Overview
The Federal Trade Commission (FTC) issued a proposed policy statement in early 2025, asserting that AI companies manipulating system outputs to advance undisclosed ideological objectives may violate Section 5 of the FTC Act's prohibition on unfair or deceptive conduct. The Commission opened a public comment period running through July 31, 2026, following a December executive order directing the FTC to address legal implications of state AI laws that mandate alterations to AI model outputs. The Commission vote was 2-0.
The statement also addresses federal preemption, arguing that state laws requiring AI output modifications to comply with state ideological objectives conflict with federal regulatory schemes and are therefore impliedly preempted. Colorado's Artificial Intelligence Act was specifically cited as an example of such state-level regulation.
Key Dates
- December 2024: Presidential executive order directs the FTC to issue a policy statement on state laws requiring alteration of AI model outputs.
- Early 2025: FTC releases proposed policy statement on AI accuracy and manipulation. Commission vote authorizes Federal Register notice (2-0).
- July 31, 2026: Public comment period closes.
Control Gaps Identified
This isn't a traditional security incident, but it reveals control gaps across three domains:
Transparency and Disclosure Controls: The policy statement targets failures to disclose material information about AI system behavior. If you're marketing an AI system as objective or accurate while altering outputs to favor specific viewpoints, you're creating a gap between represented capabilities and actual performance. This includes failures in:
- Product documentation accuracy
- Marketing claims substantiation
- User interface disclosures about system limitations
- Model card completeness
Output Integrity Controls: The statement implies organizations lack sufficient controls to prevent unauthorized or undisclosed manipulation of AI outputs. You need technical controls that:
- Log all modifications to model behavior or output filtering
- Require approval workflows for changes affecting output characteristics
- Maintain version control for prompt engineering, guardrails, and post-processing rules
- Document the business justification for any output modification
Regulatory Compliance Monitoring: Organizations operating across multiple states face a patchwork of AI regulations. The FTC's preemption argument creates uncertainty about which requirements actually apply. Missing controls include:
- Legal requirement tracking for AI-specific state laws
- Conflict analysis between federal and state AI obligations
- Escalation procedures when compliance with one jurisdiction contradicts another
Relevant Standards
FTC Act Section 5 prohibits unfair or deceptive acts or practices. The FTC's interpretation here centers on two elements:
Deceptive conduct: Representations about AI accuracy, objectivity, or suitability must not be misleading. If you tell users your system provides unbiased results, you can't secretly tune outputs to favor particular conclusions.
Material omissions: Failing to disclose that you're modifying outputs to achieve ideological objectives is a material omission if consumers would consider that information important in deciding whether to use your system.
The NIST AI Risk Management Framework provides relevant guidance under its Govern and Map functions. The framework calls for documenting AI system purposes, limitations, and known failure modes. If you're altering outputs in ways users wouldn't expect, you're failing the transparency measures the framework recommends.
ISO/IEC 42001 (AI management systems) requires organizations to identify and document AI system purposes, establish criteria for AI system performance, and maintain records of decisions affecting AI system behavior. Section 6.1.2 specifically addresses risk assessment, which should include reputational and regulatory risks from undisclosed output manipulation.
The EU AI Act takes a different approach but reaches similar conclusions. High-risk AI systems must meet transparency obligations under Article 13, including information about system capabilities and limitations. If your system is available in the EU and you're modifying outputs without disclosure, you're likely non-compliant with transparency requirements.
Action Items for Your Team
Document every output modification: Create a change log for any adjustment to your AI system's behavior, whether it's prompt engineering, output filtering, or model fine-tuning. Include the business justification, approval chain, and whether the change affects claims you make to users. This isn't optional if you're subject to FTC jurisdiction.
Audit your marketing claims against actual system behavior: Pull every public statement you've made about your AI system's accuracy, objectivity, or capabilities. Test whether your system actually performs as described. If you've claimed objectivity while implementing undisclosed bias corrections, you've created FTC Act exposure.
Map your state-level AI obligations: Colorado isn't the only state regulating AI. Track requirements in every jurisdiction where you operate. Document conflicts between state mandates and federal guidance. When you identify a conflict, escalate to legal counsel rather than defaulting to the stricter requirement.
Build transparency into your user interface: If you're modifying outputs for any reason, disclose it. Consider a model card or system card that explains:
- What the system is designed to do
- What it's not designed to do
- How you've tuned or filtered outputs
- Known limitations or biases
Establish a cross-functional AI governance committee: You need legal, compliance, product, and engineering in the same room reviewing AI system changes. Engineering can't unilaterally decide to adjust outputs, and legal can't impose requirements without understanding technical feasibility.
Prepare for the comment period: If your organization develops or deploys AI systems, submit comments before July 31, 2026. The FTC is explicitly seeking input from businesses about state law conflicts and practical compliance challenges. Your comments become part of the administrative record and may influence the final policy.
Review your vendor AI systems: If you're using third-party AI tools, you inherit their FTC Act exposure. Ask vendors whether they modify outputs, how they handle competing state requirements, and what disclosures they provide to end users. Get these answers in writing.
The FTC's proposed statement doesn't create new legal obligations. Section 5 has prohibited deceptive conduct since 1914. What's new is the Commission's explicit application of that framework to AI accuracy claims. If you've been treating AI disclosures as optional, that assumption just became significantly riskier.
