Public Policy & Governance

The FTC — under its current Trump-appointed leadership — issued a proposed policy statement in July 2026 targeting what it characterises as the 'suppression of accuracy' in AI systems. Both CDT and EFF submitted formal comments calling for the proposal to be withdrawn entirely. The core objection is structural: the FTC's framework explicitly references the executive order 'Preventing Woke AI in the Federal Government,' meaning a consumer protection agency's enforcement posture is now being shaped by a politically-defined standard of what constitutes AI 'accuracy.' CDT argues this conflates ideological output preferences with technical accuracy, while treating bias mitigation, safety filtering, and content moderation — standard industry practices — as potential violations.

This is a proposed policy statement, not a final rule, and has not undergone formal notice-and-comment rulemaking under the APA. Its legal enforceability is therefore limited. However, its signalling function should not be underestimated: an FTC policy statement shapes enforcement priorities and can influence how AI developers self-regulate to avoid scrutiny. Civil society groups are correct to engage at this stage — the comment window is the most effective intervention point. The FTC's track record under current leadership suggests the agency is unlikely to withdraw the proposal absent significant congressional pressure or legal challenge.

The General Services Administration released an updated draft of its AI Terms and Conditions for federal solicitations and contracts, representing the second iteration following a March 2026 initial draft. CDT, EFF, EPIC, and Upturn filed joint comments, as reported by CDT. Federal procurement standards are among the most consequential AI governance tools available to the executive branch: any AI vendor contracting with the federal government would be bound by these terms, covering data handling, transparency obligations, and performance requirements. Critically, this mechanism does not require congressional action and operates through existing acquisition regulations.

The joint civil society submission signals organised engagement from the digital rights community in a space that has historically been dominated by industry contractors. The key implementation gap to watch is whether the finalised terms will include meaningful audit rights, incident reporting requirements, or data minimisation obligations — provisions that tend to be watered down in procurement negotiations with large technology vendors. The GSA's track record on prior federal technology standards suggests iterative improvement is more likely than a transformative framework, but the two-draft cycle already demonstrates responsiveness to external comment.

The Senate Commerce Committee is simultaneously considering four bills with AI implications for minors: KOSA, the SCREEN Act, the CHATBOT Act, and the Youth AI Privacy Act. EFF's analyses of both KOSA and the Youth AI Privacy Act identify a common structural defect: each bill, in attempting to protect minors, mandates or creates strong incentives for age verification — requiring platforms to collect and process more personal data from all users, not fewer. The Youth AI Privacy Act's scope is nominally narrower than KOSA but EFF argues it still carries significant data security risks because it creates a protected data category that, once collected, becomes a high-value target.

The committee's consideration of four bills simultaneously suggests legislative momentum but also risks producing redundant or conflicting compliance obligations for AI companies operating youth-facing products. Industry stakeholders should note that the CHATBOT Act specifically targets AI systems, meaning it would impose requirements distinct from general platform obligations under KOSA. The absence of a unified framework creates an aggregation problem: compliance with all four bills may require more extensive data collection infrastructure than compliance with any single comprehensive statute would demand — a perverse outcome that undermines the stated child safety rationale.

A Foreign Policy analysis argues that California and New York's legislative activity may already be functioning as the effective global AI governance benchmark, filling the vacuum left by federal inaction and the slow progress of international treaty negotiations. This reflects the 'Brussels Effect' dynamic playing out at the subnational level: jurisdictions with large markets and active regulatory environments set compliance floors that multinationals apply globally because jurisdiction-specific product differentiation is operationally costly. California's history with emissions standards and privacy law — where state rules became the practical national standard — provides direct precedent.

The strategic risk of this trajectory is regulatory fragmentation without harmonisation. Unlike the EU AI Act, which provides a single compliance target across 27 member states, US companies now face an accumulating layer of state requirements with inconsistent definitions, audit standards, and enforcement mechanisms. CDT's concurrent work on AI auditing requirements explicitly flags this: state legislatures are mandating audits without establishing the technical standards those auditors would apply, creating mandates that are nominally enforceable but practically hollow until the standards infrastructure catches up.