Corporate reputation crisis: a search-first plan
A corporate reputation crisis is also a search and AI-answer problem. Build the public record, sync it with disclosure clocks and watch what people find.
A corporate reputation crisis is a moment when something true, disputed or false about a company reaches customers, investors, staff and journalists faster than the company can explain it, and the first place most of them check is a search box or an AI assistant. The plan that works treats the company's own pages, its regulatory filings and the results for its brand name as one public record, and keeps all three telling the same story.
Most guidance on corporate crises is about messaging: who speaks, in what order, with what tone. That matters, and it belongs to the crisis communications team. This guide covers the other half, the one that decides what a buyer, a bank, a recruit or an analyst sees when they type the company name an hour after the news breaks. It is about the brand search page, the pages you own, the answers AI assistants assemble from them, and the way disclosure duties set the pace.
Three limits first. Nothing here helps hide accurate, lawful, public-interest information about a company's conduct, and a plan that tries will fail and become a second story. Nothing here is legal advice: disclosure duties depend on the company, the country and the facts, and your counsel decides. And every rule quoted was read from its source for this guide, which we name, because rules and policies change.
- Publish one dated, plain-language crisis record page on a domain you own, and update it in public instead of issuing scattered statements.
- Let the legal and disclosure clocks set the order: what a regulator or the market must hear first is never first said in a social post.
- Check the brand search page and several AI assistants at fixed hours, trace every wrong claim to the page behind it, and fix the source before arguing with the answer.
- Correct what is false or outdated through each platform's own routes; never try to push down accurate coverage by fake content, fake reviews or pressure.
- Retire the crisis page only when the facts are closed and the search results show the resolution as well as the incident.
Sources: SEC Form 8-K instructions, GDPR Article 33, and Google Search Central's page on AI features, all read for this guide.
What a corporate reputation crisis looks like on the search page
A corporate crisis shows up on search in a predictable order, and that order is the reason to prepare before it happens. Within hours the brand name stops returning only the company website, its profiles and its reviews. News results, forum threads and social posts move in, and search suggestions begin to complete the brand name with the problem.
Related readBrand Ambassador Scandal: The First 24 HoursThree audiences read that page, and they want different things.
- Customers and partners look for whether the product, the service or the contract is safe to rely on today.
- Investors, lenders and analysts look for scale, cause, who was told, and whether management is in control.
- Staff, candidates and journalists look for conduct: what happened, who knew and what changed.
A company that answers only the first audience leaves the other two to read whatever ranks.
The seven places a company's crisis is written
Before choosing tactics, list every surface where the story is told and decide who writes each one. The table below separates what you control from what you can only influence.
| Surface | Who writes it | What you can do | Speed of change |
|---|---|---|---|
| Your crisis record page | The company | Everything: facts, dates, updates | Minutes to hours |
| Regulatory filings | The company, under legal rules | Content and timing within the rule | Fixed by the filing, then amendments |
| News coverage | Journalists | Supply facts, request corrections of errors | Hours to weeks |
| Brand search suggestions and related searches | Search engine systems | Influence by what people read; limited reports | Days to weeks |
| Social and forum threads | The public | Report rule breaks, reply once, calmly | Minutes, then fades unevenly |
| Review and rating sites | Customers and staff | Reply, dispute fakes under platform rules | Days |
| AI assistant answers | The assistant, from retrieved sources | Fix the sources; report errors to the provider | Varies by assistant and source |
Only the first two rows are yours; the rest is shaped by what they say.
Disclosure clocks decide what is said first
Start with the question of who must be told, because the answer sets the order of every public statement. A company that posts a reassuring message while a regulator or the market has not been told what the company knows creates a legal problem and a credibility problem at once.
Two examples show how the clocks work. They are examples, not a checklist, and many companies are subject to other rules.
A listed US company with a material cyber incident
The SEC's Form 8-K instructions say that a report under Item 1.05, material cybersecurity incidents, is to be filed within four business days after the company determines the incident is material. The same instructions say the materiality determination must be made without unreasonable delay after discovery. A narrow delay exists where the US Attorney General finds that disclosure poses a substantial risk to national security or public safety and notifies the Commission in writing; the initial delay can be up to 30 days, with possible extensions.
The instructions also separate furnished from filed information: a report furnished under Item 7.01, the Regulation FD item, is not deemed filed for the purposes of Section 18 of the Exchange Act unless the company says so. The text of Items 7.01 and 8.01 could not be read for this guide, so which item suits a particular public announcement is a question for securities counsel. Source: SEC Form 8-K.
Related readEcommerce reputation management: what to fix firstA company holding EU personal data
Article 33 of the GDPR says the controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. A late notice must give reasons for the delay. Notification is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. A processor must tell the controller without undue delay. The notice must describe the breach, give a contact point, explain likely consequences and describe measures taken, and it may be provided in stages. The controller must keep a record of every breach. Source: GDPR Article 33.
Article 34 adds a second audience. Where a breach is likely to result in a high risk to people's rights and freedoms, the controller must tell the individuals concerned without undue delay and in clear and plain language. The exceptions include data made unreadable by appropriate protection such as encryption, later measures that remove the high risk, and disproportionate effort, in which case a public communication must inform people just as effectively. Source: GDPR Article 34.
The search consequence is direct. A filing is itself a public document and is often quoted within hours. The company's own page should use the same facts, the same dates and the same words for numbers, so that no reader can find two versions of the incident.
Build one crisis record page, then keep it current
A crisis record page is a single URL on the company's own domain that states what happened, what is known, what is not yet known, what the company is doing and when the page will next be updated. It is not a press release and it is not a blog post. It is the page you want the search box, the assistant and the reporter to land on.
Related readFounder reputation affects company: separate or align- Pick a stable addressUse a short, descriptive path on the main domain, such as a statement or updates path, so the address does not change as the story does.
- Lead with the plain factsOpen with two sentences that stand alone: what happened, when it was found and who is affected. Quote-ready lines are the ones assistants and reporters will reuse.
- Separate known from unknownUse three short headings: confirmed, under investigation, what we will tell you next and when. Do not fill the unknown column with hopes.
- Date every updateAdd a dated log at the bottom and keep earlier entries. A page that rewrites itself silently reads as concealment.
- Tell people what to doCustomers, staff and partners need actions: change a password, check an invoice, call a number, ignore a message. Put them above the narrative.
- Make it indexable and readableKeep it in plain text, not a PDF image or a script-built panel, and link it from the home page and the footer so crawlers and people both find it.
- Name a contact for the pressPublish one channel for media questions that is actually monitored, so reporters do not build their story from forum posts.
Say only what is confirmed. An early claim later withdrawn does more damage than a short statement that more will follow, because the withdrawn claim stays in cached copies and in other people's articles. Fake refund forms and notices thrive when the real information is hard to find.
Match the plan to the type of crisis
Crisis type changes what searchers want, which owned asset helps first, and which mistake is most likely. The table covers six types. A company often has two at once.
| Crisis type | What searchers look for | First owned asset | Common mistake |
|---|---|---|---|
| Product failure or recall | Is it safe, what to do, refund or replacement | Action page with affected models and steps | A statement about values with no instructions |
| Data incident | Was my data taken, what to change | Dated record page tied to the notices sent | Saying "no evidence" before the work is done |
| Executive conduct | Who knew, what the board did | Short board or company statement with next steps | Defending the person before facts are in |
| Employee conduct or workplace claims | Culture, process, response | Statement of process and independent review | Attacking the people who raised it |
| Legal or regulatory action | The claim, the company position, the stage | Neutral page with the court or regulator reference | Calling the case meritless in the first line |
| False claim or rumor | Is it true, where did it come from | Evidence-led correction page with documents | Repeating the rumor in the headline |
Where the claim is false, the order is evidence first, then a correction request to the publisher, and only then platform or legal routes. Where the claim is true, no removal route works and none should. The work is the response, the fix and the record of both.
What AI assistants will say while the story moves
AI assistants do not hold an opinion about a company. They retrieve pages, summarize them and sometimes mix details. During a crisis three problems recur: an early version of the story gets repeated after the facts have changed, details from a different company with a similar name get blended in, and a single-source claim is given the same weight as a documented one.
Google's own page on its AI features gives useful limits. It says AI Overviews and AI Mode surface relevant links, may use query fan-out, which means issuing several related searches, and may show a wider range of links. A page needs to be indexed and eligible to be shown in Search with a snippet, and the page says there are no additional technical requirements, no special schema.org markup and no extra files. It also says indexing and serving are not assured. The controls it names for limiting what is shown are nosnippet, data-nosnippet, max-snippet and noindex. Source: Google Search Central, AI features.
Related readLayoffs and employer brand reputation: what stays publicSo the company cannot buy or code its way into an assistant's answer. It can keep an indexable, plain-text, dated page that states the facts, and correct the old wrong version at the source. Our page on what AI assistants say about you covers the audit side.
An answer audit for the first week
Run the same short prompt set in several assistants and in the search box at fixed times, twice a day for three days, then daily. Record the date, assistant, prompt, answer and pages cited.
- Ask what happened to the company, who is affected and what customers should do.
- Ask whether the company is safe to use or buy from.
- Ask who runs the company, and for its contact details, to test for scam copies.
Then trace each wrong or stale statement to the page behind it. If the source is a news article with a factual error, ask the publisher for a correction. If it is your own old page, update it. If it is an assistant error with no source, report it through the provider's channel. Never ask an assistant, or a vendor, to hide a documented fact: the attempt tends to be noticed, and an accurate answer will come back as the sources do.
A timeline from the first hour to day ninety
The windows below are typical for a mid-size company with a moderate crisis. A severe incident, an investigation or heavy coverage extends them. They are ranges from experience, not promises.
| Window | Search and AI work | Disclosure and legal work | Output |
|---|---|---|---|
| Hour 0 to 4 | Capture the brand search page and top assistant answers; reserve the record page address | Counsel confirms which duties and clocks apply | Evidence set; short holding line |
| Hour 4 to 24 | Publish the record page; fix errors on your own pages; check for scam copies | First filings or notices go out as required | Page matches filings word for word |
| Day 2 to 7 | Run the answer audit on schedule; request corrections for factual errors; update the page | Staged updates to regulators where allowed | One dated update log |
| Week 2 to 4 | Publish findings, fixes and customer actions; refresh outdated listings | Amend filings if the facts changed | Resolution pages that can rank |
| Month 2 to 3 | Check brand results, suggestions and assistant answers weekly; strengthen owned pages | Close regulator correspondence | Record page becomes a short archive |
A worked scenario: a data incident at a mid-size software company
This is an invented scenario with generic parties, written to show the order of operations. The assumptions are stated and none of the numbers refer to a real company.
Assume a business software company with customers in the United States and the EU. It is not listed. On a Tuesday morning its security team finds that an attacker accessed a support database holding customer names and work email addresses. No passwords or payment data were involved, as far as the first review can tell. Local press picks up a forum post by midday.
Related readLegal Dispute and Brand Reputation: A Company PlaybookHour 0 to 4. The communications lead takes screenshots of the brand search page, the news results and the answers from three assistants. Counsel confirms that the company is a controller for the EU data and that the 72-hour window under Article 33 applies where feasible. The web team reserves the address for the record page.
Hour 4 to 24. The company sends its first notice to the supervisory authority, noting that more information will follow in stages, which Article 33 permits. It publishes the record page with three headings: confirmed, under investigation, next update. The first two sentences name the affected data types and the date of discovery. Customers get a plain-language email with the same words. The page includes one action: be alert to messages that mention the support system.
Day 2 to 7. The answer audit finds that one assistant says the company "lost customer passwords", which no source supports. Tracing the claim leads to a forum post. The company cannot remove it, but it can state in the record page, in plain text, that passwords were not affected, as confirmed so far, and ask the one news site that repeated the claim for a correction, with the evidence. The scam check finds a lookalike domain offering "account recovery". The company reports it to the registrar and host and puts a warning on the record page.
Week 2 to 4. The investigation ends. The page now says what happened, what changed in the support system and how many customers were affected. Individuals at high risk are told as Article 34 requires. The company posts the final page and keeps the log.
Related readNew company online reputation with no reviewsMonth 2 to 3. Search suggestions still pair the brand with "breach" for some weeks. The company does not fight that. It keeps the resolution page prominent. By month three the assistants cite it alongside the older stories.
The lesson is the order: the regulator heard first, the page and the notice used the same facts, and nobody tried to remove an accurate article.
Fixing what is wrong without making the story worse
Corrections are legitimate when something is factually wrong, outdated or unlawful. They are a mistake when the target is an accurate report of what happened. The order below keeps the effort proportionate.
- Your own pages. Update the old statement, the FAQ, the status page and the profile descriptions. Many wrong answers trace back to a company page nobody updated.
- Publishers. Send the editor a short request naming the error, with proof. Ask for a correction, not removal.
- Platforms. Use each platform's own reporting route and cite the policy the post breaks.
- Search engine tools. For a page you do not own that has been deleted or substantially changed, Google's Refresh Outdated Content tool asks Google to update a result that still shows the old text. The tool page says it does not take a page off the web and does not apply while the content is still on the live page. Source: Refresh Outdated Content tool.
- Legal routes. For defamation, privacy or data protection claims, ask counsel.
All four are discoverable, break platform rules and give a journalist the next headline. The lawful alternative is accurate pages of your own that deserve to rank: the resolution page, the fix and credible coverage of how the company responded.
Knowing when the crisis is over in search
A crisis ends on the search page, not in the meeting room. These signals, checked weekly, tell you where you are.
- The brand name's first page shows the resolution or the current status as well as the incident.
- Search suggestions and related searches stop adding the problem word, or add it far less often. This can take weeks or months after the news cycle ends, and for a serious incident the older coverage may stay.
- Assistant answers cite the record page or other current sources and describe the incident in the past tense.
- No filing, notice or regulator question remains open that the page contradicts.
When those signals hold, convert the record page into a short archive with the facts, dates and outcome. Do not delete it: a reader who finds the incident later should find your account next to it.
For companies that want help running the monitoring and the owned-page work during the peak, reputation monitoring covers search and AI answers on a schedule, and Reputation Partners runs the search side alongside the company's counsel and communications team, not instead of them.
Next step: set the record page up before you need it
The cheapest hour in a crisis is the one spent before it. Draft a blank record page now, agree who can publish it, write down who owns each disclosure clock, and run the answer audit once on a calm day to set a baseline.
Related readPartner and supplier due diligence on your companyCapture the brand search page and the assistant answers today, then tell counsel what you have found and what clocks may be running. If you want a team to run the search and AI-answer side while your counsel and communications lead handle the rest, see our crisis desk.
Questions people ask
Should a company publish its own page or just post on social media?
Publish a page on your own domain and link to it from social posts. A social post is brief, can be removed from view by the feed, and rarely ranks for the brand name. A dated page can be quoted by reporters, indexed, read by assistants and updated without losing its history.
Can a company remove news coverage of a crisis?
Only if the coverage is wrong in a way the publisher accepts, or unlawful. Accurate reporting of real events is not removed for reputation reasons, and attempts to force it usually create more coverage. The workable routes are corrections, updates, a fuller response and, in some places, narrow legal claims that counsel assesses.
Do we tell the regulator or the public first?
Where a legal duty exists, the regulator or the market channel usually comes first or at the same time, and the public page follows with the same facts. The exact order depends on the company and the country. Ask counsel before the first post, and publish the page only once the filing or notice has gone out.
How long do brand search results stay damaged after a crisis?
It varies with the severity, the volume of coverage and what the company publishes. A minor incident can fade in weeks. A serious one can keep appearing in suggestions and older articles for months or longer. Accurate resolution pages, credible new coverage and steady monitoring usually shorten the period, but nobody controls it.
Should we ask AI assistants to forget a crisis?
No assistant keeps a file on your company that you can ask it to forget. Answers come from retrieved sources and from what a model learned, so the fix is at the source. Update your own pages, request corrections of factual errors, and report clear mistakes through the provider's feedback route.
Is a holding statement enough on the first day?
For a few hours, if it is honest and says when more will follow. After that it reads as silence, so replace it with the record page within a day.
