FTC Act Section 5 enforcement posture on artificial intelligence

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in commerce. In its Operation AI Comply sweep the FTC stated that using AI tools to trick, mislead or defraud people is illegal and that there is no AI exemption from the laws on the books. The cases announced included a company promoting an AI tool that enabled customers to create fake reviews, a company claiming to sell AI Lawyer services, and companies claiming AI could help consumers make money through online storefronts. Companies must therefore hold substantiation before publishing accuracy, performance, autonomy or earnings claims.

Applies when

Chinese companies selling AI products or services into the U.S. market, including performance claims made on websites, app store listings, white papers, offering materials and sales scripts.

Evidence to retain

• · Claims register mapped to supporting evidence, recording benchmark set, methodology, date and owner
• · Raw benchmark data and reproducible evaluation scripts
• · Compliance review records and version history for marketing materials
• · Verification records for testimonials and endorsements

Estimated first-time effort: 5–20 person-days (estimate, not a commitment)

In the Rite Aid matter the FTC alleged that the retailer deployed AI-based facial recognition in hundreds of stores without taking reasonable measures to prevent harm to consumers, who were erroneously flagged as shoplifters or troublemakers and suffered humiliation and other harm. The order requires comprehensive safeguards when deploying automated systems that use biometric information to track or flag consumers, requires discontinuing the technology where potential risks to consumers cannot be controlled, and requires a robust information security program overseen by senior company executives. This establishes an enforcement baseline that deployment must come with safeguards.

Applies when

Chinese computer vision and security companies deploying face recognition, behaviour recognition, risk scoring or fraud flagging in the United States, and vendors supplying such systems to U.S. customers.

Evidence to retain

• · Pre-deployment risk assessment and accuracy or false-positive testing reports broken down by demographic group
• · Design documentation for human review and appeal mechanisms
• · Notification plan for affected individuals
• · Minutes evidencing senior executive oversight of security and algorithm governance

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

FTC enforcement outcomes have strong demonstrative effect: the safeguards, prohibitions and executive oversight arrangements imposed in peer consent orders typically become the de facto standard used in customer diligence and procurement questionnaires. Companies should track FTC actions against comparable business models, map their requirements into internal controls, and be able to give evidenced answers in customer security questionnaires and investor diligence.

Applies when

All Chinese companies selling AI products into the U.S. market.

Evidence to retain

• · Tracking register of peer enforcement developments
• · Mapping table from enforcement requirements to internal controls
• · Standard answer library for customer security questionnaires with an evidence index
• · Annual compliance self-assessment report

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)