When an AI Vendor Says Its Chatbot Is Safe
FTC investigative demands to major AI providers show why business buyers must ask for test evidence, limitations, and incident reporting — not sales assurances alone.
Short answer
A provider's general safety claim does not establish that a system is safe for your specific use case — customer advice, confidential data, or automated decisions need evidence of testing, known limits, access controls, and incident notification. Replace vague reassurance with documented tests on realistic scenarios and contract terms that allocate responsibility.
Every business buying AI services eventually encounters reassuring promises: the system is safe, properly tested, and ready for customers. The difficulty is knowing what those statements actually mean for the work the buyer wants the system to perform.
On 14 October 2026, the United States Federal Trade Commission issued investigative demands to OpenAI and Anthropic. Axios reported the requests the following day, and CBS News obtained confirmation from the agency. The investigators sought information about safety incidents, safeguards, and related consumer protection concerns. An investigation is a request for evidence, not a finding that either company broke the law.
For business customers, the significance is broader than the companies named. A provider may have tested its software thoroughly for general use, while a particular customer plans to use it for sensitive financial information, medical communications, or decisions about people. Safety in one setting does not establish safety in every setting.
Consider a company introducing an AI assistant for customer enquiries. The supplier demonstrates that it can answer questions quickly and politely. But what happens when it invents a refund entitlement, gives misleading advice about a contract, or reveals information from another customer? Has anyone tested those circumstances? Who is informed when something goes wrong? Can the business switch off the affected function without losing essential services?
A sales presentation rarely answers these questions in enough detail. Nor does a certificate or a general assurance remove the customer's responsibility to understand how the technology is used within its own business.
What to do
Ask the supplier for evidence suited to your intended use. What tests were performed, and what were the results? Which known limitations apply? What information can the system access? What happens when it is uncertain, refuses a request, or produces a harmful answer? How quickly must the supplier report an incident, and what records can the customer obtain?
Then test the system with realistic examples from your own operations. Keep the results, including failures and changes made in response. Name a person responsible for investigating complaints and deciding when human approval is mandatory. Check that contracts explain responsibilities for incidents, privacy, and service changes.
The objective is not to demand that every supplier prove an impossible absence of risk. It is to replace a vague promise with evidence that allows an informed decision.
Sources
- Axios, 15 October 2026 — FTC investigative demands to OpenAI and Anthropic.
- CBS News, updated 15 October 2026 — agency confirmation of subpoenas.
- ISO/IEC 42001 explained — International Organization for Standardization.
Supplier assessments, realistic testing plans, and incident procedures are part of our AI Governance Gap Assessment — the starting point when a critical vendor question is still unanswered.