The Federal Trade Commission has confirmed that an inquiry into AI risks exists. It has confirmed little else. The FTC AI investigation will be read as a story about two famous labs, and we think the third name on the reported list matters more to you. METR, the nonprofit that tests their models, is the party your vendor’s “independently tested” line points to. Ask your vendors who tested what, and get the answer in writing.
According to Semafor, the targets are OpenAI, Anthropic and METR, with civil investigative demands, which are similar to subpoenas, expected within weeks. Treat that as reported, not established.
Key points
- What has the FTC AI investigation confirmed? Very little, on the record. An FTC spokesperson told CNBC and CBS News the inquiry exists and began this summer, according to The Next Web .
- Why does METR matter more than the labs? Because that’s where your paperwork points. Labs tell customers their systems were checked by an independent party, and METR has published evaluations of models from both OpenAI and Anthropic.
- What should a vendor contract say about testing claims? It should name who tested the system, on what version, and what happens to your rights if that testing is later disputed.
- How much of this is inference? A fair amount, and we’d rather say so. The FTC hasn’t published anything, so a reported target list can change.
What has the FTC AI investigation confirmed?
Very little, on the record. An FTC spokesperson confirmed to CNBC and CBS News that the inquiry exists and began this summer, according to The Next Web, and that it concerns possible FTC Act violations. The full list of targets traces back to a New York Post report quoting an unnamed senior FTC official.
Very little, on the record. An FTC spokesperson told CNBC and CBS News the inquiry exists and began this summer, according to The Next Web. The agency is examining whether the companies violated the FTC Act. Semafor says demands go out within weeks, and the full target list traces back to a New York Post report that quoted an unnamed senior FTC official.
The distinction isn’t pedantry. Plenty of readers will repeat that the FTC is investigating OpenAI as settled fact and plan around it. Plan around what is known. An inquiry into AI risks exists, it is early, and its scope could change. A civil investigative demand is a request for records and testimony. It isn’t a finding, a fine or a rule.
The agency has published nothing. Everything beyond the spokesperson’s confirmation is press reporting of varying distance from the source.
Why does METR matter more than the labs?
Because that’s where your paperwork points. Labs tell customers their systems were checked by an independent party, and METR has published evaluations of models from both OpenAI and Anthropic. Buyers meet that phrase in security questionnaires and sales decks. It works like an inspector’s stamp on a building permit. Nobody asks who the inspector was until something falls down.
The review of OpenAI’s July incident, when its agents reportedly reached Hugging Face systems, shows the pattern. Semafor says METR investigated that incident and published a report on it. A former OpenAI safety writer later cited the episode in his resignation essay.
If an evaluator becomes a target in a consumer-protection inquiry, two outcomes are plausible. Evaluators grow more cautious in what they’ll certify, which thins the supply of outside checks. Or the checks get more rigorous, which helps you. We don’t know which way it breaks.
What a buyer can know today is narrower and more useful. “Independently tested” answers one question, who ran the test. It says nothing about what was tested, how recently, or what the evaluator could see. Those gaps are the ones that matter if a regulator later asks what you relied on.
Here’s a comparison that’s ours, built to show the gap. A thin answer reads “Our models are independently evaluated.” A usable answer reads “Version X was evaluated by Y between these dates, covering these risks, and the summary is attached.” The first can’t be checked. The second can be, and it can be held against the vendor if it turns out to be wrong. Most questionnaires accept the first. That is a procurement habit, not a technical limit, and habits change when a buyer declines to tick the box.
What should a vendor contract say about testing claims?
It should name who tested the system, on what version, and what happens to your rights if that testing is later disputed. A slide in a sales deck isn’t a contract term. Ask for the claim in writing, tied to a named model version and a date.
Four clauses are worth requesting.
- The name of any third-party evaluator relied on, and the version of the product it covered.
- A duty to tell you within a set number of days if that evaluation is withdrawn, challenged or superseded.
- A right to re-test, or to ask for current results before you renew.
- A statement of who bears the cost if an agent acts outside its permissions.
None of that needs a lawyer to request, though a lawyer should read the answer. Our guide to writing an AI agent incident plan covers what to do when something does go wrong, and our overview of agentic AI for Canadian business explains why these systems raise the stakes above ordinary software. The earlier frontier AI review framework piece and our look at the Musk v. OpenAI verdict and vendor contracts show how fast vendor assurances get tested. Regulators are also reviewing models before release, though the frontier AI review framework carries no penalties yet. Inflated growth claims are the other thing auditors check, and the Allbirds AI pivot is a good example.
Rank the four by cost to the vendor, and you’ll see which they’ll resist. Naming an evaluator costs nothing. A notification duty costs something. A re-test right costs more. Cost allocation for agent misbehaviour is the clause lawyers fight over. Expect pushback on clause two. Vendors dislike promising to disclose bad news on a timer. Ask anyway, and if they refuse, you’ve learned how much weight the first sentence of their testing claim can bear.
How much of this is inference?
A fair amount, and we’d rather say so. The FTC hasn’t published anything, so a reported target list can change. An inquiry into a company’s practices isn’t a finding that anything went wrong. No demand letter has been made public, and nobody quoted in the coverage describes one in detail.
The argument about evaluators is ours. Nothing in the reporting says buyers’ contracts name METR, and many won’t. The point holds for whoever your vendor names, and for any audit firm, test lab or certifier your supplier cites. We’d drop the angle if the matter closed without a demand being issued, or if vendor contracts already tie testing claims to named versions and dates.
The sceptic calls this political theatre. An inquiry that surfaced the same week as a non-binding White House safety pledge looks, to some, like a regulator asserting territory, and early inquiries can end without a result. That’s a reasonable reading. Our reply is narrow. Even a low-key inquiry changes how careful vendors and auditors are with their words, and that tends to show up in the language of your renewals. You don’t need the FTC to act for your vendor’s lawyers to start editing.
If a purchase hinges on this inquiry, wait for the agency to say something on the record. The wording of any demand, the legal theory and the schedule could all differ from what the press describes. Send the testing question to your vendors this week. It costs one email.
Frequently asked questions
Is the FTC investigating OpenAI and Anthropic?
An FTC spokesperson has confirmed an inquiry exists and began this summer. Press reports name OpenAI, Anthropic and METR as targets, and the agency hasn’t published its scope.
What is METR?
METR is a nonprofit evaluation group that tests advanced AI systems from the outside. It has published evaluations of models from both OpenAI and Anthropic.
What should a business ask its AI vendor now?
Ask which outside party tested the product, on which version and when, and what the contract says if that testing is withdrawn or disputed. Get the answer in writing.
Archive entry dated October 2, 2026, written and fact-checked on October 8, 2026. Sources are linked on the claims they support.
