When the Record Stays Open: AI Washing, Enforcement, and the Narrative You Can't Recall

2026-04-30

In the spring of 2026, AI washing enforcement isn't a theoretical risk. The FTC brought more than a dozen cases against companies for overstated AI claims in 2025 alone. The SEC's newly constituted Cybersecurity and Emerging Technologies Unit has made it an explicit priority. Morgan Lewis published a memo this month: AI Enforcement Accelerates as Federal Policy Stalls and States Step In.

If you made AI claims in 2021, 2022, or 2023 — whether in investor communications, press releases, or product copy — there is a reasonable chance those claims were accurate enough at the time, or felt accurate, or were aspirational in the way that corporate language often is. And there is an equally reasonable chance you've since updated them.

The problem is where those old claims now live.

The Paper Trail Has a New Address

In the past, reputational correction was largely a matter of updating your website, issuing a revised disclosure, and letting time do the rest. Old press releases became hard to find. Media coverage cycled on. The trail went cold.

That is no longer how information moves.

Public AI systems — the tools that investors, regulators, journalists, and analysts now use to research companies — were trained on broad sweeps of the web, including investor relations pages, press releases, earnings call transcripts, and industry coverage. When an enforcement investigator, a short-seller, or a prospective investor queries a public AI system about your organisation today, the system may surface your 2022 product claims with the same confidence it surfaces your most recent filing.

The old claim doesn't arrive with a timestamp and a caveat. It arrives as a present-tense description of your company.

Enforcement Is Looking at What AI Surfaces

This matters precisely because the regulatory scrutiny of AI washing is now operational, not just policy-level. The SEC's enforcement division has made explicit that it is evaluating how companies "describe their AI capabilities to customers and investors" — and that evaluation increasingly happens through the same research tools that everyone else is using.

Enforcement teams do use AI-assisted research. They query public AI systems to understand a company's positioning before deeper investigation. If those systems surface a 2022 claim that says your product "uses machine learning to analyse every customer interaction in real time" — a claim you'd quietly retired because the feature never quite worked as described — that claim may not appear in any current filing. But it is still part of how public AI systems characterise your organisation.

The gap between what you currently say and what public AI systems still attribute to you is a governance exposure. Most organisations have no idea it exists.

The Correction Problem

Updating a website is straightforward. Correcting the narrative inside a public AI system is not.

These systems don't re-index in real time. They don't receive your press release corrections. They form their view of an organisation from a broad corpus of historical content, and that view updates slowly — if at all — between training cycles. A public retraction typically does less to shift the AI-generated narrative than the original claim did to establish it.

This creates an asymmetry: your legal and communications teams can produce updated materials, but the version of your company inside public AI systems may remain anchored to claims you no longer make — and can no longer defend.

What Governance Looks Like in This Environment

The organisations best positioned for the current enforcement climate are not necessarily the ones whose historical claims were most conservative. They are the ones who know what public AI systems currently say about them, and who treat that narrative with the same rigour they apply to their formal disclosures.

That means periodic review — not of your current website, but of what investors, regulators, and journalists actually encounter when they query AI systems about your organisation. It means understanding where the gaps exist between your current communications and the AI-generated narrative that precedes every conversation.

In a regulatory environment where what you once said can be surfaced without context, at any time, by the tools investigators use to do their work, that clarity is not optional. It is the new baseline of governance readiness.