On September 30, the Federal Trade Commission (FTC) confirmed it is investigating Anthropic, OpenAI, and other artificial intelligence companies over the risks their products may pose to consumers. An agency spokesperson told CBS the question is whether company conduct breaks the FTC Act, the statute that polices unfair or deceptive acts and fair competition. The file opened this summer. Wednesday's news is the public confirmation: compulsory process is next, not another voluntary pledge.

Agent escapes, training sandboxes that reached live systems, and cybersecurity incidents the labs themselves disclosed are already in the open. Boards do not need a new statute to feel this. They need a named owner for the FTC file the week after six labs signed a White House checklist. (CBS; NY Post; Bloomberg Law)

Next comes paperwork with teeth. The FTC is drafting civil investigative demands, the agency's version of a subpoena, to pull documents and put executives under oath about product dangers to consumers. Bloomberg says the demands are likely in the coming weeks. METR, the Berkeley nonprofit that evaluates frontier systems, is also expected in the information ask.

That is a production schedule, not a press release. Put the CID timeline next to every vendor still answering safety questions with a blog post. (NY Post; Bloomberg Law; CBS)

Tuesday at the White House, the same labs signed the Accord on Super Intelligence, a voluntary Joint Commitment on Frontier Responsibilities. Four layers sit in the text: internal controls, an empowered internal team, an independent external auditor, and an independent board committee. Trump called it morally binding. FTC Chair Andrew Ferguson was in the room.

Vice President Vance spent that afternoon arguing against a new FDA-style AI regulator. His line: the FTC and the Department of Justice already have the tools. Wednesday the FTC confirmed those tools are in use. Voluntary checklist on Tuesday. Public investigation on Wednesday. Keep both on one page. (The Accord; CBS; Bloomberg Law)

Across the Atlantic, September 30 was a governance day, not a new fine day. The United Kingdom's Information Commissioner's Office became the Information Commission under the Data (Use and Access) Act 2025. Power used to sit with a single commissioner. Now a body corporate of executive and non-executive members shares the decisions.

Day-to-day powers, guidance, and complaints stay put. The brand still answers as the ICO. For boards buying frontier stacks into UK data flows, the counterparty renamed itself the same week Washington put CIDs on the calendar. Update the org chart. Do not treat the risk file as closed. (GOV.UK; ICO)

Thursday already put The Accord on the desk, now sent: six frontier labs and President Trump signing a voluntary White House Joint Commitment with external auditors and an independent board committee, plus the same-day Super Intelligence rename executive order. Wednesday's Florida's Hold stays sent: Attorney General James Uthmeier's temporary-injunction motion in Highlands County under Florida's Deceptive and Unfair Trade Practices Act (FDUTPA). Tuesday's The AGs' Ask stays sent. Monday's Oregon's Frontier Buy stays sent. Sunday's Supply Chain Risk stays sent. Saturday's Agents That Probe stays sent. Friday's Virginia Executive Order 22 stays sent. California's Executive Order N-9-26 stays. The Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) Interagency Report (IR) 8587 token guide stays put.

Those are the voluntary Accord, the Florida court hold, the federal ask, the Oregon buy gate, the procurement statute, the forensic agent map, Richmond, Sacramento, and the federal token track. Friday's file is the FTC's consumer-risk probe with CIDs coming. (The Accord; Florida's Hold; The AGs' Ask; Oregon's Frontier Buy; Supply Chain Risk; Agents That Probe; Virginia; Governor's Office — California; CISA)

Thursday's Agencia Española de Protección de Datos (AEPD) agent breach notice, Wednesday's Korea Internet & Security Agency (KISA) guide, Tuesday's Altman monitorability wall and multi-lab pact, and Monday's Amodei evaluator desks stay on the desk.

They already had their mornings. Madrid, Seoul, the older pact track, and permanent reviewers next to today's FTC probe. (AEPD; SEDaily; TechTimes; Amodei)

Before the first CID lands, put three blanks on one page. Which frontier vendors in your stack already have a named owner for an FTC information demand, and who gathers the incident logs, training-sandbox notes, and consumer-harm claims without a scramble. Who signs if the demand asks how the White House Accord's four layers actually work inside the company, not on the signing table. What do you tell the board if Florida's temporary hold and Washington's voluntary checklist both stay live while compulsory FTC process starts.

Write the questionnaire now. Put the same blanks next to every lab on the Accord signature list, then copy it to every integrator marketing "frontier-safe" without a CID response plan. (CBS; The Accord)

The Move

The FTC just confirmed a consumer-risk investigation into the same frontier labs that signed a voluntary White House Accord two days earlier. CIDs and executive testimony are on the calendar. No new statute. Compulsory process under a law that has sat on the books for decades.

Send counsel and the chief information security officer (CISO) a one-pager. Ask who owns the FTC answer sheet today, how the Accord's four layers map to what a CID will actually request, and how Florida's temporary-hold file sits next to a federal probe that does not need a new regulator to land a punch.

If the answer is "we only buy commercial," the blank still goes next to every contractor pulling frontier models into your stack, or into any state reading this probe beside Highlands County.

Seven bullets. One move.