The Federal Trade Commission (FTC) The American company confirmed the September 30, 2026 the opening of a investigation targeting OpenAI, Anthropic , and other companies in the artificial intelligence sector. Sound The exact scope has not yet been made public, But the process is taking place at a time when models are becoming increasingly integrated into agents capable of accessing the Internet, to use tools and take action in external environments. The central question, therefore, is not whether an AI can be held legally liable, but rather to determine what responsibilities providers, integrators, and organizations must assume when their systems cause or facilitate harm.
What the FTC Actually Confirmed
The FTC confirmed to the Associated Press that it is investigating OpenAI, Anthropic, and other AI companies regarding potential risks to consumers. According to available information, the investigation has been underway for several months. As of October 6, 2026, OpenAI and Anthropic are the only two companies that have been publicly identified.[1][2]
This confirmation remains limited. No public document has yet specified the products under review, the incidents in question, the requests made to the companies, or the legal theory being considered. It is therefore not possible to assert that the investigation focuses exclusively on autonomous agents, even though the behavior of systems capable of using the Internet and external tools forms the immediate context of the announcement.
An investigation is neither an accusation, nor a court ruling, nor proof that a company has violated the law. It may be closed without charges being filed, lead to a settlement, or result in legal proceedings. This distinction must remain clear in any analysis of the case.
Why AI Agents Are Changing the Scale of Risk
A conversational model primarily generates a response. An agent links this model to a memory, applications, a browser, APIs, or a computing environment. It can search for information, fill out a form, edit a file, send a message, or trigger an operation, within the limits of the permissions granted to it.
The key change comes from moving from recommendations to action. An error embedded in a sequence of operations can propagate before a human notices it. The risk then depends on the model, permissions, tools, and mechanisms available to stop or reverse the action.
The key change comes from moving from recommendations to action. An error embedded in a sequence of operations can propagate before a human notices it. The risk then depends on the model, permissions, tools, and mechanisms available to stop or reverse the action.
Behavior does not stem solely from the model, but also from instructions, permissions, and interfaces. Responsibility must therefore be analyzed at the level of the entire system.
What the FTC Can Investigate Under Existing Law
In particular, the FTC enforces Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive trade practices. A deceptive practice may result from a false or unsubstantiated statement, or from a material omission likely to influence the consumer. An unfair practice involves, among other things, substantial harm that the consumer cannot reasonably avoid and that is not offset by benefits to consumers or competition.[3][4]
In the case of an AI agent, several questions may fall under this framework. Does the provider accurately describe the service’s level of autonomy, limitations, and risks? Do the promises regarding security or human oversight align with how the service actually operates? Is the data used in accordance with the stated commitments? Are the safeguards proportionate to the foreseeable consequences of an error?
In July 2026, the FTC issued a draft policy statement on the accuracy of AI systems for public comment. The document notes that companies may violate Section 5 when they market a system in a manner inconsistent with the reasonable expectations created among consumers. This statement was still a proposal at the time of writing and should not be presented as a final rule.[5]
The agency had already used its investigative powers in September 2025 to request information from seven chatbot providers regarding their advertising, security testing, protection of minors, and data management. This investigation, based on Section 6(b), was not, in and of itself, a charge. It does, however, demonstrate that the FTC can require detailed information prior to any potential enforcement action.[6]
Who is accountable when an officer takes action?
The chain of responsibility does not end with the model developer. A single model can be integrated into multiple products, work with different tools, and operate with widely varying levels of access. The vendor controls certain components, while the integrator and the user organization define the context of use.
Contracts may allocate certain financial risks among these parties, but they do not eliminate the obligations set forth in consumer law, data protection laws, or sector-specific regulations. Nor is the mere presence of a human in the loop sufficient. That person must also have the information, time, and authority necessary to refuse or halt the action.
What the investigation actually confirms
Three findings have been established. The FTC has confirmed that an investigation is underway. OpenAI and Anthropic are among the companies being targeted. Finally, the agency already has legal tools at its disposal to examine unfair or deceptive practices, privacy commitments, and certain security shortcomings.[1][3][7]
The rest remains unclear. The other companies involved have not been named. The connection between the incidents reported in the press and the FTC’s case has not been publicly documented. No violations have been established, and no specific security standards for agents have been announced as part of this investigation.
The investigation therefore marks not so much the emergence of a new law as an attempt to apply existing principles to more autonomous products. Its significance will depend on how the FTC defines “fair information,” “reasonable protection,” and “foreseeable harm” in the context of agency.
From Compliance to Demonstrable Governance
For suppliers and organizations, the challenge is to demonstrate control over the system. The NIST framework recommends documenting risks, monitoring usage, preparing incident response plans, and considering the entire value chain. This framework remains voluntary, but it helps transform general commitments into observable controls.[8]
Credible governance includes tests conducted in a real-world environment, minimum rights, validations commensurate with the severity of the action, actionable logs, spending or frequency limits, an independent shutdown procedure, and a complaint-handling mechanism. It must also measure silent errors, not just successful tasks.
The European comparison must remain accurate. The AI Act categorizes obligations based on the actor’s role, the type of model, and the intended use. Agency alone is not sufficient to classify a system as high-risk. However, an agent used for recruitment, an essential service, or another listed purpose may be subject to stricter requirements.[9]
The revised European Product Liability Directive includes software and AI systems within the definition of a product. As of October 6, 2026, Member States still had until December 9, 2026, to transpose the directive, and its new rules must apply to products placed on the market or put into service after that date. It sheds light on the evolution of the law, though it cannot be considered applicable to the U.S. investigation at this time.[10]
What to Watch for Now
The first indicator will be the possible publication of orders, requests for information, a complaint, or an agreement. These documents would provide information on the products in question, the harms under review, and the legal basis cited. Without them, any interpretations must remain cautious.
We will then need to see whether the FTC is concerned solely with commercial claims or whether it is also seeking to define what constitutes reasonable protection for an agent capable of taking action. The answer could influence the design of permissions, pre-deployment testing, log retention, and how autonomy is presented to users.
Finally, the allocation of responsibilities will be crucial. An agent-based system often involves a model, a cloud, connectors, an integrator, and a user organization. The chosen framework must avoid placing all responsibility on a single party or allowing each party to pass the responsibility on to the next.
This investigation does not yet demonstrate that U.S. regulations are sufficient to govern AI agents. It does, however, place a concrete question at the center of the debate: as systems move from generating content to performing actions, will providers be required merely to promise their safety, or will they need to be able to prove it?
For more information
To learn more about the challenges of oversight, security, and liability related to AI agents, check out these analyses from the aivancity blog.
Notes and Sources
[1] Associated Press. (September 30, 2026). FTC is investigating OpenAI and Anthropic over possible risks to consumers. View source
[2] Duncan, I. (September 30, 2026). FTC launches broad investigation into Anthropic, OpenAI. The Washington Post. Read the article
[3] Federal Trade Commission. Federal Trade Commission Act. View the legal text
[4] Federal Trade Commission. FTC Policy Statement on Unfairness. View the statement
[5] Federal Trade Commission. (July 1, 2026). FTC Seeks Public Comment on Policy Statement Addressing AI Accuracy. View source
[6] Federal Trade Commission. (September 2025). 6(b) Orders Regarding Advertising, Safety, and Data Handling Practices by AI Companion Providers. View the report
[7] Federal Trade Commission. Privacy and Security Enforcement. Accessed October 6, 2026. View source
[8] NIST. (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. View the report
[9] European Union. Regulation (EU) 2024/1689 on Artificial Intelligence. Consolidated version as of July 27, 2026. View the regulation
[10] European Union. Directive (EU) 2024/2853 on liability for defective products. View the directive at