The Federal Trade Commission issued a Policy Statement on AI Accuracy in late June 2026, clarifying its position on how existing consumer protection authority applies to AI-generated outputs. The statement does not introduce new law — it interprets existing FTC Act Section 5 authority covering “unfair or deceptive acts or practices.” But its practical implications for businesses deploying customer-facing AI are significant, and the comment period closes July 31.
This briefing explains what the policy means, which organisations carry the highest exposure, and what the board should understand about the risk and the comment window.
What the FTC Is Saying
The policy statement establishes three core positions:
Deploying AI that produces inaccurate outputs affecting consumers is potentially actionable. The FTC has long held that false or misleading statements to consumers can constitute deceptive practices. The policy clarifies that this principle applies when the false or misleading statement is generated by an AI system — regardless of whether a human reviewed the output before it reached the consumer.
The “AI did it” defence does not work. A business cannot escape FTC liability by attributing a harmful inaccuracy to its AI model. The company deploying the AI is responsible for the outputs that reach consumers. This applies to AI in customer service, product recommendations, financial guidance, health information, and any other consumer-facing context.
Reasonable accuracy standards vary by context and consequence. The FTC acknowledges that some level of AI error is inherent. What constitutes an “unfair or deceptive” failure depends on the stakes involved: an AI that gives slightly imprecise product descriptions carries different exposure than one that provides inaccurate medical or financial information. The higher the consequence of a wrong answer, the higher the accuracy obligation.
Who Carries the Most Exposure
The policy is not targeted at every business using AI. Enforcement attention will concentrate on deployments where inaccuracy creates material consumer harm. Highest-risk categories:
Financial services AI: AI-generated investment guidance, loan terms, insurance coverage explanations, or benefits summaries that are materially inaccurate. DORA-regulated entities in the EU face parallel obligations; US financial sector organisations face CFPB and state-level exposure on top of FTC authority.
Healthcare AI: AI symptom checkers, diagnosis assistants, medication interaction tools, or mental health chatbots that produce inaccurate outputs. FDA oversight applies to medical device software, but FTC consumer protection authority covers consumer-facing AI that doesn’t fall under FDA jurisdiction.
AI in advertising and e-commerce: Product descriptions, price representations, availability claims, or review summaries generated by AI that are materially false. This is the broadest exposure category by volume of businesses affected.
AI customer service and dispute resolution: AI that misrepresents consumer rights, warranty terms, or the outcome of a dispute process in ways that benefit the business at the consumer’s expense.
Board-Level Risk Assessment
The policy creates two categories of risk: enforcement risk and litigation risk. They are related but distinct.
Enforcement risk is the risk of an FTC investigation and action. The FTC has limited enforcement resources and will prioritise cases with large consumer impact and clear evidence of harm. Organisations with robust AI governance documentation — policies governing what AI outputs can and cannot do, accuracy testing before deployment, monitoring of deployed AI outputs, and mechanisms for consumers to flag and correct inaccurate outputs — are materially less likely to be enforcement targets, even if some inaccurate outputs occur.
Litigation risk is the risk of private lawsuits. The policy statement may be cited in consumer class actions, particularly in states with unfair business practices laws that parallel FTC Act standards (California UCL, New York GBL, etc.). Unlike FTC enforcement, private litigants can bring cases with smaller class sizes and lower harm thresholds. The policy gives plaintiffs’ counsel a cleaner argument that AI inaccuracy can constitute an unfair or deceptive practice.
For board risk assessment purposes: enforcement risk is manageable through governance investment; litigation risk should be factored into legal reserves for any organisation deploying customer-facing AI at scale.
What Good Governance Looks Like
The FTC policy does not specify what “reasonable” accuracy means — it will be determined case-by-case based on context and harm. But the elements of a defensible AI governance posture are consistent across regulatory contexts:
Pre-deployment accuracy assessment: Documented testing of AI outputs in the context it will be deployed, with accuracy benchmarks defined against the consequences of error. A claims processing AI and a product recommendations AI require different accuracy standards.
Output scope restrictions: Clear limits on what the AI is permitted to say. Customer-facing AI in financial or health contexts should be constrained from generating output on topics where inaccuracy carries legal liability. Restrictions enforced in the system rather than relying on model training are more defensible.
Consumer correction mechanisms: If AI generates an inaccuracy affecting a consumer, there must be a clear path for the consumer to identify the error and receive a correction. Closed-loop AI interactions with no human review or escalation path are the highest enforcement-risk pattern.
Incident logging: The ability to reconstruct what an AI told a consumer and when. In any enforcement or litigation context, the first question is “what did your AI say?” If you can’t answer it, your governance position is weak.
The Comment Period
The public comment period for the policy statement closes July 31, 2026. Comments are submitted through the FTC’s public comment portal. For most organisations, the most valuable submission is one that addresses the practical challenges of defining and measuring “accuracy” for specific AI use cases, and provides constructive input on how safe harbour provisions or compliance frameworks might reduce litigation risk without reducing accountability.
If your organisation uses AI in consumer-facing contexts, legal and compliance teams should review the policy statement before the deadline regardless of whether you plan to comment. The policy articulates the FTC’s current interpretive framework — understanding it is a prerequisite for assessing your current exposure accurately.
Action Points for CISOs
- Map all customer-facing AI deployments against the risk categories above and identify which carry the highest accuracy-consequence exposure
- Verify that pre-deployment testing documentation exists for each deployment and is current
- Confirm that consumer escalation and correction mechanisms are functional and logged
- Brief the board on litigation risk in addition to enforcement risk — the class action exposure may be more immediate than the regulatory exposure
- Engage legal counsel on whether to submit to the FTC comment period before July 31