FTC AI Marketing Rules: What Small Businesses Need to Disclose

FTC AI marketing rules aren't a single new regulation — they're the Federal Trade Commission applying its existing authority over unfair and deceptive practices (Section 5 of the FTC Act) to how businesses market AI tools and use AI in their own marketing. For a small business, that distinction matters practically: there's no new form to file, but the same long-standing rule against deceptive or unsubstantiated claims now squarely covers AI-generated testimonials, overstated AI capabilities, and marketing copy that implies a human wrote or reviewed something an AI actually produced.

Since 2024, the FTC has run enforcement under its "Operation AI Comply" initiative, targeting companies that made deceptive claims about what their AI products could do or used AI to generate fake reviews and endorsements. Several of the enforcement actions have specifically named products marketed to small businesses — AI-powered "done for you" business tools sold on inflated capability claims. That's the exposure a small business actually faces: not necessarily as the target of a headline-grabbing case, but as a buyer of AI tools whose vendor's own marketing claims might not hold up, or as a marketer whose own AI-assisted content crosses into deceptive territory without anyone intending it to.

What This Actually Means in Practice

Three categories of FTC concern show up most often in guidance and enforcement so far:

• Overstated AI capability claims. Marketing that claims an AI product can do something it can't reliably do — "fully autonomous," "replaces a full-time employee," "100% accurate" — is treated the same as any other unsubstantiated product claim. The FTC's long-standing substantiation requirement applies: you need evidence behind a capability claim before you make it, not after someone challenges it.
• AI-generated content presented as human. Content, reviews, or testimonials generated by AI and presented in a way that implies a real person wrote or experienced them is a deceptive practice risk. This is the same principle behind shadow AI risk — AI use that happens without oversight is often where disclosure gaps appear first, because nobody flagged it as a decision that needed review.
• Fake or AI-fabricated reviews and endorsements. The FTC has an explicit rule against fake reviews and testimonials, separate from its AI-specific enforcement, and AI-generated reviews fall squarely inside it.

Why Small Businesses Can't Assume This Doesn't Apply to Them

It's tempting to treat FTC AI enforcement as a problem for AI vendors, not their small-business customers. Two things complicate that:

1. You're liable for your own marketing claims, including AI-assisted ones. If a marketing team uses an AI tool to draft ad copy or social proof and it generates a claim that isn't substantiated, the business publishing it carries the liability — not the AI tool that drafted it.
2. Vendor claims you repeat become your claims. If you resell or recommend an AI tool using the vendor's own capability claims, and those claims turn out to be unsubstantiated, you've repeated a deceptive claim even if you didn't originate it. This is part of why vetting a vendor matters as much as vetting the output, the same scrutiny covered in how to choose an AI automation partner.

What to Put in Place First

A small business doesn't need a legal department to cover the basics. A reasonable starting point, roughly in order:

1. Audit where AI touches your own marketing. Identify every place AI drafts or generates customer-facing content — ad copy, email campaigns, review responses, social posts — so you know where disclosure risk actually lives before writing a policy for it.
2. Set a substantiation standard for capability claims. Before a claim about speed, accuracy, or automation level goes out, have evidence behind it — a demonstrated result, not a projection or a vendor's marketing deck.
3. Never present AI-generated content as a human testimonial or review. If a review or endorsement isn't from a real customer having a real experience, it doesn't go out under a name and a face, AI-assisted or not.
4. Write it into your AI usage policy. A short, specific rule on AI-generated marketing content belongs in the same document as your broader AI acceptable use policy — most small businesses that get this wrong don't do it maliciously, they just never wrote the rule down.
5. Keep records of what substantiates a claim. If a capability claim is ever challenged, having the evidence already on file is the difference between a quick answer and a scramble.

What the Regulatory Landscape Looks Like

The FTC has not issued a dedicated AI marketing rule as of this writing — it is applying Section 5's existing unfair-and-deceptive-practices standard to AI-specific conduct, through enforcement actions and published guidance rather than new regulation. In July 2026 the agency published a proposed policy statement addressing deceptive steering by AI systems, which is a proposal under review, not a final rule — worth watching, not yet something to build a compliance program around. Several state laws, including Colorado's AI Act, layer additional AI-specific obligations on top of federal law, so a business operating in multiple states should check Colorado AI Act compliance and similar state frameworks separately from federal exposure.

Where This Fits Into a Broader Systems Approach

AI marketing compliance isn't a standalone legal checkbox — it's one output of the same AI governance structure that should already be tracking where AI touches customer-facing decisions, covered in our broader AI governance framework for small business. A business with clear ownership of AI use across marketing, support, and operations catches a risky claim before it ships; a business without that structure finds out when a customer or a regulator does.

Common questions

Do we need to disclose every time AI helped write marketing content? Not for routine drafting assistance — the concern is content presented as something it isn't, such as a fabricated testimonial, or a claim that isn't substantiated. A human-edited blog post drafted with AI assistance isn't the issue; a fake customer review generated by AI is.

What's the actual legal risk if we get this wrong? FTC enforcement typically starts with a deceptive-practices investigation, which can lead to consent orders, required refunds, and restrictions on future marketing claims. The practical risk for most small businesses is reputational and operational disruption long before it reaches that stage.

Does this apply if we're just a customer of an AI tool, not a seller of one? Yes, if you repeat the vendor's capability claims in your own marketing without substantiation, or you use the tool to generate customer-facing content that misrepresents its source. The obligation follows the claim, not just the product.

Is there a new federal AI marketing law we should be tracking? Not yet. The FTC is applying existing Section 5 authority rather than a dedicated new rule, though a July 2026 proposed policy statement signals more specific guidance may be coming. State-level AI laws are moving faster than federal rulemaking, so check your state's requirements directly.

Getting AI governance and marketing claims right starts with knowing exactly where AI touches your customer-facing decisions today. Start a systems audit to map that before a disclosure gap becomes a compliance problem.

Sources:

• FTC: Operation AI Comply
• McDonald Hopkins: The FTC Wants Your AI to Tell the Truth