FTC launches Operation AI Comply, its first AI-washing enforcement sweep

Operation AI Comply is a Federal Trade Commission enforcement sweep targeting companies that market or deploy artificial intelligence in deceptive or unfair ways. The FTC announced the sweep on September 25, 2024, alongside five initial law enforcement actions against businesses accused of overstating or misusing AI claims.

What it is

The sweep is not a single rule or statute but a coordinated enforcement initiative under the FTC's existing authority over deceptive and unfair practices. The launch covered a company offering AI tools for fake reviews, a company selling AI Lawyer services, and several companies claiming AI could help consumers earn money through online storefronts. Four of the five initial cases concerned traditional deceptive and unfair advertising claims, while a fifth, against Rytr, applied a theory that a company can be liable for providing the means to generate deceptive content.

What it requires

Companies subject to actions faced complaints, proposed consent orders, or court filings; DoNotPay agreed to a proposed order requiring payment and consumer notices about the limits of its law-related features. Rytr's proposed order would bar the company from marketing any service dedicated to generating consumer reviews or testimonials. The initiative has continued under a new FTC chair, with the agency bringing additional AI washing cases in the following year.

What security leaders should do

Security and compliance teams should treat any public claim about AI performance, accuracy, or earnings potential as something that must be substantiated with documented testing before it is published. Teams marketing AI-enabled security or compliance tools to enterprise customers should assume the same deception standards that apply to consumer marketing also apply to business-to-business claims, since the FTC has pursued both. Organizations should also review downstream vendor and reseller materials, since the FTC has pursued parties that supplied deceptive marketing content to others.