The FTC, SEC, state attorneys general, DOJ, EEOC, and private plaintiffs are all pursuing AI enforcement simultaneously in 2026 using existing statutes — no new federal AI law is required. The four highest-exposure areas: deceptive AI capability claims (FTC Section 5), AI washing in investor communications (SEC), biased automated decisions (EEOC, state AGs), and inadequate incident disclosure. For small teams, the practical implication is that a single governance gap is now simultaneously exposed to multiple enforcement channels with different standards and different remedies.
At a glance: There is no unified federal AI law, but there is no enforcement gap either. Federal agencies, state AGs in California, Colorado, New York, and Texas, and private plaintiffs are all moving simultaneously on AI enforcement in 2026. The single most effective risk control: make your AI capability claims accurate and document that they are accurate. Most enforcement actions begin with a gap between what a company said its AI does and what it actually does.
For small teams, the multi-channel enforcement landscape means a compliance failure that would previously attract one agency's attention may now attract several. Here is what the current AI enforcement risk landscape looks like and what governance controls actually reduce exposure.
Key Takeaways
- Four high-exposure areas for 2026: (1) privacy compliance failures, (2) securities disclosure accuracy ("AI washing"), (3) False Claims Act exposure in government AI contracts, and (4) coordinated multistate AG enforcement.
- The FTC's Operation AI Comply (2024-2025) established that inflated AI capability claims are an enforcement priority under Section 5, with or without new legislation.
- The SEC treats AI washing — misrepresenting AI capabilities to investors or in filings — the same way it treats greenwashing: as material misrepresentation.
- State AGs do not need state-specific AI laws to act. Existing consumer protection and antitrust statutes apply.
- The single most effective risk control: make your AI capability claims accurate and document that they are accurate. Most enforcement actions begin with a gap between what a company said its AI does and what it actually does.
Summary
AI governance has entered active enforcement. The Morgan Lewis analysis identifies a shift that practitioners in the SEC world recognized first — regulators are not waiting for comprehensive AI legislation to bring cases. They are using what they have: FTC Act Section 5, SEC disclosure rules, the False Claims Act, and state consumer protection statutes. The result is that an AI governance gap creates simultaneous exposure across multiple enforcement channels simultaneously. For small teams, the most practical risk reduction strategy is accuracy: document what your AI actually does, make sure your public claims match that documentation, and maintain that alignment through any regulatory filing or marketing update.
The Four High-Exposure Areas
- Privacy compliance failures
AI systems often process personal data at scale, frequently exceeding the scope of privacy notices and consent frameworks originally designed for human-operated processes. The Morgan Lewis analysis highlights three specific failure patterns:
- AI tools that access personal data beyond their disclosed purpose (an AI system given access to customer databases to answer service queries, which then uses that data for model training or performance logging)
- AI outputs that constitute "decisions" about individuals without the disclosure or opt-out rights required under CCPA, Colorado Privacy Act, or similar frameworks
- AI systems processing sensitive categories (health data, financial data, location) without the heightened consent required by state privacy laws
The FTC has explicitly stated that using personal data in ways that exceed disclosed purposes — whether by a human or an AI system — is an unfair practice under Section 5. No AI-specific rule is needed.
- Securities disclosure accuracy — AI washing
The SEC's FY2026 examination priorities — which embed AI oversight across every exam category — reflect an enforcement posture the Commission has already acted on. In 2024 and 2025, the SEC brought enforcement actions against investment advisers and asset managers that claimed to use AI in portfolio construction or investment decisions when they were using rules-based or manual processes. The pattern is identical to greenwashing enforcement: material misrepresentation to investors.
For small teams, the AI washing risk has three common manifestations:
- Marketing materials claiming "AI-powered" analysis when the underlying process is rule-based screening
- ADV filings describing AI integration in investment decisions that is not actually operational
- Board or investor presentations citing AI capabilities that are aspirational, not current
The standard the SEC applies is simple: does the description of your AI capabilities in public or investor-facing documents accurately describe how your AI actually operates? If not, it is potentially a disclosure violation.
- False Claims Act exposure in government AI contracts
The DOJ has signaled AI governance misrepresentation in federal contracting as an enforcement priority. Under the False Claims Act, a contractor that falsely certifies compliance with government AI requirements — security, safety, fairness, or governance controls — and receives federal funds based on that certification faces treble damages and civil penalties.
This exposure is not hypothetical. The Biden-era AI executive orders created AI governance requirements for federal contractors. The current administration has modified but not eliminated those requirements. Contractors that certified compliance with governance controls that did not actually exist may face both enforcement and qui tam relator actions from employees or competitors with knowledge of the gap.
- Coordinated multistate AG enforcement
State AGs in California, Colorado, New York, and Texas have each brought AI-related consumer protection investigations or actions without state-specific AI statutes. They use existing unfair business practices, deceptive trade, and antitrust law. The coordination piece is new: multistate coalitions are pooling resources for investigations — allowing AGs to pursue companies that would be too large or technically complex for a single state office to tackle alone.
The Morgan Lewis analysis notes that multistate AI enforcement is following the pattern established by multistate data breach enforcement: initial investigations are information-demand focused, giving companies opportunity to explain their AI governance posture before formal action. Organizations that cannot produce documentation of their AI governance program face a much more difficult negotiating position than those who can.
Why Small Teams Face Disproportionate Exposure
Large organizations often have marketing review processes, legal sign-off on regulatory filings, and technical documentation standards. Small teams frequently do not. Three patterns create outsized risk:
Marketing that outpaces product. A small AI startup claims "AI-driven" capabilities in investor materials and sales decks before those capabilities are fully operational. The FTC and SEC both treat this as deceptive — the intent to eventually build the feature does not immunize the current misrepresentation.
No process to maintain alignment. A company accurately describes its AI capabilities at the time of a marketing refresh or ADV filing. The AI product then changes significantly. No one updates the marketing or the filing. Six months later, the external representation is materially wrong. This drift is an extremely common pattern and a standard enforcement predicate.
Vendor AI claimed as proprietary. A company describes its AI as "proprietary" when it is actually a foundation model from Anthropic or OpenAI with a thin wrapper. This may constitute a deceptive capability claim to the extent customers or investors are paying a premium for supposed proprietary technology. The hidden AI features governance gap often starts here — teams do not fully document what their AI is so they cannot describe it accurately.
Governance Goals
For a small team, the governance goal against multi-channel enforcement risk is straightforward: maintain a single source of truth about what your AI actually does, and ensure all external representations — marketing, regulatory filings, investor communications, government contracts — match that source of truth.
- AI capability inventory: documented description of each AI system's actual functionality, current operational status, and the evidence basis for any capability claim
- Claims audit process: a process (even informal) to review marketing materials and regulatory filings against the capability inventory before publication
- Drift monitoring: a cadence (quarterly is sufficient) to check whether existing external claims still accurately describe current AI capabilities
- Government contract review: for any federal or state government contract, an explicit review of AI governance certifications against actual governance practices
Controls: What to Actually Do
This week:
- Pull your most recent marketing materials and regulatory filings (ADV, government contract certifications, investor deck). Identify every claim about AI — what it does, how it performs, what oversight exists.
- Compare each claim against what your AI actually does today. Flag any gap.
This month:
- Document the actual operational status of each AI capability claimed externally. For any claim that is aspirational rather than operational, either update the external materials or add a clear forward-looking qualifier.
- Establish a review step — even a single email chain — before any AI-related capability claim goes into marketing, regulatory filings, or government contracts. Document that the review occurred.
- Review privacy notices for any AI system that processes personal data. Confirm the notice accurately describes how AI is using that data.
Ongoing:
- Run a quarterly AI claims alignment check: current AI capabilities vs. current external representations. Document the check and any updates made.
- Add an AI governance documentation request to your vendor due diligence process. If a vendor's AI governance documentation does not match their marketing claims, that is a risk signal for your own reliance on their capability representations.
- Track the Morgan Lewis multistate enforcement update and the FTC's Operation AI Comply follow-on actions for the specific fact patterns being targeted.
Checklist (Copy/Paste)
- Audit all AI capability claims in marketing materials, filings, and investor communications
- Compare claims to actual current AI functionality; document gaps
- Update or qualify any claim that is aspirational rather than operational
- Establish pre-publication review for AI capability claims
- Review privacy notices for AI data processing accuracy
- Audit government contract AI governance certifications against actual practices
- Implement quarterly AI claims alignment check cadence
- Add AI governance documentation to vendor due diligence checklist
- Document all reviews and updates as evidence of good-faith compliance effort
Implementation Steps
- Day 1: Assign someone to own the AI claims audit. This is a 2-4 hour task, not a project — one person reviewing current marketing and filings against what the AI actually does.
- Week 1: Complete the gap analysis. For each gap, make a decision: update the external claim to match reality, or update the product to match the claim. Document the decision.
- Week 2: Update privacy notices and government contract certifications. These are the highest-risk external representations because they are submitted to regulators under penalty of perjury or subject to federal enforcement.
- Week 3: Establish the quarterly claims alignment check as a recurring calendar item. Assign ownership.
- Ongoing: When your AI capabilities change significantly, trigger an out-of-cycle claims review. Product releases and model changes are the most common source of drift.
Frequently Asked Questions
Q: We use "AI" loosely in marketing but we have rules-based logic underneath. Is this AI washing? A: It depends on context. Describing a rules-based system as "intelligent" in passing marketing copy is different from claiming "AI-powered investment decisions" in a regulatory filing. The higher the stakes context — investor communications, regulatory filings, government contracts — the more precise the description needs to be. When in doubt, describe what the system actually does rather than reaching for AI branding.
Q: The FTC's enforcement posture has shifted under the current administration. Should we still worry about FTC AI enforcement? A: Yes. The FTC's Operation AI Comply enforcement actions from 2024-2025 are settled and on the books. More importantly, state AGs and private plaintiffs are not subject to the same political constraints as the FTC. Even if federal enforcement appetite shifts, state-level exposure under consumer protection law remains active.
Q: We are a B2B company and do not market to consumers. Does the FTC's consumer protection jurisdiction reach us? A: The FTC's Section 5 jurisdiction is broader than consumer-facing businesses — it covers "unfair or deceptive acts or practices in or affecting commerce," which includes B2B representations. However, state AG consumer protection statutes vary. In a B2B context, the most relevant enforcement channel is typically the False Claims Act (if government customers are involved), SEC (if public companies are involved), and private plaintiff breach of contract or fraud claims.
Q: What is coordinated multistate AG enforcement and how does it start? A: It typically starts with a civil investigative demand (CID) — a subpoena-like request for documents and information about the company's AI practices. Organizations that receive a CID should engage outside counsel immediately. The most common trigger is a consumer complaint that reaches multiple state AG offices simultaneously, or investigative reporting that prompts AG interest. Having documented AI governance in place before a CID arrives substantially improves the negotiating position.
For teams building their response documentation, the AI Incident Response Playbook covers the record-keeping structure that satisfies both FTC and state regulators.
References
- AI Enforcement Accelerates as Federal Policy Stalls and States Step In (Morgan Lewis, April 2026): https://www.morganlewis.com/pubs/2026/04/ai-enforcement-accelerates-as-federal-policy-stalls-and-states-step-in
- FTC Operation AI Comply — enforcement actions summary (FTC.gov): https://www.ftc.gov/business-guidance/blog/2024/09/operation-ai-comply-continuing-crackdown-overpromises-ai-snake-oil
- SEC FY2026 Division of Examinations Priorities (Harvard Law Forum): https://corpgov.law.harvard.edu/2026/01/04/2026-sec-division-of-examinations-priorities/
- NIST AI Risk Management Framework — Govern function: https://www.nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf
- Colorado AI Act SB 24-205: https://leg.colorado.gov/bills/sb24-205
