The FTC is investigating AI agents. Here is what businesses should do now.
On September 30, 2026 the Federal Trade Commission opened an investigation into OpenAI, Anthropic and other AI developers over the risks their technology may pose to consumers. Reporting describes it as the first US consumer-protection probe aimed squarely at agentic AI: systems that browse, code and act with limited human oversight.
- Who: OpenAI, Anthropic and other AI developers.
- Why: incidents in which agents stepped outside their intended limits.
- What next: formal information requests and sworn testimony, per reports.
- For you: if you run agents, be ready to show limits, approvals and logs.
What we know, and what we don’t.
| Known | Not yet known | |
|---|---|---|
| Scope | Consumer risks from AI products, with a focus on agents | Which products and practices will be named |
| Trigger | Recent incidents of agents acting beyond their bounds | Whether any company will face penalties |
| Process | Information requests and testimony are expected | Timeline and any resulting rules |
Why it happened now
A seven-point checklist for any business running agents
- Inventory every agent.Name, owner, purpose and the systems it touches.
- Least access.Only the folders, tools and accounts the job needs.
- Approval gates.Payments, customer messages and regulated actions wait for a person.
- Full logs.What it read, what it did, and who approved it.
- A kill switch.Anyone accountable can pause it in one step.
- Measured accuracy.A test set from your own cases, scored before and after launch.
- Plain disclosure.Tell customers when they are dealing with an agent.
Limits, approvals and logs are not red tape. They are what make an agent buyable.Intelligent AI World
Every agent IAW builds ships with these seven controls. We designed them for hospitals and law firms long before the FTC moved. They are now becoming everyone’s standard.
What changes for different businesses
| If you are… | Do this now | Why |
|---|---|---|
| Using ChatGPT or Claude for staff | Write a one-page AI use policy | Shows reasonable oversight if anything goes wrong |
| Running agents that act | Add approvals and logs | Autonomy without oversight is the core concern |
| Letting agents talk to customers | Disclose it plainly | Consumer protection is the FTC’s job |
| In healthcare, finance or law | Map agents to your existing rules | Sector rules still apply to AI actions |
| Selling AI to others | Document limits and known risks | Undisclosed risk is what the probe is about |
A simple one-page AI policy
- Which AI tools staff may use, and for what
- What data must never be pasted into public tools
- Which agents can act, and what needs approval
- How customers are told when AI is involved
- Who owns each agent and reviews its log
- How to report a mistake, and how fast it is fixed
Frequently asked questions
Does the FTC investigation affect companies that only use AI agents?
It targets AI developers, but it signals what regulators will expect: disclosed risks, limits on autonomy and evidence of oversight. Buyers should build to that standard now.
What should a company document?
What each agent can access, which actions need approval, how errors are caught, and who is accountable for its output.
Is this the end of AI agents?
No. It is the start of rules for them. Agents with clear limits, approvals and logs will be easier to buy, not harder.
Do small businesses need an AI policy?
Yes, a short one. One page that says which tools are allowed, what data stays out, and who approves agent actions covers most of the risk.
Will the FTC regulate AI tools I buy?
The investigation targets developers. But regulators look at how products are used too, so businesses should be able to show reasonable oversight.
Our agents are built with scoped access, approvals and audit trails from day one. See them working on the agents page, or read our IAW vs ChatGPT, Claude, Cowork, Manus, Kimi and Genspark comparison.
Sources: SecurityWeek; ABC News; Euronews.