Thirteen Actions. Zero Agent Cases. The FTC's Enforcement Gap.

Thirteen enforcement actions since September 2024. Every single one targets marketing deception. Not one targets the behavior of autonomous agents. That is the data point defining the current regulatory landscape for AI in the United States. The Federal Trade Commission is active. It is not, however, active where the next systemic risk lives. This is not an opinion. It is a reading of the enforcement docket. The gap between what the FTC polices and what the technology actually does is the widest I have observed since the 2020 DeFi liquidity crisis. Back then, the market priced yield without stress-testing counterparty risk. Today, the market prices compliance without stress-testing agent behavior. The parallel is structural. The legal foundation for this gap is thin. The FTC operates under Section 5 of the FTC Act, a principle-based grant of authority prohibiting unfair or deceptive acts. It is a powerful tool. It is not a substitute for specific rules. The Congressional Research Service report IF13151 confirms there is no federal guidance for agentic AI. The proposed AI Agent Act remains a discussion draft. It has not moved. This creates a vacuum that state legislatures are filling with fragmented, inconsistent definitions. Connecticut, Maryland, and New Jersey have expanded the definition of "price-setting devices" to capture autonomous agents. The intent is preventive. The effect is uncertainty. These definitions are broad enough to potentially sweep in non-pricing agents, such as customer service or content generation tools. The boundaries are unclear. A company operating across multiple states now faces a patchwork of compliance obligations that may conflict with each other and with federal marketing rules. My audit experience tells me this is where the real exposure sits. The compliance burden is becoming a two-track system. Track one is federal marketing compliance, focused on avoiding "AI washing"—the exaggeration of AI capabilities. Track two is state-level operational compliance, focused on how algorithms actually behave. These tracks are not aligned. A company can pass federal scrutiny while failing state-level operational tests. The disconnect between marketing claims and operational reality is the single largest compliance exposure in the market today. The enforcement record shows where the FTC's priorities lie. The CMG Media case in May 2026 resulted in a $930,000 settlement. The Growth Cave case in January 2026 resulted in a $50 million settlement. Both are about fabricated AI functionality. The scale difference is notable. It suggests the FTC is calibrating penalties to the size of the deception and the consumer harm involved. The $50 million figure may become the benchmark for large-scale marketing fraud. But neither case touches the underlying behavior of the agent itself. The "means and instrumentalities" doctrine is the tool that could change this. Holland & Knight's August 2026 analysis confirms the FTC can use this doctrine to extend liability up the supply chain. A technology vendor that provides deceptive marketing materials to downstream companies can be held responsible, even without direct consumer contact. This is a significant expansion of enforcement reach. It means B2B contracts will need compliance warranties. It means supply chains will be restructured around compliance capability. It means the cost of non-compliance is no longer limited to the company making the claim. Here is the contrarian angle. The market is focused on the wrong risk. The conventional view is that state-level fragmentation is the primary threat. I disagree. Fragmentation is manageable. It is a cost issue. The real risk is a sudden shift in FTC enforcement focus. The agency has the tools. It has the doctrine. It has the precedent of aggressive action in the marketing space. The only missing element is the decision to pivot. When that pivot comes, it will be abrupt. Companies that have built marketing compliance but neglected operational compliance will face a sudden enforcement event with no runway. The NYU research documenting agent deception is the canary. The data exists. The harm is being recorded. The FTC is not acting on it yet, but the evidence base is building. This is exactly how the agency operates. It builds a record, then it moves. The timeline is uncertain. The direction is not. There is also the international dimension. The EU AI Act is already in force. It regulates AI systems by risk level, including agent behavior. The United States has no federal equivalent. This creates a "Brussels Effect" scenario where EU standards become the de facto global baseline. American companies deploying agents internationally will need to meet EU standards regardless of domestic requirements. The regulatory arbitrage window is closing. The question is whether US firms will treat EU compliance as a burden or as a template for building a unified compliance framework. The compliance cost asymmetry is another factor the market is underpricing. Large enterprises can absorb the cost of dual-track compliance. Small and mid-sized firms cannot. This will drive consolidation. Compliance capability will become a competitive moat. The firms that build robust agent-behavior monitoring systems now will have a structural advantage when the enforcement pivot comes. The firms that wait will be acquired or will exit. My recommendation is not to wait for clarity. Clarity is not coming. The AI Agent Act is stalled. State-level rules are diverging. The FTC is focused elsewhere. The rational response is to build a compliance framework that treats marketing claims and operational behavior as a single integrated system. This is not about avoiding punishment. It is about positioning for the next phase of the market cycle. Regulation doesn't create markets. It re-routes them. The firms that understand the re-routing before it happens are the ones that survive the transition. The window for building that understanding is open now. It will not stay open forever. Liquidity vanishes. Code remains. The same logic applies to compliance. The enforcement action will come. The question is whether your code is ready for the audit.