FTC scrutiny turns agent safety logs into regulatory evidence. Preserve the decision trail.

On 30 September, Reuters reported that the US Federal Trade Commission is conducting an industry-wide probe into Anthropic, OpenAI and other AI labs, with plans to demand information and compel executive testimony. The operational consequence is immediate: agent safety evidence is moving from internal assurance material toward something a regulator may expect a company to produce.

The FTC has used compulsory process in AI before. Its September 2025 inquiry into companion chatbots issued orders seeking information about safety, testing, monitoring, advertising and data handling. The new probe is broader, according to Reuters, and places autonomous-agent risk inside the same consumer-protection machinery.

Preserve the decision trail, not only the final output

An agent incident cannot be reconstructed from a chat transcript alone. Teams need the model and version, system policy, tool calls, retrieved evidence, identity used, approvals requested, actions executed and the policy version that allowed them. Without that chain, a successful-looking output can hide an unsafe route.

Retention should therefore follow the control boundary. Keep enough evidence to explain why an action was permitted, what external systems changed and which human or automated control could have stopped it. Protect those records from the same agent identities they are intended to audit.

If an agent can change the world, its decision trail should survive long enough to explain the change.

Turn safety evaluations into reproducible evidence

Red-team results and benchmark scores are useful, but regulatory scrutiny is likely to expose the gap between a laboratory result and a deployed control. Record evaluation inputs, model configuration, tool permissions, pass criteria and remediation decisions so a test can be rerun against the production version rather than cited as a historical badge.

The FTC's existing AI materials show sustained interest in how companies measure, test and monitor AI products. Engineering teams should connect those activities to release records: which failure caused a block, which mitigation changed the result and who accepted residual risk.

Make incident evidence exportable before an incident

Compulsory information requests operate on legal timelines, not on the convenience of a fragmented observability stack. Security, legal and AI platform teams should agree now on the minimum evidence package for an agent incident and test whether it can be assembled without manual reconstruction across unrelated systems.

Start with one production agent. Trace a consequential action from user request through model decision, tool execution and downstream change, then verify that timestamps, identities and policy versions line up. Fix missing links as control defects. The regulatory shift is not a reason to log everything forever; it is a reason to make consequential autonomy explainable with evidence the organisation can actually retrieve.

Written by the Devence Lab research team.