AI companies do not need to violate a law labeled "AI Act" to face enforcement. State attorneys general and federal regulators can use existing consumer protection laws when an AI product is marketed deceptively, omits material limitations, handles consumer data unfairly, or creates risks that conflict with the company's public claims.
That approach has become increasingly important as states investigate and sue AI developers under statutes that long predate generative AI. The legal theory is straightforward: a new technology does not make an old prohibition on unfair or deceptive conduct disappear.
For legal teams, the practical question is not only whether the model works. It is whether product behavior, safeguards, disclosures, evidence, and marketing claims remain aligned throughout the product lifecycle.
Why Existing Consumer Protection Law Reaches AI
Most states have statutes prohibiting unfair or deceptive acts or practices. These laws can apply to representations about safety, accuracy, privacy, performance, human oversight, suitability for minors, or the consequences of using a product.
The Federal Trade Commission has taken the same general position at the federal level. Its Operation AI Comply targeted deceptive AI claims and schemes under existing authority rather than waiting for a single comprehensive federal AI law.
An enforcement theory may focus on what the company said, what it omitted, how the product behaved, and whether internal evidence supported the claim when it was made.
What AI Claims Create the Most Risk?
AI marketing often moves faster than legal substantiation. Statements that sound like ordinary product language can become important if consumers reasonably rely on them.
Legal teams should closely review claims such as:
• "Safe" or "appropriate" for children or vulnerable users.
• "Accurate," "verified," or "hallucination-free."
• "Private," "confidential," or "not used for training."
• "Fully autonomous" or "requires no human review."
• "Compliant" with a law, standard, or professional duty.
• "Unbiased" or able to make neutral decisions.
• "Secure" against misuse, manipulation, or unauthorized access.
The question is not whether a disclaimer appears somewhere in the terms. The overall consumer impression matters. A prominent promise cannot always be cured by a narrow qualification hidden in another document.
Product Behavior Can Contradict the Marketing
An AI system changes over time through model updates, retrieval sources, guardrails, system instructions, integrations, and new user workflows. A claim that was supportable at launch may become inaccurate after a product change.
That creates a monitoring obligation for the business even when the statute does not use that label. Legal and product teams should know:
• Which model and configuration supported the original claim.
• Which tests and incident data were reviewed.
• Whether the claim applies to every user group and use case.
• What changed after launch.
• Whether complaints or safety signals contradicted the claim.
• Who had authority to pause, revise, or withdraw the representation.
The company should be able to connect a public statement to evidence that existed at the time and to a process for reevaluating it.
AI Agents Add an Authority Problem
An AI agent may send messages, access systems, create records, recommend actions, or initiate transactions. When the agent causes harm, the business cannot assume that describing the system as autonomous eliminates responsibility.
Investigators may examine who selected the system, which permissions it received, what instructions governed it, which safeguards were tested, what logs were retained, and whether the company represented that human review would occur.
This makes agent governance partly a consumer protection issue. A company that promises controlled, supervised automation should be able to show the actual controls and supervision.
State Attorneys General Can Move Before Courts Define New AI Rules
State attorneys general can issue investigative demands, seek documents, negotiate assurances, request injunctions, and bring enforcement actions under existing law. They do not always need to wait for a legislature to create a new cause of action specifically for AI.
This can produce different theories across states. One investigation may focus on deceptive safety claims, another on minors, privacy, discriminatory outcomes, subscription practices, or failure to disclose that a consumer is interacting with AI.
Companies therefore need both a national baseline and a state-law map. The baseline should govern evidence, claims, testing, complaints, incidents, and escalation. The map should identify state-specific disclosures, user rights, age-related protections, and enforcement exposure.
New AI Laws and Old Consumer Laws Can Overlap
New statutes do not necessarily replace existing consumer protection law. They may add duties while preserving broader enforcement authority.
Colorado, for example, has enacted requirements concerning automated decision-making and chatbot safety. The Colorado Attorney General's AI rulemaking page explains that the state's framework includes consumer protections for consequential automated decisions and conversational AI services.
A company may therefore face several layers at once:
• A specific AI statute.
• A general unfair or deceptive practices law.
• Privacy and data-security requirements.
• Product liability or negligence claims.
• Sector-specific rules for health, finance, employment, education, or legal services.
• Contractual obligations to customers and vendors.
Compliance should be organized around the actual product lifecycle rather than a single statute.
What Legal Teams Should Review Now
The first priority is a claim inventory. Legal teams should identify every material statement about the AI product across websites, sales decks, app stores, demonstrations, terms, privacy notices, help centers, investor materials, and customer communications.
Each claim should have an owner, scope, evidence source, approval date, and review trigger. Claims about safety or performance should be linked to defined tests rather than general confidence in the product.
The second priority is incident traceability. The company should retain enough information to understand the relevant model, instructions, user context, permissions, output, human review, and subsequent action. Logging should be designed with privacy and security limits rather than collected indiscriminately.
The third priority is complaint escalation. Consumer complaints may reveal a pattern before formal testing does. The organization should know when a complaint becomes a safety incident, when legal must review it, and when marketing or product language must change.
Contract Terms Do Not Replace Product Controls
Terms of service can allocate risk and explain appropriate use, but they cannot substitute for truthful marketing or reasonable product governance. A broad disclaimer is especially vulnerable when the company's prominent messaging makes a stronger promise.
Vendor and customer contracts should address:
• Permitted and prohibited uses.
• Model and feature changes.
• Human review responsibilities.
• Data use and retention.
• Safety testing and incident notification.
• Audit information and cooperation.
• Suspension and remediation rights.
• Allocation of responsibility for integrated workflows.
The contract should match operational reality. A term requiring human review is weak if the product design and customer onboarding encourage unattended use.
How Alloomi Can Support AI Claims Review
Alloomi AI can help legal teams compare product claims, policies, contracts, incident reports, testing materials, and customer communications while keeping conclusions tied to the source record.
That can make it easier to identify inconsistent promises, locate the evidence supporting a claim, and assemble a chronology of product changes or complaints. Alloomi does not determine whether a practice is legally unfair or deceptive; qualified counsel must make that assessment under the applicable law.
For related governance principles, see The Legal AI Audit Trail.
Practical Takeaway
The absence of a comprehensive federal AI statute does not create an enforcement vacuum. Existing consumer protection laws already give regulators tools to challenge unsupported claims and harmful practices.
AI companies should treat marketing review, product testing, incident response, contract language, and evidence preservation as one connected system. The strongest defense is not a generic disclaimer. It is a traceable record showing what the company promised, why it believed the promise was accurate, how it monitored the product, and what it did when the evidence changed.
Frequently Asked Questions
1. Can a state sue an AI company without a dedicated AI law?
Yes. State attorneys general may rely on existing consumer protection, privacy, data-security, or other generally applicable laws when the alleged conduct falls within those statutes.
2. Are AI disclaimers enough to avoid deceptive-practices claims?
Not necessarily. Regulators may consider the overall consumer impression, the prominence of the disclaimer, and whether the company's evidence supports its broader claims.
3. Do consumer protection laws apply only to consumer chatbots?
No. They may apply to many AI-enabled products and services, including agents, decision systems, subscription products, professional tools, and automated recommendations.
4. What is the first document an AI company should create?
A claims inventory is a practical starting point. It should connect each material public claim to its owner, supporting evidence, scope, approval, and review trigger.
