The FTC Sent 50 Page Demands to OpenAI and Anthropic, and AI Safety Is Now a Regulatory File

The FTC AI probe, explained

The FTC AI probe became concrete in mid-October, when Axios reported that the Federal Trade Commission had sent civil investigative demands to OpenAI and Anthropic. Each demand ran to more than fifty pages, according to the report, and the FTC confirmed the probe to CBS News on October 15. The scope is broad: security incidents, safeguarding practices, marketing representations, privacy policies, and plans for testimony from senior executives. If you want to understand how AI regulation actually happens in the United States, this is what it looks like in practice, not a new law, but a formal demand for documents.

A civil investigative demand is the FTC's version of a subpoena. It compels a company to hand over records and, potentially, testimony. It is not a complaint, not a finding of wrongdoing, and not a fine. That distinction matters, because the headlines will blur it. What a CID does is open a formal record: from this point on, the companies' safety claims exist in a file where a regulator can compare them against internal documents.

Why the FTC, and why now

The FTC's interest follows a pattern visible across the AI industry this year. The labs have made sweeping claims about safety: that their models refuse harmful requests, protect children, handle sensitive data carefully, and behave as described in their marketing. Those claims are now load-bearing. Millions of people use these products, businesses build on them, and schools and hospitals are starting to rely on them. A regulator does not need to believe the claims are false to investigate them. It needs only to decide that the gap between marketing and reality, if one exists, would harm consumers.

Timing also matters. The probe landed in the same week Anthropic committed 5 percent of its stock to a new public benefit LLC, and OpenAI acquired Orchestra Bio, a biotech agent startup, folding it into its Rosalind life sciences product. The industry is writing its own governance structures and expanding into regulated fields like drug development at the same time. Regulators notice that combination, because self-governance claims and regulated-domain expansion are exactly the areas where oversight follows.

What the fifty pages probably cover

Fifty pages of demands is a lot, and the reported scope tells you where the FTC is looking. Security incidents: what went wrong, when the company knew, and what it told users. Safeguarding practices: how the models are tested, what guardrails exist, and how they are enforced when users push against them. Marketing representations: whether public claims about safety and capability match internal testing. Privacy policies: what data is collected, how it is used, and whether the fine print matches the advertising.

Executive testimony is the sharpest part. When senior executives testify, their answers become part of the record, and inconsistencies between testimony and documents are where investigations get serious. Companies take CIDs seriously for this reason, even when they believe they have done nothing wrong. The process itself is expensive, distracting, and reputation-sensitive, which is why a CID is a meaningful regulatory signal even before any outcome.

What this is not

It is tempting to read the probe as the start of a breakup, a ban, or a sweeping AI law. It is none of those. The FTC enforces consumer protection and competition law with the tools it already has, and a CID is the earliest formal step. Possible outcomes range widely: the investigation could close with no action, end in a settlement with commitments, or become a formal complaint if the FTC finds violations. That range is wide because the process is early, and anyone predicting a specific outcome right now is guessing.

It is also worth placing this probe in the wider regulatory picture. The FTC has already opened a separate antitrust probe into Microsoft's cloud licensing, the Justice Department is asking questions about Nvidia's Hugging Face deal, and the Treasury has proposed wider outbound investment curbs on tech deals. The common thread is not a single AI law. It is regulators using existing powers across competition, consumer protection, and national security, case by case.

What to watch next

Watch for three things. First, whether either company discloses more about the probe in its own words, since voluntary disclosure often signals confidence or a desire to frame the story. Second, whether the investigation expands to other labs, which would suggest a sector-wide inquiry rather than a company-specific one. Third, whether any settlement or complaint emerges, and what it requires: changes to marketing, to safety testing, or to data practices would all be more consequential than a fine alone.

For users, the practical takeaway is modest but real. The safety claims on AI product pages are now being tested against internal records by a regulator with subpoena power. That does not mean the products are unsafe, and it does not mean they are safe. It means the claims are no longer just marketing. They are evidence, and someone is reading them carefully.