Build pillar · review-response agent
How to build per-location AI review-response drafting at multi-location scale
BirdEye + Podium + ReviewTrackers + GatherUp + Reputation.com + Trustpilot + Yotpo + Bazaarvoice ship per-account flat review-response primitives. The Triage + Draft + Gate + Audit skill bundle on the review-response agent sits above 10+ review platforms (Google Business Profile + Yelp + Tripadvisor + Facebook + Apple Maps + Bing Places + Healthgrades + Vitals + Zocdoc + Avvo) and writes a per-response canonical record with named regulatory anchors covering FTC Fake Review Rule 16 CFR Part 465 + Google Business Profile prohibited content + Yelp Content Guidelines + HIPAA Privacy Rule when MedicalBusiness + ABA Model Rule 7.1-7.5 when legal + FINRA 2210 when financial + state bar advertising + EU AI Act Article 50 AI-disclosure.
Published September 26, 2026 · 3,200 words
The 4-skill bundle on the review-response agent
One agent. Four coordinated skills. The Triage + Draft + Gate + Audit bundle runs above the review-management surface (BirdEye + Podium + ReviewTrackers + GatherUp + Reputation.com + Trustpilot + Yotpo + Bazaarvoice) and the 10+ review platforms and writes one canonical per-response record.
Triage
Per-platform + per-vertical + per-star-tier + per-sentiment + per-urgency-tier + per-claim-type + per-required-disclosure + per-language + per-locale + per-fairness-doctrine-overlap classification. Per-vertical MedicalBusiness + Physician + Dentist + Pharmacy + Hospital + LegalService + FinancialService + Restaurant + Retail + Service applicability of HIPAA / ABA / FINRA / state bar / state medical board.
Draft
3 candidate responses per review generated by per-vertical brand-voice-tuned LLM (zero-retention + voice-attribute canonical from sibling-skill handoff at /how-to-build-voice-attribute-extraction-for-brand-voice- canonical). Per-vertical compliant by construction (no PHI markers when MedicalBusiness + no fiduciary-commitment when FinancialService + no scope-of-representation when LegalService + per-platform character limit + per-platform tone). Per-platform disclosure language labeled.
Gate
5 anchors per candidate before any platform API call commits. FTC Fake Review Rule + per-platform review-platform TOS + per-vertical regulatory anchor (HIPAA Privacy Rule + ABA Model Rule + FINRA 2210 + SEC Regulation FD + state bar + state medical board) + FTC Endorsement Guides + EU AI Act Article 50 transparency disclosure + per-vendor LLM zero- retention.
Audit
Per-response WORM canonical record: original review snapshot + triage classification + per-platform metadata + per-vertical applicability + 3 candidate responses + selected response + gate-pass per-anchor + selected disclosure + AI-generation- provenance-chain + platform-publish-confirmation + per- platform-review-policy-version-at-publish-time. Retention: 7-year FTC + 6-year HIPAA + 7-year state bar + 6-year SEC + 3-year FINRA + 7-year state medical board + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.
The real ecosystem this sits above
Triage + Draft + Gate + Audit does not replace the review platforms or the review-management vendors. It sits above them, coordinates them, and writes one canonical per-response record with named regulatory anchors.
Per-platform review surface
- Google Business Profile review API
- Yelp Fusion API + Tripadvisor Content API
- Facebook Pages reviews + Apple Maps Business
- Bing Places + Healthgrades + Vitals + Zocdoc + Avvo
- Trustpilot + Yotpo + Bazaarvoice + PowerReviews + Stamped
Review-management surface
- BirdEye + Podium + ReviewTrackers + GatherUp
- Reputation.com + Reputation Defender + Womply
- Grade.us + Swell + Broadly + Localworks + Yext Reviews
- Bright Local + Synup + Moz Local + LocaliQ
- ReviewBuzz + ReviewInc + Five Star Reputation
LLM + moderation stack
- OpenAI GPT-4o + Anthropic Claude + Google Gemini
- Mistral + Meta Llama brand-voice-tuned draft generation
- Persado + Phrasee + Jasper + Writer + Copy.ai
- spaCy + NLTK + VADER + RoBERTa + DistilBERT sentiment
- Microsoft Content Moderator + OpenAI Moderation
Compliance overlay
Five anchors run before any per-response publish decision commits. The first anchor is operationally distinctive to AI review-response drafting: HHS OCR has settled multiple cases against healthcare providers who responded to patient reviews with statements that identified the patient relationship, treatment, or condition. HIPAA-Privacy-Rule-in-review-response is the operationally distinctive surface this skill must gate.
Anchor 1: HIPAA Privacy Rule + ABA Model Rule + FINRA + per- platform review-platform TOS (operationally distinctive)
HIPAA 45 CFR 164.502 + 504 + 514 Privacy Rule + 164.308 administrative safeguards + 164.312 technical safeguards (no- PHI-in-review-response when MedicalBusiness + Physician + Dentist + Pharmacy + Hospital responds to patient review — no patient-name + no patient-relationship-identification + no condition + no treatment + no appointment ID + Safe Harbor de- identification). HHS OCR enforcement (multiple $25k-$1M settlements). ABA Model Rule 7.1-7.5 when LegalService (preserve attorney-client privilege + duty-of-confidentiality + 50-state bar advertising matrix). FINRA Rule 2210 when FinancialService (no efficacy/result/comparison/testimonial without substantiation). SEC Regulation FD when public-company IR review response. State medical board + state professional licensing review-response rules. Google Business Profile prohibited content (no AI-generated fake + no fake responses + no off-topic + no business-owner-impersonation). Yelp Content Guidelines (no business-owner-soliciting-positive + no incentivized + no fake). Apple Maps Business reviews + Facebook Pages reviews + Tripadvisor Content Integrity Policy + Healthgrades + Vitals review policy + per-platform TOS.
Anchor 2: FTC Fake Review Rule + Endorsement Guides + claims substantiation
FTC Fake Review Rule 16 CFR Part 465 (effective October 2024 + $51,744 per-violation civil penalty + no-AI-generated-fake- reviews + no-undisclosed-employee-response + no-suppression- of-negative + no-incentivized-without-disclosure + no- business-owner-impersonating-customer). FTC Endorsement Guides 16 CFR Part 255 (material-connection disclosure when response acknowledges paid relationship). FTC Act Section 5 + Pfizer 1972 substantiation when response asserts efficacy / results / comparison. FTC MARS (Made-in-USA in response). FTC Health Products Compliance Guide. FTC Negative-Option + ROSCA + Click-to-Cancel when response references subscription. CFPB UDAAP when consumer-finance review response. State UDTPA + Lanham + Robinson-Patman.
Anchor 3: EU AI Act Article 50 transparency + AI-generated disclosure
EU AI Act Article 50 transparency for AI-generated content (when AI-generated response disclosure obligation). EU AI Act Article 13 + 14 + 15 + Annex III high-risk when AI-ML scoring drives publish/block routing. Digital Services Act Article 30 + DMA. Per-platform AI-disclosure (Trustpilot Business Reviewer Code + Yotpo Reviewer Verification + Bazaarvoice Authenticity Guidelines). Tennessee ELVIS Act 2024 + 11-state deepfake regulation matrix when response uses AI-generated voice / image / likeness of identifiable person.
Anchor 4: Privacy + per-platform processing
GDPR Article 6 + 7 + 9 special category when health-review- response + Article 17 + 22 automated decisions + Article 28 data processor + Article 30 records. CCPA + CPRA + COPPA + 18-state comprehensive privacy. LGPD + DPDP + PIPEDA + Quebec Law 25. Per-vendor LLM zero-retention verified per call. Per- platform API rate-limit honoring. Per-source DPA.
Anchor 5: AI governance + security framework
NIST AI Risk Management Framework. ISO 42001 AI Management System. ISO 27001. SOC 2 Type II. Policy-as-code via OPA Rego + AWS Cedar + Casbin + Cerbos + Oso + Styra DAS + Permit.io. Storage: AWS S3 Object Lock + Azure Blob immutable + Google Cloud Storage Bucket Lock + Wasabi WORM.
6-workstream reporting cycle
Every two weeks during a Tier 3 Fractional CMO engagement, six workstreams report against the pre-engagement baseline. No forecast accuracy claims. Process commitments only.
- 1. Per-platform per-location review-surface coverage. Platforms monitored per location + per-platform review volume + per-platform response-rate baseline.
- 2. Triage classification distribution. Per-platform per-vertical per-star-tier per-sentiment per- urgency-tier per-claim-type distribution + AI-disclosure- obligation frequency + HIPAA/ABA/FINRA applicability frequency.
- 3. Draft-candidate generation flow. Per-platform candidate generation volume + brand-voice canonical applied per locale + voice-attribute drift detection from sibling-skill handoff.
- 4. Gate-pass/gate-fail distribution. Per-anchor gate-fail rate + per-vertical anchor breakdown + per-anchor remediation cycle time + HIPAA-Privacy-Rule near- miss tracking.
- 5. Regulatory-defense audit coverage. FTC Fake Review Rule + Google Business Profile prohibited content + Yelp Content Guidelines + HIPAA Privacy Rule + ABA Model Rule + FINRA 2210 + state bar + state medical board + EU AI Act Article 50.
- 6. FBC feedback-loop pattern-learning. Per-platform per-vertical rejection-pattern learning + multi- arm-bandit regret + recalibration applied + per-vertical pattern shifts + platform-review-policy-update impact retrospective.
FAQ
- What is per-location AI review-response drafting — and what is the HIPAA-PHI-in-review-response settlement problem that distinguishes this from generic review reply?
- A multi-unit franchise + multi-location service brand operator (gym + beauty + food + fitness + home service + healthcare + legal + financial) running 50-500 locations gets reviews on 10+ platforms — Google Business Profile + Yelp + Tripadvisor + Facebook Pages + Apple Maps Business + Bing Places + Healthgrades + Vitals + Zocdoc + Avvo + Trustpilot + Yotpo + Bazaarvoice + Tripadvisor. The four-skill bundle on the review-response agent — Triage, Draft, Gate, Audit — sits above the 10+ platform review surface and writes a per-response canonical record. The operationally distinctive anchor: HIPAA 45 CFR 164.502 + 504 + 514 Privacy Rule when MedicalBusiness/Physician/Dentist/Pharmacy/Hospital responds to a patient review. HHS OCR has settled multiple cases ($25k-$1M+) against healthcare providers who responded to negative patient reviews with statements that identified or confirmed the patient relationship, treatment, condition, or appointment. A response saying “We are sorry your visit last Tuesday did not meet expectations — we have your records on file” identifies that the reviewer was a patient. That is a PHI disclosure without authorization. Generic AI-generated review reply does not solve this. The Gate skill blocks any response that identifies patient relationship + condition + treatment + appointment + visit date before it ever reaches the platform API.
- Why do BirdEye + Podium + ReviewTrackers + GatherUp + Reputation.com + Trustpilot + Yotpo + Bazaarvoice break at multi-location 10+-platform compliance scale?
- Each review-management vendor ships a per-account flat response primitive — a location manager sees a review, types a reply or accepts an AI suggestion, the platform publishes. None triages per-platform per-vertical urgency + sentiment + claim-type (medical patient identification + legal client-relationship disclosure + financial fiduciary commitment + scarcity claim + efficacy claim + comparison claim + negative sentiment escalation + 1-star vs 2-star vs 3-star). None drafts with per-platform-required disclosure (Google Business Profile owner-response identifier + Yelp business-owner reply badge + Trustpilot Business Reviewer Code + Yotpo Reviewer Verification + Bazaarvoice Authenticity Guidelines + EU AI Act Article 50 AI-generated disclosure). None gates per-vertical (HIPAA Privacy Rule + ABA Model Rule 7.1-7.5 + FINRA Rule 2210 + SEC Regulation FD + state bar + state medical board + state professional licensing) before any response commits. None enforces FTC Fake Review Rule (no-AI-generated-fake-response + no-business-owner-impersonating-customer + no-incentivized-without-disclosure). None writes a per-response audit trail with regulatory-defense retention. The four-skill bundle Triage + Draft + Gate + Audit sits above the review-management surface — it does not replace it.
- How does Triage + Draft work across 10+ platforms and per-vertical?
- Triage runs per-portfolio per-banner per-location per-platform per-review per-attribute classification: per-platform (Google + Yelp + Tripadvisor + Facebook + Apple Maps + Bing + Healthgrades + Vitals + Zocdoc + Avvo + Trustpilot + Yotpo + Bazaarvoice) + per-vertical (MedicalBusiness + Physician + Dentist + Pharmacy + Hospital + LegalService + FinancialService + Restaurant + Retail + Service) + per-star-tier (1 + 2 + 3 + 4 + 5) + per-sentiment (positive + neutral + negative + mixed + sarcasm + sentiment-shift) + per-urgency-tier (legal-threat + media-mention + viral-risk + reputation-risk + standard + complimentary) + per-claim-type (medical + legal + financial + safety + harassment + discrimination + accessibility + price + scarcity + product + service) + per-required-disclosure (HIPAA Privacy Rule applicability + ABA Model Rule applicability + FINRA applicability + state bar applicability + state medical board applicability + AI-disclosure obligation) + per-language + per-locale + per-fairness-doctrine-overlap. Draft routes the triaged review to a per-vertical brand-voice-tuned LLM (per-vendor zero-retention + per-platform voice-attribute snapshot from /how-to-build-voice-attribute-extraction-for-brand-voice-canonical sibling skill) and generates 3 candidate responses per review. Each candidate is per-vertical compliant by construction (no PHI markers when MedicalBusiness + no fiduciary-commitment when FinancialService + no scope-of-representation when LegalService + per-platform character limit + per-platform tone) and labeled with per-platform disclosure language.
- What does Gate + Audit do?
- Gate runs 5 anchors per response candidate before any platform API call commits. (1) FTC Fake Review Rule + Google Business Profile prohibited content + Yelp Content Guidelines + per-platform review-platform Terms of Service. (2) Per-vertical regulatory anchor: HIPAA 45 CFR 164.502 + 504 + 514 + 308 + 312 when MedicalBusiness/Physician/Dentist/Pharmacy/Hospital (block any patient-identifying language + visit date + treatment + condition + appointment ID + Safe Harbor de-identification rules); ABA Model Rule 7.1-7.5 when LegalService (preserve attorney-client privilege + duty of confidentiality + 50-state bar advertising matrix); FINRA Rule 2210 when FinancialService (block efficacy/result/comparison/testimonial); SEC Regulation FD when public-company IR; state medical board + state professional licensing when professional service. (3) FTC Endorsement Guides + FTC Act Section 5 + Pfizer 1972 substantiation when response asserts claim. (4) EU AI Act Article 50 transparency disclosure when AI-generated response. (5) Per-platform-required disclosure + per-vendor LLM zero-retention. Audit writes a per-response WORM canonical record: original review snapshot + triage classification + per-platform metadata + per-vertical applicability + 3 candidate responses + selected response + gate-pass per-anchor + selected-disclosure-language + AI-generation-provenance-chain + platform-publish-confirmation + per-platform-review-policy-version-at-publish-time. Storage: AWS S3 Object Lock + Azure Blob immutable + Google Cloud Storage Bucket Lock + Wasabi WORM. Retention stacks (longest applicable): 7-year FTC + 6-year HIPAA (retention of communications about PHI) + 7-year state bar + 6-year SEC + 3-year FINRA + 7-year state medical board + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.
- What does this skill connect to on the review-response agent and across the swarm?
- On the review-response agent: review-response (parent commercial pillar) + per-location per-platform review monitoring + review-volume-analytics + review-velocity-detection + review-sentiment-trending. Across the swarm: voice-attribute extraction for brand-voice canonical (sibling build-pillar at /how-to-build-voice-attribute-extraction-for-brand-voice-canonical — upstream brand-voice source) + brand-voice management + forbidden-phrase library + claims-allowlist substantiation + tiered pre-filter deterministic gates for AI content compliance (sibling build-pillar at /how-to-build-tiered-pre-filter-deterministic-gates-for-ai-content-compliance — same Tier-1 deterministic gates substrate) + per-jurisdiction compliance multi-state franchise + master-record + per-location dynamic content + cs-agent-assist + chat-deflection compliance. Build-pillar siblings: per-platform compliance gating for social posts (#564 — same FTC Endorsement Guides + Fake Review Rule substrate) + marketing AI autonomy profile configuration + per-location per-cohort two-sigma anomaly detection. Commercial-pillar parent: /review-response.
- What does the 6-workstream pre-engagement-baseline reporting cycle look like for this skill?
- Every two weeks during the Tier 3 Fractional CMO with AI Swarm engagement, six workstreams report against the pre-engagement baseline. Workstream 1: per-platform per-location review-surface coverage — which 10+ platforms are monitored per location + per-platform review volume + per-platform response-rate baseline. Workstream 2: triage classification distribution — per-platform per-vertical per-star-tier per-sentiment per-urgency-tier per-claim-type distribution + AI-disclosure-obligation frequency + HIPAA/ABA/FINRA applicability frequency. Workstream 3: draft-candidate generation flow — per-platform candidate generation volume + brand-voice canonical applied per locale + voice-attribute drift detection from sibling-skill handoff. Workstream 4: gate-pass/gate-fail distribution — per-anchor gate-fail rate + per-vertical anchor breakdown + per-anchor remediation cycle time + HIPAA-Privacy-Rule near-miss tracking. Workstream 5: regulatory-defense audit coverage — FTC Fake Review Rule + Google Business Profile prohibited content + Yelp Content Guidelines + HIPAA Privacy Rule + ABA Model Rule + FINRA 2210 + state bar + state medical board + EU AI Act Article 50. Workstream 6: FBC feedback-loop pattern-learning — per-platform per-vertical rejection-pattern learning + multi-arm-bandit regret + recalibration + per-vertical pattern shifts + platform-review-policy-update impact retrospective.
Engage Completions
Two ways to engage. The Tier 1 AI Readiness Assessment maps the review-management substrate + 10+-platform review surface + per- vertical compliance surface against the Triage + Draft + Gate + Audit bundle. The Tier 3 Fractional CMO with AI Swarm embeds 1-2 days per week for 6+ months and runs the bundle end-to-end against the review-response agent across the swarm.
Related reading
- Parent commercial pillar: review response
- Sibling build-pillar: voice-attribute extraction for brand- voice canonical (upstream brand-voice source)
- Sibling build-pillar: per-platform compliance gating for social posts (same FTC Endorsement + Fake Review substrate)
- Sibling build-pillar: tiered pre-filter deterministic gates for AI content compliance
- Sibling build-pillar: per-jurisdiction compliance for multi-state franchise
- Fractional CMO with AI Swarm
- AI Readiness Assessment