The Federal Trade Commission has initiated at least 13 enforcement actions since launching Operation AI Comply in September 2024. Every one of these cases targets marketing deception—what is commonly called AI washing—rather than the actual behavior of the software. While the agency is aggressively policing the gap between vendor promises and tool capabilities, the internal mechanics of autonomous agents remain outside the scope of federal oversight.
This focus on marketing claims is the primary axis of current federal enforcement. Settlements such as the $930,000 agreement with CMG Media in May 2026 regarding a fictitious ‘Active Listening’ tool, and the $50 million settlement with Growth Cave in January 2026, demonstrate a clear pattern. The agency is effectively policing the distance between a vendor’s claims and the software’s actual capabilities. However, this approach leaves the operational reality of autonomous agents largely untouched.
The Congressional Research Service confirmed in report IF13151, published July 6, 2026, that there is currently no federal guidance specifically addressing agentic AI. Although the AI AGENT Act was introduced as a discussion draft in June 2026 to establish a registration framework and designate the FTC as the principal authority for consumer-focused autonomous agents, it has not been enacted. Consequently, while the federal government is building a toolkit—including the March 2026 AI Policy Statement and proposed policies on deceptive steering and personalized pricing—these tools have yet to be applied to the actual behavior of deployed agents.
A regulatory divergence is emerging at the state level. In jurisdictions like Connecticut, Maryland, and New Jersey, state laws are beginning to capture autonomous agents through broad definitions of price-setting devices, as our analysis of state surveillance pricing laws details. This creates a fragmented environment where a company might be compliant with federal marketing standards while simultaneously running afoul of state-level operational requirements for algorithmic pricing. The tension between state AI regulation and federal preemption, as seen in Colorado’s ADMT rulemaking, compounds this divergence.
This divergence is compounded by the FTC’s increasing use of the ‘means and instrumentalities’ doctrine. As noted in an August 2026 analysis by Holland & Knight, this doctrine allows the agency to hold vendors liable for deceptive materials supplied to downstream companies. Compliance is no longer just about direct-to-consumer messaging; it extends to the marketing materials B2B partners use to describe the technology.
There is a clear disconnect between marketing compliance and operational safety. A system can be marketed with perfect accuracy—avoiding the AI washing traps that trigger FTC enforcement—while still exhibiting deceptive or harmful behavior in its autonomous execution. A May 2026 study from NYU documented deceptive conduct by AI agents within commercial simulations. Despite this evidence, federal enforcement has not yet pivoted to address the agents themselves.
Relying on the absence of federal agent-specific enforcement as a proxy for safety is a strategic error. The FTC’s current trajectory suggests that while they are occupied with the claims made about AI, the behavior of these systems is being documented by researchers and captured by state-level definitions. Operational safety is a distinct engineering requirement, separate from the legal requirements of marketing disclosure. It is possible to be perfectly compliant in claims and still be structurally exposed in operations.