What did the FTC say about AI deception in March 2026?

The FTC issued policy guidance in March 2026 explaining how the FTC Act's prohibition on unfair or deceptive acts applies to AI applications. The core position: existing consumer protection law — Section 5 of the FTC Act, the Fair Credit Reporting Act, and the Equal Credit Opportunity Act — applies directly to AI-generated outputs and client communications. Firms don't need to wait for new AI-specific legislation to be liable for deceptive AI use.

Which professional services firms face FTC exposure for AI use?

The FTC guidance applies most directly to firms using AI in client-facing contexts where material errors or misleading representations could occur: legal advice documents, financial recommendations, accounting summaries, consulting reports, and client communications. Firms that present AI-generated output as human expert judgment without disclosure are most exposed. The guidance also applies to AI use in credit, employment, and financial service delivery.

Is using AI in client work automatically an FTC violation?

No. Using AI is not inherently deceptive under the FTC's framework. The violation occurs when AI-generated content that is materially inaccurate or misleading is presented to clients in a way that causes harm — particularly when clients are not informed that AI was involved and reasonably relied on the output as professional expert judgment. Disclosure, verification, and error-correction practices significantly reduce exposure.

Do professional services firms need to disclose AI use to clients?

Yes, in most cases. ABA Formal Opinion 512 requires attorney disclosure when AI materially affects service delivery. The FTC's March 2026 guidance adds federal consumer protection law to the existing professional responsibility framework. Accounting, consulting, and staffing firms face parallel obligations under AICPA guidance and applicable FTC rules governing fair dealing and non-deception in professional relationships.

What is the minimum viable AI disclosure policy for a small professional services firm?

A minimum viable policy has three components: (1) an engagement letter clause that discloses AI use in service delivery and confirms licensed professional review of AI-assisted work; (2) an internal review requirement — no AI-generated client deliverable goes out without substantive human review; and (3) a firm-level documentation log of which AI tools are used and for what purpose. This protects against both FTC consumer protection claims and professional liability.

FTC AI Deception Rule: Firms Guide (2026)

Published: March 14, 2026 | By: The Crossing Report | 6 min read

Summary

The FTC issued policy guidance in March 2026 on when AI applications violate the FTC Act's prohibition on unfair or deceptive acts. The guidance doesn't create new rules — it clarifies that existing consumer protection law already applies to AI-generated outputs. For professional services firm owners using AI in client-facing work: this is the federal layer of AI disclosure obligation you now have to account for, alongside your professional licensing rules.

What the FTC Said

Under a directive from the White House AI Executive Order, the FTC was required to issue a policy statement by March 11, 2026 on how federal consumer protection law applies to AI.

The FTC's position: it won't wait for new AI legislation. The existing framework — Section 5 of the FTC Act (prohibiting unfair and deceptive acts), the Fair Credit Reporting Act, the Equal Credit Opportunity Act — already applies to AI applications and outputs. What's deceptive from an AI tool is deceptive under the same standards that apply to any business practice.

The "truthful outputs" language in the guidance is particularly important. The FTC signaled that when an AI-generated professional communication is presented as human-crafted — or when AI output contains material errors that cause client harm — the firm faces FTC exposure, not just professional malpractice liability.

Three Ways This Lands in Professional Services Firms

1. AI-generated advice documents presented as attorney or CPA review

If your firm uses AI to draft client memos, tax summaries, legal analyses, or consulting reports, and those documents go to clients as if they represent the reviewed professional judgment of a licensed expert — without that review actually occurring in substance — you have an FTC problem on top of a professional liability problem.

The FTC test: what does the client reasonably believe about how the document was produced? If the answer is "by a licensed professional reviewing my situation in detail," and the reality is "by an AI model without substantive human review," that gap is potentially deceptive under federal consumer protection law.

2. AI summaries with material errors

This is the most common risk because it's the most common failure mode. AI-generated summaries of client situations — financial positions, legal matters, compliance status — can contain confident-sounding errors. When a client receives and acts on a materially inaccurate AI summary from their professional services firm, they have a legal claim for harm caused by that error. Under the FTC's March 2026 guidance, that claim may now include an unfair or deceptive practices component alongside standard negligence.

The fix is a review protocol, not a technology fix. Every AI-generated client-facing output must have a substantive human verification step before it leaves the firm. "I looked it over" is not sufficient — the review must be able to catch and correct the types of errors the AI is likely to make.

3. AI-drafted client communications without disclosure

Automated client communications — AI-generated status updates, follow-up emails, intake responses, case summaries — present the highest volume risk because they're often the least reviewed. If your firm uses AI to draft routine client communications and those communications go out without disclosure or substantive review, the FTC guidance creates a disclosure obligation you may not have previously considered.

This is not about every email being flagged with "This message was AI-assisted." It's about ensuring that when clients receive professional advice or recommendations from your firm, they understand the nature of the review that produced them.

The Regulatory Stack

The FTC guidance doesn't replace your professional licensing obligations — it adds to them.

For law firms, the stack now includes:

ABA Formal Opinion 512 (2024) — attorney disclosure of AI use when material to service delivery
State bar ethics guidance — most states have issued or are developing AI ethics opinions
FTC Section 5 — federal consumer protection prohibition on deceptive acts
State AI legislation — New York, Illinois, Colorado, and Texas have active or enacted AI-specific professional disclosure requirements

For accounting firms:

AICPA professional responsibility standards — require disclosure of material factors affecting service quality
IRS professional conduct rules (Circular 230) — govern tax advice quality standards
FTC Act — applies to accounting firms delivering financial advice to consumers
State AI laws — Colorado SB24-205 (effective June 2026) covers high-risk AI applications including financial advice

For consulting and staffing firms:

FTC Act Section 5 — broadly applicable to any professional service delivery with consumer impact
FCRA — applies to staffing firms using AI in employment decision processes
State consumer protection statutes — most states have parallel "mini-FTC" statutes

The practical consequence: the compliance analysis for AI use in professional services is no longer just "what does our bar say?" It now also includes "what does federal consumer protection law say?"

What a Compliant AI Communication Policy Looks Like

A minimum viable compliance policy for a small professional services firm has three components.

Component 1: Engagement letter disclosure

Your standard engagement letter should include a clause that:

Acknowledges your firm uses AI tools in service delivery
Specifies that AI-assisted work is reviewed by licensed professionals before delivery to clients
Notes that clients may request information about which specific tasks AI was used for

You don't need to list every tool you use. You do need to acknowledge the category of use.

Component 2: Internal review protocol

Every AI-generated client deliverable — memo, summary, recommendation, filing, communication — must have a documented human review step before it leaves the firm. The review must be substantive enough to catch material errors. For most small firms, this means the same licensed professional who is responsible for the client relationship reviews and approves the AI output before it goes out.

Document this step. If a client complaint or regulatory inquiry ever arises, the documentation of review is your primary defense.

Component 3: Tool inventory

Know what AI tools your firm is using and for what purposes. This doesn't need to be elaborate — a spreadsheet noting each tool, its use case, and who is responsible for oversight is sufficient. If you don't know what your staff is using (the "shadow AI" problem), you can't manage the disclosure obligation.

The Connection to Your Professional Licensing Rules

The FTC guidance reinforces rather than replaces your existing professional responsibility obligations. But it does expand the potential consequences of non-compliance.

A professional liability claim for AI-related errors stays within the professional malpractice framework — it's between you, your client, and your insurer. An FTC consumer protection violation is a federal enforcement matter. The FTC has authority to investigate, impose civil penalties, require consumer restitution, and publicize enforcement actions.

For small professional services firms, the realistic FTC enforcement risk is low in absolute terms — the agency focuses its enforcement resources on larger consumer-facing businesses. But the guidance matters for two reasons. First, state attorneys general with "mini-FTC" authority under state consumer protection statutes are more likely to bring actions against smaller firms. Second, an FTC policy statement shifts how courts interpret standard-of-care in negligence cases — a plaintiff's attorney can now point to the FTC's guidance as establishing what disclosure a professional services firm exercising reasonable care would provide.

What to Do This Week

Law firms: Review your engagement letter for AI disclosure language. If it doesn't have any, add a clause before your next new client matter. Draft it this week — it can be two sentences. Then audit your standard client communication workflow for AI-generated content that goes out without substantive review.

Accounting firms: Check whether your client engagement letters and tax preparation authorization forms acknowledge AI use. Given IRS Circular 230's quality standards for tax advice, any AI assistance in tax work without disclosure and review is a dual risk — professional conduct and FTC consumer protection.

Consulting and staffing firms: Identify any client-facing AI tools currently running without a formal review step. The highest-risk targets: automated proposal generators, AI-drafted status reports, AI-powered intake or screening workflows.

Sources: Mondaq: March 2026 Federal AI Deadlines | FTC AI Compliance | Baker Botts analysis

The FTC Just Defined AI Deception — What Every Professional Services Firm Using AI in Client Communications Needs to Know