FTC: the baseline AI enforcement authority
The FTC's Section 5 authority covers businesses that use AI in ways that are unfair or deceptive — false claims about AI capabilities, AI used to discriminate against protected groups in consumer contexts, chatbots that deny being AI when asked, and training AI on customer data not disclosed in privacy policies. The FTC's 2024 AI policy statement confirms this authority applies fully to AI, and small businesses are not exempt.
Sector-specific obligations
Healthcare: HIPAA prohibits disclosing PHI to AI tools without a Business Associate Agreement — most general-purpose AI tools do not offer BAAs. Financial services: ECOA adverse action notices must state specific reasons when AI denies credit. Real estate: Fair Housing Act prohibits algorithmic discrimination. Education: FERPA restricts use of student records; COPPA requires parental consent for under-13s.
