FTC AI Agent Investigation: The Product Claims, Logs, and Evals Your Team Must Have Ready for a Section 5 Inquiry
FTC AI agent investigation hits beyond big labs. Learn which Section 5 compliance logs, evals, and claim records your product team needs now.
TL;DR: As of September 30, 2026, the FTC's AI agent investigation requires your team to produce, for every public claim your product makes, a matching eval result, timestamped log, and documented escalation path proving that claim is accurate and not deceptive under Section 5. Map each marketing or UI assertion to its evidence before regulators ask, or risk enforcement action based on gaps you could have closed in advance.
Key Takeaways
- Section 5 reaches beyond frontier labs: any company making safety or accuracy claims about an AI agent feature can be pulled into an FTC inquiry.
- Claims must be backed by artifacts: every UI or marketing statement needs a matching eval result that existed before the claim went live.
- Deploying an agent keeps you liable: handing off a task to automation does not hand off legal responsibility to the model provider.
- A Claims-Evidence-Escalation (CEE) Register is your first defense: it demonstrates good faith concretely and in writing.
- Incident logs are not optional: silence in the logs looks like negligence to a regulator reviewing your record.
- Unsubstantiated safety language is the highest-risk category: "safe," "reliable," or "never" without documented evidence are exactly what regulators characterize as deceptive.
Introduction
On September 30, 2026, the FTC opened an investigation into OpenAI, Anthropic, METR, and other frontier labs over consumer harms and autonomous agent risk. Most coverage treats this as a big-lab story. It is not. Section 5 of the FTC Act prohibits deceptive trade practices by any company, including mid-market SaaS firms white-labeling foundation models and publishing their own safety claims. This article focuses on one concrete response: a Claims-Evidence-Escalation (CEE) Register, buildable in a week and designed to demonstrate good faith before a regulator asks.
Does the FTC's AI agent investigation actually apply to your product team?
A sales deck line like "our AI never hallucinates customer data" is a strong Section 5 candidate: no eval backs it, no log tracks it. If your UI or marketing contains "safe," "accurate," "reliable," or "never" next to an AI capability, your team should treat that as live exposure worth addressing now.
What specific claims trigger FTC Section 5 scrutiny, and which are defensible?
The table below is a practical classification framework used in this guide to help product teams triage their existing copy. It is author synthesis based on the verified FTC enforcement principles described in cited sources, not an externally measured or regulatory-issued taxonomy.
CEE Risk Classification Matrix, October 2026
| Claim type | Example | FTC risk level | What makes it defensible |
|---|---|---|---|
| Absolute safety assertion | "Our AI never hallucinates customer data" | Critical | Nothing; remove or qualify before publishing |
| Unanchored accuracy stat | "95% accurate" | High | Benchmark eval, stated test conditions, date |
| Relative performance claim | "More accurate than manual entry in our A/B test" | Medium | A/B test methodology, sample size, date |
| Qualified capability claim | "Designed to minimize errors; see eval report" | Low | Published eval artifacts, version-pinned |
| Aspirational or directional claim | "We're working to reduce hallucinations" | Low | Incident log showing active remediation |
How do you build a claims-vs-evidence register the FTC would accept?
Each row has three columns in this framework:
- Claim. The exact string as it appears in UI, docs, or marketing copy, with the version and date it went live.
- Evidence artifact. The eval result, A/B test report, red-team log, or third-party audit that substantiated the claim before it published. No artifact means the claim should come down.
- Escalation path. Who owns the claim, what threshold triggers review, who gets notified, and the remediation SLA.
The FTC does not expect perfection. It expects process. An agent that erred but triggered an internal alert and a documented response represents a fundamentally different legal posture than one that erred silently. Silence reads as negligence. Start by auditing every UI string, help doc, sales deck, and press release. That audit is time-consuming, and it is also where the most important gaps tend to surface.
What is a civil investigative demand?
A CID typically requests all internal communications about feature safety or accuracy, evaluation records, consumer complaint logs, and documents showing whether the company knew of risks before a claim published. A team that wrote "our agent is reliable" but ran no reliability eval has a discoverable claim and zero discoverable evidence.
What documents must your team have ready before a CID arrives?
The documents regulators request in a CID are exactly the ones most AI product teams have not built yet.
Three immediate actions to take before that moment arrives
- Audit all public-facing claims now. Pull every string containing "safe," "accurate," "reliable," "never," "always," or any percentage figure across UI copy, help documentation, sales decks, and press releases.
- Match each claim to an artifact or take it down. A CID arrives without warning; reconstruction under deadline is the harder path.
- Stand up production logging and a documented escalation path. Even a Slack-to-Jira pipeline capturing anomaly reports is a defensible starting point. What matters is that it existed before the demand arrived.
The CID is not the moment to start building evidence. It is the moment you find out whether the evidence you needed already exists.
Frequently asked questions
Q: Does the FTC investigation only apply to OpenAI and Anthropic, or can it reach my company?
Section 5 applies to any company making deceptive or unsubstantiated claims in commerce. If your marketing makes safety or accuracy claims about an AI agent feature, you are within the doctrine's reach regardless of whose model you use. f
Q: What is a civil investigative demand and how should my team prepare for one?
A civil investigative demand (CID) is a legally enforceable pre-lawsuit document request from the FTC; the strongest preparation is building your evidence trail before any demand arrives, not after. Teams should consult legal counsel immediately upon receipt of a CID, but waiting for that moment to begin documentation is the riskier path. The CEE Register framework described in this guide is designed to create that trail proactively.
Q: If I white-label an AI agent from a third-party vendor, does their safety documentation cover my product claims?
No. The vendor's documentation covers the vendor's claims. Your product-level assertions are yours under Section 5 and must be substantiated independently.
Q: What should an eval artifact include to support an accuracy claim?
In the author's view, a useful artifact includes at minimum: a defined test dataset, a stated success metric with numeric results, a date stamp showing the eval preceded the claim, and a named owner. The goal is to demonstrate that a real process produced the number before anyone published it, not that the number is perfect.
Conclusion
As of September 30, 2026, the FTC's investigation applies an established consumer protection doctrine to a category where marketing has consistently run ahead of evidence. The inquiry targets consumer harms and autonomous agent risk across the AI industry, and its reach extends to any company making unsubstantiated claims about AI agent behavior.
The CEE Register framework used in this guide communicates to a regulator that your team knew what your product could do, had evidence for every claim before it published, and maintained a documented process to catch gaps. That is what good faith looks like under Section 5. The most cost-effective compliance step an AI product team can take right now is a spreadsheet built this week, before a CID makes building one someone else's decision.
Learn from me
Agentic AI for Product Managers, my Maven cohort. Learn how to design, evaluate, and ship reliable AI systems: the technical fluency PMs need to lead agentic products, no engineering background required. Join the next cohort →
Hire us
Traversaal.ai. We're a team of forward deployed engineers solving the toughest AI problems for Fortune 100 companies: document intelligence, agentic data platforms, and real-time web intelligence, deployed in production. Work with our team to deploy your next agentic ecosystem. Talk to Traversaal.ai →
Join us
Want to solve these problems with us? We're always looking for forward deployed engineers who want to ship production AI. jobs@traversaal.ai
