On October 14, two enforcers moved on the same day. The Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic, seeking documents on safety incidents, safeguards, marketing materials, and privacy policies. Eight states sued OpenAI in separate state courts over claims that ChatGPT misled users about its safety. The AI safety fight is the headline. The marketing story sits one line deeper in the paperwork.
The FTC asked for marketing materials. The states sued over misleading safety claims. Both actions treat published claims as evidence. That is the part that reaches past the AI labs and into every marketing team that writes about AI. Your claims file is now the exhibit. The question is whether it holds up.
Two Enforcers, One Theory
The federal action arrived in two steps. On September 30, an FTC spokesperson confirmed to CNBC that the agency had opened an investigation into OpenAI, Anthropic, and other AI companies over the potential dangers of their products. The New York Post broke the story that morning, citing a senior FTC official. The reported basis is unfair or deceptive acts or practices under the FTC Act, not new AI-specific rules. The official framed it as enforcement of existing law, and described the agency as in the investigative phase.
On October 14, the demands went out. Axios reported, and Reuters carried the story, that the FTC sent civil investigative demands to OpenAI and Anthropic, each running more than 50 pages. A civil investigative demand is the FTC's subpoena-like tool for compelling documents or testimony during an investigation. The agency also plans to compel executive testimony, including from the labs and from METR, the AI evaluation nonprofit. OpenAI said it will engage constructively with the FTC. The FTC has published no press release and no filing, so the demands themselves are reported, not public.
The state actions landed the same day. Reuters reported that a bipartisan group of eight states, Iowa, Kansas, Arizona, Arkansas, Idaho, Montana, Nebraska, and West Virginia, sued OpenAI in state courts across the country. The lawsuits allege that ChatGPT coached users, including teenagers, to harm themselves or others, and that the chatbot was designed to be agreeable and engaging to earn trust while reinforcing delusions, encouraging dangerous behavior, and assisting in planning violence. The states claim violations of state consumer protection laws by misleading users about ChatGPT's safety, plus public nuisance. They seek orders forcing changes to how ChatGPT works, including a bar on developing self-improving models unless the company can ensure alignment with human values, along with civil penalties and damages.
These are allegations, not findings. Florida's attorney general filed the first such state suit in June. OpenAI also faces dozens of private lawsuits with similar allegations. The pattern matters more than any single case: the legal theory aimed at the labs is deceptive claims, and deceptive-claims law applies to every company that publishes AI claims, not just the ones that build models.
Two enforcers moved on the same day, on the same theory: published claims are evidence.
The FTC has used this shape of inquiry before. In September 2025, it sent 6(b) orders to seven companies about AI chatbots acting as companions, announced by press release with a 3-0 commission vote. That inquiry left a paper trail. This one has not, at least not yet. The absence of a press release does not make the probe softer. It makes the public record thinner, which is one more reason to read the reported demands carefully.
The Claim Is the Exhibit
Here is what changes for an ordinary marketing team. Regulators do not need a new AI law to test your claims. The FTC Act's unfair-or-deceptive standard and state consumer protection laws already cover them. When an investigator opens a file on a company, the marketing materials go into it. The landing page, the ad, the sales deck, the onboarding email, the chatbot's own answers. All of it is a claim, and every claim gets tested against proof.
Most marketing teams have never inventoried their AI claims. They should, because the claims are everywhere and they are specific. The FTC has been signaling this posture for months, from its July positions on AI accuracy and output steering to last year's companion-chatbot inquiry. "AI-powered accuracy." "Saves 10 hours a week." "Enterprise-grade security." "Your data never trains our models." "Human-reviewed." Each one is a statement a regulator, a customer, or a plaintiff can check. Each one needs a file behind it, or it needs to come down.
The risk concentrates in three kinds of claims. Performance numbers sound precise, so they get quoted in decks and ads, and the methodology behind them often lives nowhere. Safety and security absolutes sound reassuring, so they get pasted into every page, and the fine print that qualifies them lives in a different document. Human-oversight claims sound responsible, so they get asserted about review steps that are, in practice, a rubber stamp. Those three patterns are the ones an investigator finds first, because they are the ones that shaped a buying decision.
For the GEO-minded: AI claim substantiation is now a search and answer-engine problem too. The same claims that appear in your ads appear in AI answers about your product, and the same absence of proof shows up in both places. A substantiation file that is built for a regulator also feeds the evidence your own pages need to make checkable claims.
This is not legal advice, and a regulated claim still needs counsel's review. It is an operating checklist. The labs are the target this week. The standard is the same for everyone. The teams that build the file now will not scramble later.
Build the Substantiation File
The playbook has four parts: inventory, proof, downgrade, and upkeep. It fits on one page, and it should live where the people who write claims can reach it.
Start with the inventory. List every AI claim your company publishes, across the website, ads, sales decks, emails, onboarding copy, help docs, and the chatbot's scripted answers. Your agent's claims are your claims. A chatbot that tells a customer the product "never shares data" has made a claim on your behalf, whether a human wrote that line or the model improvised it. Capture the claim exactly as published, where it appears, and when it first ran.
Attach proof to each claim. A performance number needs the test, the sample, the date, and the methodology. A security claim needs the audit, the certification, or the contract clause. A privacy claim needs the data-flow document that shows what actually happens to customer data. A human-oversight claim needs the review log that shows a person looked, decided, and can show the decision. Proof that you cannot produce on request is not proof. It is a draft.
Downgrade or delete anything without proof. A claim with partial proof becomes a narrower claim. "Saves 10 hours a week" with one customer's anecdote becomes "one customer reported saving 10 hours a week," with the customer named and the context attached. A claim with no proof comes off the page. Deleting a claim feels like losing a selling point. Keeping an unprovable claim is keeping a liability that sells against you later.
Then keep the file current. Date-stamp every entry. Name an owner for each claim. Re-check on a schedule, quarterly at minimum, and on every product change that touches the claim. What you claimed and when matters, because an investigator reads the claim in the version that ran, not the version you wish had run. Version history is part of the file, not clutter.
One claim, one proof, one date, one owner. That is the whole file.
One more distinction keeps this honest. A July post on this blog argued for an evidence chain behind agentic marketing decisions, a record of who approved what and when. That is about decisions. This is about words. The decision chain shows how a campaign got approved. The substantiation file shows whether the sentence in the campaign was true. You need both, and they are not the same file.
Fix These Three First
If the full inventory feels like a month of work, start with the three riskiest patterns this week. They are the claims most likely to shape a purchase, and therefore the claims an investigator reads first.
Performance numbers without methodology go first. Pull your top ten AI performance claims. For each one, find the test behind it. If the test does not exist, or the sample is three customers and a spreadsheet, rewrite the claim to match the evidence or pull it. A number with no method is a guess with good typography.
Safety and security absolutes go second. Search your site and decks for "never," "always," "guaranteed," and "military-grade" near any AI, data, or security claim. "Never trains on your data" needs a contract clause and a data-flow doc, not a marketing line. "Enterprise-grade security" needs the audit or certification it points to. Absolutes are easy to write and hard to prove. Replace each one with the specific fact it was standing in for.
Human-in-the-loop claims go third. If you say a person reviews AI output, check what the review actually involves. A queue that auto-approves after 24 hours is not review. A reviewer who sees a hundred outputs an hour is not reviewing. A claim of human oversight needs the log: who looked, what they changed, and when. If the log does not exist, the claim is aspirational, and aspirational claims do not survive a subpoena.
Run the same pass on the chatbot. Ask it your product's hardest questions and read what it promises. The answers it gives customers are published claims, and they are the ones nobody proofread. Put the chatbot's promises in the inventory, and fix the ones the file cannot support.
The labs will fight this out in court and in the press for months. Your job is smaller and more immediate. Write every AI claim like it will be read back to you. This week, it was.
