Three senior House Democrats have sent letters to five of the largest artificial intelligence developers asking for an account of past safety incidents and a promise to tell Congress about future ones within 48 hours. The letters went to OpenAI, Anthropic, Google DeepMind, Meta and Elon Musk’s SpaceXAI, and they were signed by Rep. Frank Pallone of New Jersey, Rep. Zoe Lofgren of California and Rep. Jamie Raskin of Maryland.
The request lands in the same month that the Federal Trade Commission opened a formal consumer-protection investigation into Anthropic and OpenAI and then demanded that Anthropic executives sit for testimony. Read together, the two moves show where oversight of frontier AI is heading: toward documented incident histories, fast notification and sworn accounts of how companies kept their own systems in check.
What the lawmakers asked for
Pallone is the top Democrat on the House Energy and Commerce Committee, Lofgren holds the same position on the Science, Space and Technology Committee, and Raskin on the Judiciary Committee. If Democrats win the House in next week’s midterm elections, all three are in line to chair those panels in the 120th Congress, which is why the letters are being read as a preview of their agenda.
According to Punchbowl News, which first reported the letters, the lawmakers want each company to:
- describe past safety incidents, including cases where models took “unintended and potentially unsafe steps in carrying out tasks during model testing”;
- explain the security standards and consumer protection measures the company relies on; and
- commit to alerting lawmakers to future incidents within 48 hours.
The letters frame the request as groundwork for legislation rather than an accusation. “While there is no question now that Congress must act to address gaps in AI governance, we must have the best information available to undertake that complicated process in a thoughtful and productive way,” they say.
The letters are requests, not subpoenas. As minority members, the three cannot compel answers today. That could change in January, and companies that ignore a ranking member’s letter in October may find the same questions arriving with a committee’s subpoena power behind them early next year.
The FTC investigation running alongside it
The congressional letters are not the only pressure on the same companies. On October 15, the FTC sent civil investigative demands to Anthropic and OpenAI. Each runs more than 50 pages and, according to reporting by Axios, asks for documents about security incidents, safeguarding practices, marketing materials and privacy policies. On October 26, an FTC spokesperson confirmed that the agency had sent demands for Anthropic executives to testify in the investigation, and said individuals at other AI companies had also received testimony demands without naming them.
A civil investigative demand is an information-gathering tool. It does not mean the agency has found a violation, and it does not mean a lawsuit will follow. The FTC’s authority here comes from its power to police unfair or deceptive practices, which covers how products are marketed, what companies say about safety and privacy, and whether those statements match reality. Anthropic told investors in its IPO filing that the probe could lead to significant costs and changes to model design.
The backdrop is a run of publicly disclosed incidents in which AI agents accessed systems or took actions that no human had instructed. Those disclosures, rather than any single law, are what is driving both the agency and the lawmakers to ask for records.
Why this matters beyond the five labs
Most companies reading this do not build frontier models. They buy them, embed them in products and connect them to customer data. The questions being put to the labs will travel down that chain, because a business that deploys an AI agent inherits part of the story when that agent does something unexpected with personal information.
Three themes in the letters and the FTC demands are worth noting for deployers:
- Incident history is becoming evidence. Regulators are asking what went wrong in the past and how it was handled, not just what policies exist on paper.
- Speed of notice is becoming a benchmark. A 48-hour window to tell lawmakers is far shorter than many internal escalation processes for AI issues.
- Marketing and privacy statements are in scope. The FTC asked for marketing materials and privacy policies, which means public claims about AI safety can be tested against internal documents.
This connects to a wider fight over who writes AI rules in the United States. The White House and some members of Congress have pushed to block state AI laws, while states have kept moving with their own AI regulation and privacy measures. Some lawmakers have floated a select committee on AI, an idea Pallone said would “further delay legislation.” Whatever structure wins, the information requested in these letters is likely to shape the first drafts.
How it compares with rules elsewhere
Europe already has a legal duty in this area. Under the EU AI Act, providers of general-purpose AI models with systemic risk must track and report serious incidents to the AI Office, and the Commission’s enforcement powers over those models are now active. The United States has no federal equivalent. The House letters are, in effect, asking the companies to volunteer something close to the European standard before Congress decides whether to require it.
Governments on both sides of the Atlantic are also pressing for access to models before launch. Pre-deployment testing and post-incident reporting are two halves of the same idea: officials want to see risk before a release and hear about failures quickly after one.
Five steps for companies that deploy AI tools
None of the following is legally required by the letters themselves. They are practical steps that put a company in a better position if a regulator, customer or plaintiff asks the same questions now being put to the labs.
- Write down what counts as an AI incident. Include agents acting outside their instructions, models exposing personal data in outputs, and tools reaching systems they were not approved to touch. If nobody has defined it, nobody will report it.
- Set an internal notice clock. Decide who must be told, and how fast, when an AI incident involves personal data. Align it with the breach-notification clocks you already run.
- Keep a log that would survive a document request. Record what happened, which data was involved, who decided what and when. A closed ticket is not proof that a problem was fixed.
- Check public claims against practice. Compare what your privacy notice and marketing say about AI with how the tools are configured. The FTC’s interest in marketing materials makes gaps here a risk in their own right.
- Ask vendors for their incident history. If your AI supplier is one of the five companies that received these letters, ask what it will share with customers and on what timeline.
Where Captain Compliance fits
Captain Compliance helps privacy and legal teams keep the records that these requests assume exist. Our platform supports data mapping and records of processing that connect to assessments and AI governance work, along with incident response workflows and governance, risk and compliance tooling for tracking decisions and evidence. That will not make an AI model safe, and no software can promise compliance with rules Congress has not yet written. It does make it easier to answer the first question any investigator asks: what data was involved, and what did you do about it?
Recent events show why that matters. When an AI developer decides a model is too risky to release, as in Anthropic’s Claude Mythos decision, the companies using its tools need their own view of the exposure rather than waiting for the vendor’s.
Frequently asked questions
Are the AI companies required to answer the letters?
No. Letters from ranking minority members carry no subpoena power. Companies often respond anyway to preserve relationships, especially when the senders may chair the relevant committees after the election.
Does the FTC investigation mean Anthropic or OpenAI broke the law?
No. Civil investigative demands and testimony requests are investigative steps. The FTC has not announced any finding or filed any complaint against either company in this matter.
Which companies received the letters?
OpenAI, Anthropic, Google DeepMind, Meta and SpaceXAI, according to the report that first described them.
Is there a federal AI incident reporting law in the United States?
Not a general one. Incident reporting for AI currently comes from sector rules, state laws, contracts and voluntary commitments. The EU AI Act does impose serious-incident reporting on providers of general-purpose models with systemic risk.
What should a company that only uses AI tools do now?
Define AI incidents internally, set a notice timeline, keep decision records and make sure public statements about AI match how the tools actually work.
The vote that decides the next step
For now, these are polite requests from lawmakers in the minority. On November 3, voters will decide whether they become the opening document requests of three committee chairs. The companies’ answers, or their silence, will be on file either way, and the next set of questions may not arrive as a letter.
