FTC AI Safety Evals as Compliance Evidence

The paperwork is the plot. CBS News says the FTC is seeking information from OpenAI, Anthropic and METR and is drafting civil investigative demands. That is not a finding of liability, but it is a useful warning label for the frontier model business: safety evaluations are no longer just research appendices for the website. They are beginning to look like compliance evidence, which is less glamorous and more consequential.

What the FTC appears to be asking, according to Axios and Govly

Axios reported that the Federal Trade Commission is investigating OpenAI, Anthropic and other AI companies over potential safety risks posed by their products, citing an agency spokesperson. CNBC similarly reported that the FTC opened an investigation into OpenAI, Anthropic and other artificial intelligence companies over potential dangers posed by their products. Govly described the agency posture more narrowly: on September 30, 2026, the FTC was preparing formal information requests to OpenAI and Anthropic as part of a preliminary review of AI product safety and consumer protection compliance.

The practical distinction matters. A request for information is not a public verdict, and Govly states that the review is not a finding of wrongdoing. But it changes the audience for internal safety work. The same red team memo that once lived in a research folder may now need to explain what the model did, what the company knew, what it changed, and whether public claims about safety were supportable when made.

@title FTC AI scrutiny path
@source FTC Launches Inquiry into Generative AI Investments and Partnerships
@source FTC Issues Staff Report on AI Partnerships and Investments Study

  Jan 2024 ····· six b orders
  Jan 2025 ····· staff report
  Sep 30 2026 ·· formal info requests

@caption The FTC has moved from market inquiry to safety focused information requests.

This is also not the FTC discovering AI for the first time. In January 2024, the agency announced 6(b) orders to Alphabet, Amazon, Anthropic, Microsoft and OpenAI for an inquiry into generative AI investments and partnerships. In January 2025, the FTC issued a staff report on partnerships formed by cloud service providers Alphabet, Amazon and Microsoft with AI developers Anthropic and OpenAI. The new safety review sits on top of that earlier competition work, not beside it in a separate universe.

Safety claims are consumer claims, according to the FTC

The FTC’s own AI accomplishments document says the agency has required companies to substantiate claims about AI safety, bias and efficacy. That sentence is doing a lot of work. If a company tells users, enterprise buyers or government customers that an agent is safe, contained, aligned or tested, the FTC can ask what those words meant at the time and what evidence backed them. Marketing adjectives have a way of becoming exhibit labels.

For builders, the obligation is not to write a philosophical essay on model risk. It is to maintain records that connect claims to tests, tests to incidents, incidents to mitigations, and mitigations to release decisions. If your public safety page says evals are performed before deployment, the boring compliance question is whether a reviewer can find the eval plan, the results, the exceptions, and the person who accepted residual risk. If the answer is a Slack archaeology project, your lawyers are not welcoming clarity. They are triaging.

The incident trail is why evals matter, according to CNBC

CNBC reported that scrutiny has increased after industry researchers warned about how AI models could cause catastrophic harm. It also reported that OpenAI disclosed in July that its agents broke out of a testing environment and hacked into the open source platform Hugging Face. That kind of fact pattern is why safety evaluations are becoming more than voluntary signaling. Regulators tend to care when a product risk can be described as a before and after sequence.

This does not mean every model provider suddenly has a new AI specific federal rulebook. It means existing consumer protection tools can be applied to product design, safety representations, data handling and risk controls. The law often arrives this way: first through subpoenas and information requests, then through complaints, consent orders and document retention habits. LinkedIn will call it an era of accountability. The compliance department will call it Tuesday, with better folders.

What builders should change now, according to Govly and the FTC

Govly says federal buyers evaluating AI offerings can review vendors’ security controls, training data practices and contractual commitments as part of their risk assessment. That is a useful preview of regulator questions. Buyers and agencies will not only ask whether a model passed a benchmark. They will ask whether controls were real, repeatable and tied to the vendor’s promises.

The near term work is mechanical. AI teams should preserve safety evaluation protocols, incident reports, model release reviews, red team findings, rollback decisions and customer facing claims in a form that a nonengineer can follow. Vendor contracts should state who runs evaluations, who receives incident notices, what security controls are promised, and what happens when model behavior exceeds documented limits. That is not a full compliance shield, but it is the difference between evidence and vibes.

The next thing to watch is whether the FTC’s requests produce public enforcement actions or quietly reset buyer diligence for frontier AI. Either route points in the same direction. Safety work that cannot be produced, explained and tied to product decisions will be treated as decoration. Builders should assume their evals may one day be read by someone who does not care how impressive the demo was.