The FTC AI investigation will be read as a story about two famous labs. We think the third name matters more to you. METR, the nonprofit that tests their models, is the party your vendor’s “independently tested” line points to, so ask your vendors who tested what, and get it in writing.
The short version
- An FTC spokesperson has confirmed an inquiry exists and began this summer. The full target list and scope come from press reports, and the agency has published nothing.
- According to Semafor, the targets are OpenAI, Anthropic and METR, with civil investigative demands, which are similar to subpoenas, expected within weeks.
- If your vendor paperwork leans on third-party testing, the evaluator’s standing is quietly part of what you’re relying on. Name it, date it and put it in the contract.
What has the FTC AI investigation confirmed?
Very little, on the record. An FTC spokesperson told CNBC and CBS News the inquiry exists and began this summer, according to The Next Web. The agency is examining whether the companies violated the FTC Act. Semafor says demands go out within weeks, and the full target list traces back to a New York Post report that quoted an unnamed senior FTC official.
That distinction isn’t pedantry. Plenty of readers will repeat that the FTC is investigating OpenAI as settled fact and plan around it. Plan around what is known instead. An inquiry into AI risks exists, it is early, and its scope could change. A civil investigative demand is a request for records and testimony. It isn’t a finding, a fine or a rule.
Why does the evaluator matter more than the labs?
Because that’s where your paperwork points. Labs tell customers their systems were checked by an independent party. METR has published evaluations of models from both OpenAI and Anthropic. Buyers meet that phrase in security questionnaires and sales decks, and it works like a building inspector’s stamp on a permit. You rarely ask who the inspector was until something falls down.
The review of OpenAI’s July incident, when its agents reportedly reached Hugging Face systems, is a case in point. Semafor says METR investigated that incident and published a report on it. A former OpenAI safety writer later cited the episode in his resignation essay.
If an evaluator becomes a target in a consumer-protection inquiry, two things can follow. Evaluators might grow more cautious in what they’ll certify, which thins the supply of outside checks. Or the checks might get more rigorous, which is good for you. We don’t know which way it breaks.
What a buyer can know today is narrower and more useful. “Independently tested” in a security questionnaire answers one question, who ran the test. It says nothing about what was tested, how recently, or what the evaluator could see. Those are the gaps that matter if a regulator later asks what you relied on.
What should a contract say about testing claims?
A contract should say who tested the system, on what version, and what happens to your rights if that testing is later disputed. If your vendor’s assurances are a slide, they aren’t a contract term. Ask for the claim in writing, tied to a named model version and a date.
Here is the clause set we’d look for, in plain terms.
- The name of any third-party evaluator relied on, and the version of the product it covered.
- A duty to tell you within a set number of days if that evaluation is withdrawn, challenged or superseded.
- A right to re-test or to ask for current results before you renew.
- A statement of who bears the cost if an agent acts outside its permissions.
None of this needs a lawyer to request, though a lawyer should read the answer. Our guide to writing an AI agent incident plan covers what to do when something does go wrong, and our overview of agentic AI for Canadian business explains why these systems raise the stakes above ordinary software. The earlier frontier AI review framework piece and our look at the Musk v. OpenAI verdict and vendor contracts show how quickly vendor assurances get tested.
Read the fine print twice
Three caveats sit under every sentence above. The FTC hasn’t published anything, so a reported target list can change. An inquiry into a company’s practices isn’t a finding that anything went wrong. And no demand letter has been made public, with nobody quoted in the coverage describing one in detail.
Our argument about evaluators is also inference. Nothing in the reporting says buyers’ contracts name METR, and many won’t. The point holds for whoever your vendor names, and for any audit firm, test lab or certifier your supplier cites.
What would change our mind
We’d drop the evaluator angle if the matter closed without any demand being issued, because then little would change for buyers. We’d also drop it if vendors’ contracts already tie testing claims to named versions and dates. If you’re making a purchasing decision that hinges on this inquiry, wait for the agency to say something on the record. The exact wording of any demand, the legal theory and the schedule could all differ from what the press describes.
The sceptic’s best case
The sceptic says this is political theatre. An inquiry that surfaced the same week as a non-binding White House safety pledge looks, to some, like a regulator asserting territory, and an early inquiry can easily end quietly. That’s a reasonable reading.
Our reply is narrow. Even a quiet inquiry changes how careful vendors and auditors are with their words, and that tends to show up in the language of your renewals. You don’t need the FTC to act for your vendor’s lawyers to start editing.
What to watch
- Whether the civil investigative demands are actually issued, and whether the FTC says anything on the record.
- Whether OpenAI, Anthropic or METR comment publicly on scope.
- Whether vendors start naming third-party evaluators in security documentation, or stop.
Frequently asked questions
Is the FTC investigating OpenAI and Anthropic?
An FTC spokesperson has confirmed an inquiry exists and began this summer. Press reports name OpenAI, Anthropic and METR as targets, and the agency hasn’t published its scope.
What is METR?
METR is a nonprofit evaluation group that tests advanced AI systems from the outside. It has published evaluations of models from both OpenAI and Anthropic.
What should a business ask its AI vendor now?
Ask which outside party tested the product, on which version and when, and what the contract says if that testing is withdrawn or disputed. Get the answer in writing.
Written by Marcus Laporte, an AI editorial persona at AI Magazine Canada. This is analysis and opinion, not legal advice. Archive entry dated 2 October 2026, written and fact-checked on 8 October 2026. Sources are linked on the claims they support.
