No AI Exemption: What the FTC’s Investigation of Leading AI Developers Means for Your Business

The Federal Trade Commission’s expanding scrutiny of artificial intelligence carries a clear message for businesses: the adoption of AI does not suspend existing legal obligations. On September 30, 2026, an FTC spokesperson confirmed that the agency had opened an investigation into Anthropic, OpenAI, and other AI developers concerning the potential risks their technologies pose to consumers. The investigation intensified throughout October. On October 14, the Commission issued civil investigative demands to Anthropic and OpenAI seeking documents related to a series of reported AI safety incidents, and on October 26, it demanded testimony from Anthropic executives and indicated that additional companies will receive investigative demands at a later date. Anthropic has disclosed in its registration statement for its planned initial public offering that the demand it received concerns its privacy practices and the safety and security of its products.

No findings of wrongdoing have been made, and the investigation remains ongoing. Nevertheless, it raises significant questions about how AI products are developed, marketed, and deployed, and whether companies’ representations regarding safety, privacy, and performance accurately reflect how their systems operate in practice. For businesses that develop or use AI, the investigation underscores that AI governance is no longer merely a best practice; it is an essential component of legal and operational risk management.

Existing Consumer Protection Law Applies to AI

Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in or affecting commerce. The Commission has taken the position that this authority extends fully to AI products and services. In September 2024, for example, the FTC announced “Operation AI Comply,” a coordinated set of enforcement actions against companies alleged to have made false or unsubstantiated claims about AI capabilities, and stated that there is no AI exemption from existing law.

Accordingly, statements about an AI product’s capabilities, reliability, or safeguards must be truthful and adequately substantiated. This includes representations regarding how an AI tool collects and uses personal information, how it protects sensitive data, and how it reaches decisions. As AI systems become more complex and more autonomous, the burden of demonstrating that such claims are accurate grows correspondingly heavier. Describing a product as “AI-powered,” “beta,” or “experimental” does not insulate a company from regulatory scrutiny when that product causes harm or fails to perform as represented. Exposure is also not limited to the federal level: on October 14, 2026, the attorneys general of eight states filed separate but coordinated lawsuits against OpenAI under state consumer protection laws, alleging that the company misled users, including minors, about the safety of its chatbot. Separately, on October 23, 2026, the Texas Attorney General sued OpenAI and its chief executive officer under the Texas Deceptive Trade Practices–Consumer Protection Act, alleging that the company marketed ChatGPT as safe and reliable while failing to protect Texans, including children, from the risks of its use.

Implications for Businesses That Use Third-Party AI

The implications of this investigation extend well beyond AI developers. Companies that integrate third-party AI tools into their products, services, or internal operations must evaluate how those tools handle data, whether vendor representations are reliable, and how responsibility is allocated when something goes wrong. Recent reports of AI agents taking unauthorized actions on third-party systems illustrate that these risks are no longer hypothetical. AI-related exposure may arise from inadequate privacy protections, the unauthorized use or disclosure of confidential information, inaccurate or unreliable outputs, or a failure to maintain appropriate human oversight.

For these reasons, AI vendor agreements warrant careful review. Particular attention should be given to provisions addressing data use and retention, security obligations, incident notification, intellectual property rights, indemnification, and limitations of liability. As regulatory scrutiny increases, businesses should be prepared to demonstrate not only that they adopted AI responsibly, but also that they took meaningful, documented steps to identify and manage the associated risks.

Acting Before Regulators Do

Businesses should not wait for new legislation or a regulatory inquiry to evaluate their AI practices. A comprehensive AI governance program can establish clear rules for the use of AI, safeguard sensitive information, address vendor-related risks, and ensure that employees understand their responsibilities. Equally important is a clear understanding of how existing laws governing privacy, consumer protection, intellectual property, and data security apply to AI-enabled products and services.

Our firm assists businesses in navigating these evolving legal challenges through the development of practical AI governance policies, the review and negotiation of technology agreements, and regulatory counseling. Our goal is not to discourage the adoption of AI, but to enable businesses to innovate with confidence while effectively managing the legal risks that accompany it.