Category: Regulatory | Reading time: 4 min
What Happened
On Wednesday, 14 October 2026, the US Federal Trade Commission sent civil investigative demands (CIDs) to OpenAI and Anthropic, Axios reported on 15 October, citing a person familiar with the matter. CIDs are compulsory requests for documents and information that the Commission uses to gather evidence before deciding whether to litigate.
Axios said each demand runs to more than 50 pages and asks for documents on security incidents and safeguarding practices, as well as marketing materials and documents that set out company privacy policies. The source said the probe's scope is potential consumer-protection violations. The Commission also plans to compel top AI executives to testify about their products, and investigative demands to third-party AI organisations are expected later.
The same Axios report notes that a group of state attorneys general sued OpenAI on Wednesday under consumer-protection laws over alleged safety marketing to users, including children—a separate track from the FTC demands.
How This Differs From the Earlier Probe Signal
On 8 October, a senior FTC official told Semafor that civil investigative demands to frontier AI companies were close and that the questions would run to dozens of items about what the companies had said about product dangers and about consumer harm. Cyphrex covered that signal on 9 October. Wednesday's send is the formal step: the paper has left the agency, OpenAI and Anthropic are under compulsory process, and the document categories now explicitly include security incidents and safeguards alongside marketing and privacy.
FTC Chair Andrew Ferguson co-chairs the White House Super Intelligence Force, which last week responded to Anthropic's disclosed use of government systems by announcing an industry-wide mandate to notify and remediate when incidents occur. Axios said the SI Force was due to meet on Thursday, 15 October.
Why It Matters
For regulated enterprises that deploy action-taking agents built on frontier models, the CID package reframes "lab incident" disclosure as a consumer-protection evidence problem, not only a safety-research story. The Commission is asking for what happened, what safeguards existed, how the products were described to the market, and how privacy was described—then tying those records to unfair or deceptive practices authority.
When a lab faces compulsory production on incidents and marketing claims, enterprise buyers inherit a parallel question: if a customer, examiner, or counterparty asks what your agent did after a safeguard failed, can you produce an independent record that does not depend on the vendor's voluntary brief? The CID list is a preview of the evidence categories regulators will treat as material.
The Takeaway
Treat the FTC's incident-and-safeguard document categories as a design input for agent deployments you control. Map which agent actions would count as security incidents or safeguard failures in your environment, keep marketing and product claims aligned with what your controls actually enforce, and retain independently checkable records of what was attempted, what was allowed, and who authorised it.
Source: Axios: FTC subpoenas OpenAI, Anthropic over consumer harms | Semafor: FTC advancing on its AI safety probe