What should the CMO authorise now?

Authorise a bounded compliance review alongside the visibility pilot—not an open-ended compliance retainer. Our suggested sequence is:

First: establish scope

• Assign legal/privacy, analytics and content owners.
• Inventory the proposed supplier’s activities and data inputs.
• Separate monitoring from implementation and publishing.
• Flag synthetic performers, review incentives, customer-level data and consequential decision uses.

Second: resolve evidence gaps

• Obtain the supplier’s access and data-processing explanations.
• Review performance claims against the actual test design.
• Verify California’s September chaptered legislation where relevant.
• Check Colorado’s court position and proposed rules if the use case may be covered.

Third: approve a controlled pilot

• Freeze the initial measurement specification.
• Require publication and disclosure approvals.
• Preserve exportable evidence and methodology changes.
• Set a review decision based on useful findings and execution quality—not guaranteed engine recommendations.

Bottom line: the strongest regulatory response is not to stop useful AI search research. It is to know what is being collected, what is being published, which rules apply, and what evidence supports the supplier’s claims.