There's a gap between what a business is in the real world and how an AI search system can verify it. The author calls this the "identity leak."
Businesses may not be struggling, but they may be invisible to AI systems, which decide what sites get recommended and surfaced to searchers.
An audit of 71 verified businesses on Prince Edward Island (PEI), Canada, spanning multiple industries:
| Finding | Figure |
|---|---|
| Average identity leaked to AI systems | 84% |
| Share with no AI-retrievable digital presence at all | 17% |
| Share of trust/retrievability requirements actually resolved | 15.6% |
An AI search retrieval system doesn't browse a website the way a person does. It looks for specific, verifiable facts: who runs a business, where it is, what it does, whether the people behind it are real.
When it can't find these, it guesses, using whatever fragments it can piece together from the web. Or it'll simply leave the business out of an answer entirely.
The gap between what's true about a business and what an AI can confirm is the identity leak.
The most common and most fixable version. Twenty-two of the 71 businesses had named, identifiable leadership somewhere on their own site.
In several cases that information lived on an "Our Team," "Our History," or "Our Family" subpage that a routine pass of the homepage by an AI missed.
The information is there, it's just not where the verification needs to be.
Several businesses had professionally built, real, modern-looking websites that returned zero extractable text to a direct fetch — built entirely in client-side JavaScript with no static fallback.
One was a software company whose own tagline promised "intuitive enterprise and AI systems." Its homepage was unreadable to the very system it claimed to be built for.
One well-known cheesemaker's domain is now for sale by a domain reseller, and a salt producer's domain returned nothing. The brand now survives only as a product line sold through another website. Neither showed up where a crawler was looking.
One chocolatier circulated under three different domain variants across directories, and a biotech company operated two separate live domains for the same entity.
Each fragment dilutes the others, and an AI system will try to resolve "who is this," finding competing, partial answers instead of one authoritative answer.
A photography studio, an HVAC contractor, a lumber yard, and an auto shop on the province's own vehicle-inspection registry — real, operating businesses existing only in third-party directory listings, with no actual sites for an AI system to verify against.
The identity leak isn't the result of bad business. It's the result of websites that were built for a different, older kind of reader.
In the past, a website's job was to be found by a search engine and read by a human who already had some context — a brand from an ad, a neighbour's recommendation, a local directory listing. Under those conditions, a website that looked good and loaded fast was doing its job, and AI readability wasn't a consideration.
Three technical issues explain most instances found:
1. Client-side rendering with no static fallback — if a page's content only exists after JavaScript executes, a retrieval agent parsing static HTML will never see it. This produced the worst results in the study: no content at all.
2. Real facts confined to pages nobody checked — named leadership, real history, and policy pages disproportionately lived on secondary pages rather than the homepage. A full re-verification pass caught most of these — evidence of how easy this gap is to miss and how real it is once you actually look.
3. No canonical source of truth — with identity split across domains, or a dead canonical domain alongside a living social presence, an AI system has no way to determine which source to trust. It often defaults to whichever third-party platform has invested the most in making that site verifiable.
In hotel and golf-resort accommodations, this showed up as third-party booking resellers ranking alongside or above the property's own booking page — a version of the leak with a direct commission attached.
71 verified businesses across food and beverage, retail, professional services, technology, agriculture, health care, accommodation and golf.
The author used a condensed E-E-A-T scoring framework, built around the same principles search engines have used for years, modified for how AI retrieval systems trust and extract information now, as a points-based diagnostic.
The full audit scores five categories totalling 500 points:
The condensed version scored against a fixed 485-point scale — the 500-point baseline minus 15 points reserved for Core Web Vitals, which required tooling the audit lacked. All businesses were scored against the same standard.
Additional checks:
This low-level AI retrievability check was designed so anyone could run it. It's not a deep technical audit of crawl budgets, structured data, or server infrastructure. A person with no technical background could perform every one by hand, with a browser, in under five minutes per business.
Results were independently rechecked in a full second pass.
If a basic check can find a gap this large, a business isn't falling behind because of a technical issue, but because nobody has looked at the problem.
1. Put a named person on the page — the most common fix across this study. Add a real "About the Owner," "Our Story," or "Our Team" page with an actual name, and if it already exists on a secondary page, link it from the homepage.
2. Server-render content that matters — any fully client-rendered site needs a static fallback for core facts (name, address, services, leadership), even if the interactive experience stays as-is for humans.
3. Pick one domain and commit to it — consolidate to a single canonical address and redirect everything else.
4. Confirm the domain is actually live — this sounds basic, but it wasn't for at least two businesses whose domains had quietly lapsed or been listed for resale without anyone noticing.
5. Add a real, linked policy page — privacy policies and terms of service are trust signals AI systems weigh, and weren't always present even among well-built sites.
6. Check whether a third-party reseller ranks near or above your own booking page — for any transactional path, make sure your direct route is at least as verifiable as theirs.
The businesses that scored best weren't the most resourceful or the most aggressive marketers. They were the ones with an institutional obligation to be transparent and therefore had to make their sites easily readable to systems.
A regulated care facility, a publicly accountable nonprofit, and a government-marketed asset with a dedicated general manager.
Closing the identity leak isn't expensive, and it isn't hard. It's mostly unknown and just a matter of businesses knowing how to look for it.
Run the five-minute self-check first. Does a direct fetch return text, is a real name on your own domain, is NAP consistent? No tooling needed.
Move the About page. 22 of 71 had the information and lost it to a subpage. Cheapest, highest-yield fix available.
Register JavaScript rendering as business risk. A company selling AI while being unreadable to AI was in this sample. Write static fallback into site rebuild requirements.
Monitor domain expiry. Two cases of a live brand with a resold domain appeared in this small sample alone.
Run the qualitative version too — The AI Entity Footprint Audit asks AI to explain your business directly.
Shift to an entity frame — see Entity SEO.
Local businesses should not add pages. As this audit shows, the problem is verifiability, not volume — Local SEO Isn't About More Pages.
The gap between what's true about a business and what an AI system can verify. AI retrieval looks for facts like who runs it, where it is and whether the people are real; failing that, it guesses from fragments or omits the business entirely.
Across 71 verified PEI businesses, the average leaked 84% of its identity and 17% had no AI-retrievable digital presence at all. The average business resolved only 15.6% of what it needs to be considered trustworthy and retrievable.
Client-side rendering with no static fallback (zero extractable text), real facts confined to secondary pages rather than the homepage, and no canonical source of truth when identity is split across domains and directories.
Put a named person on a homepage-linked page, server-render core facts, consolidate to one canonical domain with redirects, confirm the domain is live, add a linked policy page, and check whether third-party resellers outrank your own booking page.
Not the most aggressive marketers, but those with an institutional obligation to be transparent — a regulated care facility, a publicly accountable nonprofit, and a government-marketed asset with a dedicated general manager.
To apply what you just read to your own site, start with a free audit of where things are now.
A strategist replies within 24 hours on business days.
An E-E-A-T checker was never automatable because there is no API for it. Here is how an AI coding agent read Google's quality guidance, crawled a page sample, and produced a scored audit — plus where it stops.
A GEO audit is not checking whether your brand appears in an AI answer. Here is a nine-point GEO checklist split into four on-site items, four off-site, and one measurement layer.
LinkedIn, YouTube, Reddit, and TikTok are building systems to identify low-value AI content. Here are the limits of watermarking and what content still gets distributed.