How a regulated Australian business markets itself within its rules, and which regulator pages a researcher can actually open

Five decisions, settled once and written down, cover most of it. Who signs off a claim before it publishes. Which claims you will not make at all. Where the rule you are answering to is stated on the page. What happens to a customer list and who may touch it. And whether a piece goes for external review before it runs. A regulated Australian business with those five written down publishes faster than one without them, because the uncertainty rather than the rule is what slows everything down.

Nothing on this page is legal advice. A specific question about your own obligations belongs with an Australian lawyer, and what follows is the commercial decision structure that sits in front of that conversation.

The five decisions

1. A named sign off, with a deadline. One person, not a committee, with a stated turnaround. A committee with no deadline is how a regulated business stops publishing.
2. A refusal list. The claims you will never make, written down, so nobody has to relitigate them. This is the highest value document in a regulated marketing function.
3. The rule, on the page. Where a claim rests on a requirement, state it and name where it came from. This is a credibility asset rather than a chore, and it is also what the engines read.
4. A data position. Where personal data sits, who may reach it, and what happens when it goes to a supplier. The engines in our own Australian audit reached oaic.gov.au in 6 of 64 readings.
5. An external review trigger. One sentence saying which kinds of piece go out for review, so it is a rule rather than a judgement call every time.

Which Australian regulators the engines actually reach for

This is the part that turns compliance into a visibility asset. On 22 October 2026 we put 33 batches of buying questions to ChatGPT and Gemini with Australia written into the text of each one, because the search interface we use accepts country, language and location parameters and ignores all three. The snapshot taken that evening holds 64 blind readings, 32 per engine, returning 1,010 distinct hosts.

Sixty six distinct Australian government hosts appeared 139 times across 25 of the 64 readings. business.gov.au in 15, accc.gov.au in 13, acma.gov.au in 8, oaic.gov.au in 6, legislation.gov.au in 5, business.qld.gov.au in 5, nsw.gov.au in 4, consumer.gov.au in 4, buy.nsw.gov.au in 4, service.nsw.gov.au in 3, ato.gov.au in 3, ai.gov.au in 3, asic.gov.au in 2. Health practitioner regulators, the therapeutic goods regulator, the workplace regulator, the product safety site and the statistics agency each appeared once or twice.

So when a buyer in a regulated Australian sector asks a buying question, the engines hand them the regulator's page and then look for a supplier who visibly answers to it. A page that states the rule and what you do about it is a stronger candidate than one that avoids the subject, which inverts the usual instinct in regulated marketing.

What we could and could not read, which affects how you research this

Fetched on 22 October 2026 with every response recorded. asic.gov.au returned HTTP 200 and is quoted on this site. accc.gov.au returned HTTP 403 on two separate guidance paths, each a short Access Denied page carrying an edge provider reference. legislation.gov.au returned HTTP 200 at 1,358,447 bytes carrying the arrangement of provisions and no provision text. The advertising standards body's code page returned HTTP 403 with a browser challenge body, and an industry association's codes page returned HTTP 404 while serving 473,318 bytes of fully styled page.

A 403 on one date under one agent records what a server did rather than a policy, and we report it as a reading. The operational point for a regulated business is sharper: the primary guidance for Australian claims is harder to reach than it looks, which is exactly the condition in which secondary summaries circulate unchecked. Read the regulator's own page in a browser before relying on anybody's summary of it, including ours.

What to publish instead of what you cannot publish

What a regulated business often wants to say	What to publish instead
A performance figure stated as typical	One dated case with the window, the conditions and the starting position
A comparison against unnamed competitors	A criterion a reader can check, with the count and the date
A superlative about the firm	The specific licence, registration or qualification, named and verifiable
Nothing, out of caution	The rule, what it requires, and what your process does about it

The bottom row is the one that pays. A regulated business that publishes the rule rather than tiptoeing around it becomes the page the engines reach for, and it costs nothing beyond the sign off you already decided on.

Questions about marketing a regulated business in Australia

Do we need everything pre approved externally

Write a narrow trigger for external review and handle the rest with your named internal sign off. A blanket external review policy produces a backlog rather than compliance.

Who is responsible if our agency writes a non compliant claim

The advertising carries your name, so settle it in the contract and put a named reviewer on your side. Cheaper than any dispute.

Can we use customer testimonials

Treat the connection question first. If anything of value moved, the connection is disclosed. Our page on what a recommendation page has to disclose, quoted from a regulator's own advice works through where the label goes and the wording that fails.

What about electronic messages to customers

The communications authority appeared in 8 of our 64 readings, which is the deepest single non general regulator signal in the set, so treat messaging compliance as a first order question rather than an operational detail and take it to a lawyer.

How do we verify a supplier in a regulated sector

ASIC's Banned and Disqualified search is free and covers six registers at once, and in ASIC's own words it is a good idea to check people and organisations before you deal with them. Also search its separate court enforceable undertakings register, because ASIC states that people who give one will not always appear on the banned and disqualified registers.

The reading that should change how you research your own obligations

Four of the five Australian sources a regulated business would naturally consult did not answer an ordinary request on 22 October 2026. The consumer regulator returned HTTP 403 on two separate guidance paths, each a short Access Denied page carrying an edge provider reference. The tax office returned the same. The advertising standards body returned HTTP 403 with a browser challenge body. An industry association's codes page returned HTTP 404 while serving 473,318 bytes of fully styled page. Only the corporate regulator answered, at HTTP 200, and the statute register answered with a table of contents at 1,358,447 bytes. Those are readings of what those servers did on that date rather than statements of policy, and the operational consequence for a regulated business is sharp: open the regulator's page in a browser yourself before relying on any summary of it, including this one. Meanwhile the engines reached those same hosts constantly, 66 distinct government hosts 139 times across 25 of our 64 readings, which means your buyer is being shown material you may find harder to reach than they do. AI Knows Us shows which sources sat behind each answer about your category, across ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews, and in our own reading we were behind none of them.