic. The same question, asked twice in the same hour, can return different names in a different order. A single run tells you what happened once. Three to five runs start telling you what tends to happen.
The major assistants and AI search products draw on different indexes, different retrieval behavior, and different source preferences. Being named by one and ignored by another is normal and it is diagnostic. Reporting only the engine that names you is marketing, not measurement.
Date, engine, model or version if it is shown, whether you were signed in, and the location context. Answers to "near me" questions vary by city and sometimes by neighborhood. An observation without its conditions cannot be compared to anything, including itself next month.
Named, not named, and named with something wrong. The third is the one most practices never look for and the one most worth finding: an engine confidently reporting a closed location, a departed partner, or a service you stopped offering. That is a Part 1 problem showing up in the only place it is visible.
It is a sample, not a score. Variance is the normal condition of these systems, not a sign something broke. Read the trend across weeks and engines, and be suspicious of any report, ours included, that hands you one clean number without showing the spread behind it.
If you cannot hand somebody the prompt, the date, the engine, and the conditions, you do not have a measurement. Visibility scores with undisclosed methods are the tell of a vendor who would prefer you did not check.
Whether every surface agrees, whether the five decision questions are answered on each service page, whether the structured data validates, whether the credential links resolve. Those are fully in your hands and they move first. Citations are the outcome. The inputs are the work.
The short version, in sixteen checks.
If all sixteen are true, your practice conforms to version 1.0. Nothing is saved and nothing is sent anywhere; this is a scratchpad that resets when you leave the page.
The self-assessment above is free and always will be. If you would rather not do the work yourself, the Answer Kit covers Part 2 and Part 3, the Foundation covers Part 1 and Part 4, and AEO Standard Certified audits all six and proves the result.
Or have it audited, done, and certified.
Everything above is free to adopt on your own. If you would rather have the people who wrote the Standard check every requirement, close the gaps, and certify the result, that is AEO Standard Certified. One practice per market, scoped on a call, with a badge and a public listing to show for it.
What this standard will never ask you to do.
A specification is defined as much by its refusals. These are not gaps waiting to be filled in version 2. They are commitments.
Nothing in this document can be satisfied by buying anything. If a requirement ever could be, it would not belong in a standard about whether a machine should trust you.
Purchased links are a search-era tactic that aged badly and never had much to do with how answer engines pick sources. Part 4 asks for corroboration you earned, which is a different thing entirely.
Reviews and testimonials sit under rules that differ by board, by bar, and by registration, and in some cases forbid them. No requirement here depends on one, and none ever will.
It is a proposal, not a standard, and no major engine has committed to reading it. Publishing one costs you nothing and may prove useful later. Being sold one as a deliverable should worry you.
Nine hundred neighborhood pages is not Part 2. Part 2 asks for the questions you actually get, answered once, well, by somebody qualified to answer them.
Every requirement is written to be done in-house. We built the standard around what we do because that is what we know, not to leave a gap only we can close.
Version 1.0, published July 20, 2026.
Reviewed annually, and sooner when engine behavior or a regulatory rule shifts materially. Requirement numbers are permanent and never reused. A requirement that stops applying is marked withdrawn rather than deleted, so a citation stays readable. Clarifications bump the minor version; a change that alters what conformance means bumps the major version and says so at the top.
Use it. Quote it. Send it to whoever maintains your site. If you meet every Must, you may say your practice is built to the AEO Standard v1.0. Attribution is appreciated and not required, and there is no logo to license. Cite it as: The AEO Standard for Regulated Practices, v1.0, AEOptim, 2026, aeoptim.com/standard.
Write to human@aeoptim.com and cite the requirement number. Corrections, better wording, a rule we got wrong for your state, a requirement you think does not earn its place: all useful. Revision notes credit the people who send them. We would rather fix a requirement in 1.1 than defend it.
This document is general information about publishing and structured data. It is not legal, medical, or investment advice, it creates no professional relationship, and no citation, ranking, or outcome is promised by following it.
Reasonable questions about a free specification.
Can I use this without hiring AEOptim?
Do I have to meet all forty-nine requirements?
Can I say my practice conforms to the standard?
Why publish this instead of keeping it internal?
Does this replace SEO?
Is Part 5 legal or compliance advice?
How often will the standard change?
What if I think a requirement is wrong?
Who is this written for?
Want to know where you stand against it?
The free check reads your practice the way an engine does and tells you which parts of the standard you already meet. No call required, and if the record is clean we will say so.
Run your free check →Adopting it yourself? Tell us how it goes: human@aeoptim.com