On September 30, 2026 a senior Federal Trade Commission official confirmed that the agency has opened a broad investigation into the safety of AI systems from OpenAI and Anthropic, and into the evaluator METR. The probe sits under the FTC Actβs unfair-or-deceptive-practices authority, not a new AI statute. Civil investigative demands and possible executive testimony are expected in the coming weeks. In-house counsel at labs, enterprise buyers of agentic tools, and vendors that rely on those models should freeze relevant incident files now. The date that matters is the arrival of the first CID, not a future rulemaking.
The first Trump-administration enforcement move aimed at frontier AI safety arrived as a consumer-protection investigation, not as a new regulatory agency β and it landed one day after several of the same companies joined a White House lunch on voluntary self-policing.
This overview is not legal advice. FTC investigations are confidential until the agency says otherwise. Companies should work with qualified U.S. counsel before producing documents or commenting on pending demands.
- What changed? The FTC confirmed an investigation of OpenAI, Anthropic and METR over potential consumer harm from AI systems.
- When? Confirmed Wednesday, September 30, 2026; first reported by the New York Post; CIDs expected in coming weeks.
- Who is affected? The named labs, METR, enterprise buyers of their agents, insurers writing tech E&O, and boards overseeing AI incident response.
- What to do this week? Map which vendors sit in the probeβs blast radius and preserve safety evaluations, incident tickets and customer-facing claims.
What did the FTC actually confirm?
Reuters, The Washington Post, Bloomberg, CBS News and ABC News all reported on September 30 that the FTC has opened a probe into whether AI companiesβ conduct may violate Section 5 of the FTC Act. Named subjects include OpenAI, Anthropic and METR, the California nonprofit that evaluates frontier models and that reviewed a high-profile agent incident involving Hugging Face. Agency officials said the Commission plans to send civil investigative demands β compulsory document requests similar to subpoenas β and may compel executive testimony. OpenAI, Anthropic and METR did not immediately issue detailed public responses in the first-day coverage.
The legal hook is existing consumer-protection law: unfair or deceptive acts or practices. That is a different path from drafting a new federal AI licensing regime. FTC Chair Andrew Ferguson had argued in the days before the confirmation that officials should examine existing law before writing new rules and should treat industry calls for regulation with βdeep suspicion.β
How does this sit next to the White House βself-policingβ lunch?
On September 29 President Trump hosted AI executives at the White House. Coverage of that meeting described a short voluntary accord that the President called βmorally binding,β with signatories reported to include leaders from Anthropic, OpenAI, Alphabet, Meta, Nvidia and SpaceX. The FTC confirmation the next day is not a repeal of that photo opportunity. It is a reminder that a voluntary pledge does not freeze the Commissionβs independent enforcement calendar. Counsel should not brief boards as if the lunch closed the U.S. safety file.
What is in scope for enterprise legal teams who are not the targets?
Buyers are not the respondents. They still have work. If your company deploys OpenAI or Anthropic agents in customer-facing workflows, marketing claims about βsafe,β βsupervised,β or βcannot take unauthorized actionsβ now sit next to a live federal inquiry into those exact failure modes. Procurement and privacy counsel should pull the last twelve months of vendor questionnaires, DPA schedules and incident notices. If a vendor told you an independent evaluator such as METR had cleared a system, that representation is now part of the factual record the FTC is building.
Product counsel should also inventory agent permissions: which tools can send email, move money, change CRM records, or reach third-party APIs without a human in the loop. Those permission maps will be the first exhibit an outside investigator asks for if an incident lands on your side of the contract.
What should legal teams do this week?
Issue a narrow preservation hold covering safety evaluations, red-team reports, customer complaints tagged to agent behavior, and public marketing claims about AI reliability. Do not wait for a CID addressed to you. Review insurance notices β some tech E&O and cyber policies require prompt notice when a vendor is under a government investigation that could produce downstream claims. Align the public-affairs script with the legal script: βwe are not a partyβ is accurate for most buyers; βthe models we use have been clearedβ is a claim that now needs a citation.
What to watch next?
Whether the first CIDs go only to labs and METR or also to cloud hosts and enterprise resellers. Whether Fergusonβs preference for existing-law enforcement produces a complaint or stays in the investigation file through the midterms. And whether state attorneys general copy the FTC Act theory into their own information requests. The operational date is the CID clock, typically measured in weeks rather than years.
Is this an antitrust case?
No. Day-one reporting frames it as a consumer-protection investigation under the FTC Act, focused on safety representations and potential harm.
Does a CID mean the company broke the law?
No. A civil investigative demand is a fact-gathering tool. It is not a finding of liability.
Why is METR named?
Reporting says METR evaluated incidents involving agentic systems, including a review tied to a Hugging Face hack. Naming an evaluator widens the file beyond model trainers.
Should enterprise buyers pause deployments?
The FTC has not ordered customers to stop using the products. Review contractual safety claims and human-in-the-loop controls instead of a blanket freeze unless your own risk committee requires one.
When will documents be due?
Officials said demands are expected in the coming weeks. Exact return dates will be in the CID itself.
Son GΓΌncelleme / Last Updated: October 1, 2026
Related: Googleβs EU DMA challenge Β· Google ad-tech remedies order Β· Law hub
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.