FTC AI disclosure rules 2026 are looser than most posts claim. New York's law has the real teeth. Here's what your SaaS blog actually has to disclose.
Search "FTC AI disclosure rules 2026" and most of what comes back describes a federal "dual disclosure mandate" and an "FTC AI enforcement unit." Neither exists. Check FTC.gov and you'll find the opposite story: in December 2025 the agency vacated its own AI enforcement action, and a December 2025 executive order is pushing federal agencies to resist state AI rules, not multiply them. The real 2026 story is narrower and more useful than the content-farm version: a real disclosure law took effect in New York on June 9, 2026, and it stacks on FTC rules that predate the AI boom by years.
This post covers what's actually required, not what's getting repeated. If you're running a fintech or healthtech blog, the sector-specific version of this, FTC AI-washing, FINRA, UDAAP, and California's AB 489, is covered in more depth in our compliance breakdown for regulated industries. If your readers are in the EU, a separate and stricter disclosure duty applies under Article 50 of the EU AI Act, and the two frameworks are worth reading together rather than treating as one rule.
Two things changed in 2026, and they point in opposite directions. New York passed the country's first real disclosure law with actual penalties attached. The FTC, meanwhile, spent the year signaling it wants less AI-specific oversight, not more. Conflating the two is how a post ends up inventing a federal mandate that isn't there.
New York General Business Law 396-b requires anyone who produces a commercial advertisement containing a "synthetic performer" to conspicuously disclose it, once they have actual knowledge the ad contains one. It took effect June 9, 2026, and it's the first state law of its kind, per McDermott Will & Emery's summary.
A "synthetic performer" is a human-like digital asset created by generative AI or an algorithm, one that gives the impression of an actual human performer who isn't a recognizable, identifiable person. That definition matters: it targets fabricated people appearing in ads, not AI-assisted writing, not an AI-generated illustration, and not a real employee whose photo you used with permission.
The law carries three exemptions worth knowing before you assume it applies. Expressive works, film, TV, streaming, documentaries, video games, are exempt as long as the synthetic performer's use fits the work itself. Audio-only ads with no visual synthetic performer are exempt. And AI used solely for translation doesn't trigger the duty, per Reed Smith's advertiser guidance. What isn't exempt is geography in the way you'd expect: the law applies to any ad that could reach a New York consumer, regardless of where the advertiser is based or who it's actually targeting.
The penalties are modest by AI-regulation standards but real: $1,000 for a first violation, $5,000 for every one after that, per advertisement. Small enough that it won't bankrupt anyone on a single miss, large enough that it isn't a rounding error if a synthetic-performer ad campaign runs unlabeled for months.
Here's the part that separates a sourced post from a content-farm one: the FTC spent 2026 walking back AI enforcement, not building it out. In December 2025, the agency reopened and vacated its own 2024 consent order against Rytr, the only prior FTC action that specifically targeted an AI review-generation tool. FTC Bureau of Consumer Protection director Christopher Mufarrige explained the reversal plainly: "condemning a technology or service simply because it potentially could be used in a problematic manner is inconsistent with the law and ordered liberty," per reporting on the reversal.
That reversal didn't happen in isolation. On December 11, 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," directing federal agencies to push back on state AI regulation as an obstacle to a single national framework, per Wikipedia's summary of the order. The FTC's own follow-through arrived July 1, 2026, with a proposed policy statement on "suppression of accuracy" in AI systems, aimed at AI companies steering model output to comply with state laws like Colorado's AI Act, not at bloggers disclosing AI assistance. Public comments closed July 31, 2026, per Covington's coverage of the proposal. None of this is an "FTC AI disclosure rule." It's the opposite: a federal posture actively resisting new state-by-state AI disclosure obligations.
Skip the invented federal mandate and you're left with two real rules, neither of which is new, both of which already reach AI-assisted content because they were never written to exempt it.
The FTC's Endorsement Guides, 16 CFR Part 255, revised in 2023, require clear and conspicuous disclosure of any material connection between an endorser and an advertiser. The 2023 revision explicitly extended "endorser" to cover virtual endorsers and bots, so a fabricated spokesperson or AI-generated testimonial figure is inside the rule's scope, not a loophole around it, per Arnold & Porter's advisory on the revision.
The Consumer Review Rule, 16 CFR Part 465, took effect October 21, 2024. It bans buying, selling, or disseminating fake reviews and testimonials, including reviews that misrepresent they're from a real person who doesn't exist, which is exactly what an AI-fabricated review is, per Goodwin's summary of the final rule. The FTC isn't sitting on this one: on December 22, 2025 it sent warning letters to ten companies over possible Consumer Review Rule violations, its first public enforcement move under the rule, per Kelley Drye's coverage. The maximum civil penalty tied to violations under Section 5 of the FTC Act, the same statutory hook the Consumer Review Rule and existing consent orders use, is $53,088 per violation as of 2026, unchanged from 2025 since no inflation adjustment applied this year.
A 2,000-word explainer that mentions your product once in the CTA isn't the thing these rules were written for. A page built around a fabricated persona or an unverifiable performance claim is. The line between those two matters more than whether AI touched the draft.
None of the rules above care whether a language model helped write a sentence. They care whether the output makes a promotional claim, features a fabricated endorser, or presents a synthetic person as real. An AI-assisted explainer about how your product's underwriting model works isn't an endorsement. A hero-section video with an AI-generated "customer" describing their results is squarely inside both New York's law, if it could reach a New York viewer, and the FTC's Endorsement Guides.
This is a narrower trigger than most compliance posts imply, and narrower is the useful part. us ai content compliance in 2026 means matching the right rule to the right format, not treating every AI-touched page as regulated the same way.
Rank the formats on a SaaS blog by actual exposure and testimonials sit well above ordinary how-to content. A quote attributed to a named customer who didn't say those words, a "results may vary" case study built on a composite rather than a real account, an AI-generated avatar presented as a genuine user: each of those is a Consumer Review Rule or Endorsement Guides question, independent of any AI-specific law. The fix isn't a disclosure banner. It's not publishing a testimonial you can't attribute to a real, identifiable person who actually said it.
The FTC has filed 13 AI-washing cases since 2024, and seven of the last eight targeted B2B marketing claims, not consumer-facing ones, per DLA Piper's analysis of the agency's most recent action. That most recent case, against CMG Media Corporation in May 2026, resulted in a $930,000 settlement over a claimed "Active Listening" AI feature that didn't exist. Seven of eight recent cases hitting B2B claims specifically is the detail SaaS marketing teams undersell: this is the exact posture of a company describing its own AI feature to prospective business buyers.
That's a bigger practical risk than a missing disclosure line for most blogs. A false or overstated claim about what your AI feature does is enforceable under existing FTC deception authority regardless of whether the page mentions AI at all. Disclosure risk is bounded and rule-specific. AI-washing risk is just ordinary false advertising with an AI-shaped claim attached, and the agency has a four-year track record of acting on it.
US AI content compliance in 2026 isn't one law, it's three narrow ones stacked on top of each other: New York's GBL 396-b, the FTC's Endorsement Guides, and the Consumer Review Rule, each triggered by a different content shape rather than by AI involvement itself. Most SaaS blog posts trip none of them. A small number of formats trip all three. Here's the checklist that sorts one from the other.
| Content type | Disclosure required? | Which rule |
|---|---|---|
| AI-assisted how-to or explainer post, no endorsers | No | None of the above apply |
| Fabricated "customer" testimonial or review | Yes, don't publish it | Consumer Review Rule |
| Synthetic performer in an ad reaching NY consumers | Yes, conspicuous disclosure | GBL 396-b |
| Virtual or AI spokesperson endorsing your product | Yes, material connection disclosure | Endorsement Guides |
| Claim about what your AI feature does | Verify it's accurate, no disclosure format fixes a false claim | FTC deception authority |
Where the FTC's Endorsement Guides do require disclosure, "clear and conspicuous" has a specific bar: not difficult to miss, and delivered in the same medium as the endorsement itself, meaning on-screen and audible if the endorsement is a video with sound. A disclosure buried in a footer link or a terms page doesn't satisfy it. New York's GBL 396-b doesn't prescribe exact wording or placement, which means the safest read is to apply the FTC's existing "conspicuous" standard to any synthetic-performer disclosure by default, rather than inventing a lighter bar because the statute is quiet on format.
The mechanics of proving you did this, a named reviewer, a record of what was checked, a timestamped sign-off, are the same audit-trail discipline that already applies to fact-checking. Our post on AI content governance covers what that record needs to capture. It's the same reason Lyra opens every draft as a pull request instead of publishing it directly: a disclosure check is one more line item a human reviews before merge, not a step that happens after the post is already live. The practical move is adding a disclosure check to the same style guide that already governs brand voice and tone, so it's applied consistently by whoever drafts a post rather than bolted on after the fact. Our brand voice guide for AI content covers how that guide gets built and enforced.
It's also worth separating this from a different question entirely: whether AI-assisted content hurts your rankings. Google's own research shows no ranking penalty for AI-assisted content. Disclosure is a legal question about advertising claims and fabricated endorsers. It has nothing to do with how Google treats the page.
New York's law and the FTC rules above are US-only in origin, but if any of your blog's readers are in the EU, a separate disclosure duty runs in parallel: Article 50 of the EU AI Act, which took effect August 2, 2026 and requires disclosing AI-generated content published on matters of public interest, unless a real human review process exempts you. That's a different trigger than anything covered here, public-interest topic and review quality, not promotional claims or synthetic performers, and it applies regardless of where your company is based, only where your readers are. Our full breakdown of Article 50 covers which posts qualify and what counts as genuine review. The two frameworks don't conflict; they just test different things, and a US SaaS blog with any EU traffic needs to clear both, not pick one.
The federal read on all of this predates the current FTC's lighter-touch posture, but it hasn't been repealed: in an April 2023 joint statement from the CFPB, FTC, EEOC, and DOJ's Civil Rights Division, then-FTC Chair Lina Khan put it in one sentence: "There is no AI exemption to the laws on the books." That's still true, even under a different chair. New York didn't invent a new category of harm, it applied an old one, fabricated performers in ads, to a new production method. The FTC's Endorsement Guides and Consumer Review Rule were never technology-specific either. What changed in 2026 isn't the underlying law. It's that one state finally wrote a rule specific enough to have a dollar figure attached.
Getting the disclosure question right starts with knowing who reviewed a post and what they checked, the same record Lyra attaches to every pull request it opens.
FAQ
No single federal disclosure statute exists. What binds you federally are two existing rules applied to AI output the same way they apply to anything else: the FTC's Endorsement Guides (16 CFR Part 255), which require clear disclosure of material connections and cover fabricated endorsers, and the Consumer Review Rule (16 CFR Part 465), which bans AI-fabricated reviews and testimonials. Neither is new in 2026, and the FTC has been moving to loosen AI oversight this year, not tighten it.
Yes, if the ad could reach a New York consumer. GBL 396-b's disclosure duty triggers on where the audience is, not where the advertiser is headquartered or targeting. It only applies once you have actual knowledge an ad contains a synthetic performer, defined as a human-like AI-generated asset that isn't a recognizable real person, and it exempts expressive works, audio-only ads, and translation-only AI use.
It depends which rule you tripped. New York's GBL 396-b caps out at $1,000 for a first violation and $5,000 for each one after that, per advertisement. Violations tied to the FTC's Consumer Review Rule or an existing consent order can reach $53,088 per violation as of 2026, unchanged from 2025. There's no federal per-post disclosure fine, because there's no federal per-post disclosure rule.
Not on content disclosure specifically. The FTC vacated its own Rytr enforcement action in December 2025, and Executive Order 14365 directs federal agencies to push back on state AI rules rather than add federal ones. The active enforcement pattern is AI-washing, false claims about what your AI actually does, not the fact that AI touched a draft. Thirteen AI-washing cases have been filed since 2024, and seven of the last eight targeted B2B marketing claims.
Built by the tool you're reading about
Lyra finds the topics worth ranking for, writes them in your repo's voice, fact-checks every claim, and opens a pull request scored and ready to merge. You review and hit merge. Want to see what she'd write for you? Start free with three posts, no card.
Keep reading
Google's site reputation abuse policy is tightening, algorithmic or not. What SaaS guest posts and sponsored content need to audit before it costs rankings.
AI content compliance for fintech and healthtech: what FTC, FINRA, UDAAP, and AB 489 actually require, and how to build review into the pipeline.
AI writing tool data training policies vary sharply by vendor: the exact contract language to check before your SaaS drafts train someone else's model.