AI Washing Legal Risk 2026: FTC & SEC Enforcement

Does AI Washing Put Your Company at Legal Risk in 2026?

The FTC charged DoNotPay in 2024 with deceptive AI claims, extracting a $193,000 settlement after the company marketed its chatbot as "the world's first robot lawyer" without evidence to support that claim. That case is not the ceiling. It is the floor.

What Is AI Washing and Why Does It Create Legal Risk in 2026?

AI washing means making unsubstantiated or exaggerated claims about a product's AI capabilities in marketing, investor, or sales materials. In 2026, this is no longer a brand problem: the FTC, SEC, and EU regulators treat these claims as potential consumer deception, securities fraud, or investor manipulation simultaneously, each carrying its own enforcement track and penalty schedule.

Most executives assume AI washing is a marketing problem, something for the brand team to manage. They picture a slapped wrist, a corrected webpage, and a short press cycle. The legal reality in 2026 is different.

Regulators now treat unsubstantiated AI performance claims as potential securities fraud, consumer deception, and investor manipulation simultaneously, each carrying its own enforcement track. The FTC's 2023 "AI Claims" policy guidance made clear that partial AI integration does not excuse inflated capability claims. The agency specifically flagged phrases like "AI-powered," "intelligent automation," and "machine learning-driven" as triggers requiring documented substantiation.

What Does the FTC and SEC Enforcement Record Show?

The FTC and SEC have both moved from guidance to active penalties, making AI washing a documented enforcement priority rather than a theoretical risk. The FTC opened more than 50 investigations into AI-related marketing claims between 2022 and 2025, according to agency public records. The SEC separately charged two investment advisers in March 2024 for making false AI claims without supporting systems.

The SEC charged Delphia and Global Predictions in March 2024 for false claims about using AI to inform investment decisions, collecting $400,000 in combined penalties, according to the U.S. Securities and Exchange Commission. Both firms used AI language in marketing materials without the underlying systems to support it.

The EU AI Act adds a third regulatory vector. Non-compliant AI claims in regulated sectors face fines up to 3 percent of global annual revenue, according to the European Commission's published penalty schedule. For a company with $500 million in revenue, that is $15 million per violation.

Does EU AI Act Compliance Affect How Companies Market AI in Banking and Finance?

EU AI Act compliance directly reshapes AI marketing obligations for banking and finance companies operating in European markets. Financial services firms classified under high-risk AI categories face fines up to 3 percent of global annual revenue for non-compliant AI claims, and regulators are cross-referencing marketing language against actual system capabilities as part of audit procedures starting in 2026.

Two patterns illustrate where companies most often underestimate their legal risk.

The first is the vendor pass-through trap. A CFO signs a contract with a software vendor whose platform is marketed as "AI-driven cash flow forecasting." The company repeats that claim in its own investor materials. The underlying system turns out to be a rules-based algorithm with a thin machine learning wrapper. Courts and regulators have consistently held that companies repeating a vendor's unsubstantiated claims take on shared liability, according to FTC guidance on endorsements and testimonials.

The second is the product announcement timing problem. A public company issues a press release claiming its new AI platform "reduces operational costs by 40 percent." No third-party validation exists. When the stock rises 12 percent on that announcement and then retraces after the product underperforms, the SEC has a direct path to a Section 10(b) fraud investigation. Securities lawyers documented this exact pattern in at least four enforcement inquiries opened in 2024 and 2025, according to reporting by The Wall Street Journal.

KEY TAKEAWAY: Repeating an AI vendor's performance claims in your own investor or customer materials transfers legal liability to your company. Document the evidence chain before any claim goes public.

Three Steps That Close Most of the Exposure

Three steps close most of the exposure before regulators ask questions.

First, audit every external AI claim your company makes, including vendor materials you redistribute. Assign your general counsel or chief compliance officer ownership of an AI claims registry. Every claim needs a source document: a controlled test result, a third-party audit, or a vendor contract with performance warranties.

Second, stop using capability language your product cannot yet demonstrate. "AI-assisted" is defensible. "AI-powered" requires specificity. "Industry-leading AI" requires a benchmark. The FTC's substantiation standard requires evidence in hand before the claim is published, not after.

Third, build a documentation trail for every significant AI marketing claim. The FTC and SEC both reward cooperation and early remediation. Companies that self-document demonstrate good faith. Companies that cannot produce any substantiation appear to have known the claims were false.

For a deeper look at how governance frameworks protect companies from AI-related regulatory exposure, read the full analysis on AI Agent Governance Framework: 5-Step Control Plan. For the banking-specific compliance picture under the EU AI Act, see EU AI Act Enforcement: AI Compliance Banking Guide.

Sources

1. U.S. Federal Trade Commission, "FTC Takes Action Against DoNotPay." https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-donotpay
2. U.S. Securities and Exchange Commission, "SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence." https://www.sec.gov/news/press-release/2024-36
3. European Commission, "Regulatory Framework for AI." https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
4. FTC Commissioner Commentary on AI Self-Regulation Limits. http://www.adexchanger.com/data-privacy-roundup/hot-takes-from-ftc-commissioner-mark-meador-on-cookies-and-the-limits-of-self-reg/