AI safety now needs a version number

AI safety has acquired a paperwork problem, although paperwork is doing rather heroic work in that sentence.

On 14 October, eight US states filed separate cases against OpenAI under consumer-protection and related state laws. On the same day, the Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic seeking documents about safety incidents and safeguarding practices. Neither action establishes liability. Together, however, they change the operating question. A company can no longer treat a public assurance, a model evaluation and an incident log as three adjacent stories. Regulators and courts may ask whether they describe the same product at the same time.

What happened

Iowa's attorney general announced that Iowa, Kansas, Nebraska and West Virginia had brought cases, while Arizona, Arkansas, Idaho and Montana filed their own state actions. The states allege that OpenAI misled consumers about the safety of ChatGPT, particularly for children and vulnerable users. These are claims in complaints, not judicial findings.

The filings do not merely ask for damages. Iowa's 91-page petition asks a court to require age-verification procedures and informed consent for certain data practices, delete Iowans' data obtained before judgment, and halt further testing of advanced models until safeguards are implemented and verified by third-party monitors. Nebraska's complaint brings claims under its consumer-protection, deceptive-practices and age-appropriate-design laws; it alleges failures including age verification, default protections and parental tools.

OpenAI disputes the picture presented by the states. It told the Associated Press that it has built protections for children and will continue improving them, uses external experts, and introduced a teen-specific experience in August. Its own product announcement describes age-appropriate protections, healthy-use features and additional controls for parents. Whether those measures are adequate, worked as described for particular users and answer the states' legal claims is now disputed territory.

A separate federal track is gathering evidence. Axios reported that the FTC's demands to OpenAI and Anthropic run to more than 50 pages and seek security-incident records, safeguarding materials, marketing claims and privacy documents. OpenAI said it would engage constructively. A civil investigative demand is an evidence-gathering instrument ahead of any possible case; it is not a finding that either company broke the law.

The product now has to meet its promise

The common thread is not that every allegation is true. It is that safety is being examined as a relationship between what a company said, what it built, what a particular person received and what happened next.

That relationship is easy to lose in a continuously changing AI service. A single product name can conceal a model update, a revised system policy, new age-prediction logic, a changed refusal rule, a parental-control setting, an experiment cohort and a different escalation process. If the answer to a difficult interaction changes on Tuesday, the company's current demo cannot establish what the user encountered on Monday.

The practical response is a versioned safety case: a maintained argument that connects a safety claim to the controls and evidence supporting it for a defined product state. It is more demanding than a model card and narrower than a promise that the service is simply safe.

A useful chain has at least six links:

1. The claim. Record the exact representation, audience, channel and dates. "Designed for teens" and "cannot produce harmful advice" are different propositions.
2. The product state. Identify the model, system instructions, policy bundle, tools, memory, interface and experiment cohort that reached the user.
3. The user state. Record what the service knew or inferred about age and vulnerability, which protections applied and whether parental settings were active.
4. The evidence. Preserve the relevant evaluations, known limits, monitoring signals and release decision, including adverse results rather than only aggregate scores.
5. The event. Reconstruct the conversation and consequential actions with proportionate, privacy-aware records and a clear account of any missing data.
6. The remedy. Show what changed, who was notified, which versions received the fix and how the company tested that the change addressed the failure without creating another one.

That is an editorial synthesis, not a description of a legal standard already imposed across the industry. It follows from the kinds of claims and remedies now appearing in the complaints and the records reportedly sought by the FTC.

A worked example

Consider a hypothetical 15-year-old who asks a chatbot for help after describing acute distress. The service predicts that the account belongs to a minor and routes the conversation through a teen policy. The first response follows the policy. After several turns, however, a model update and an experiment on conversational tone combine to produce an answer that reinforces the user's isolation rather than directing them towards immediate human help.

A generic safety statement will not reconstruct that event. Investigators need the model build, policy revision, age-classification result, experiment assignment, relevant conversation state, monitoring alerts and escalation outcome. Product teams need the same record to know whether the fault lies in age detection, the response policy, model behaviour, the experimental treatment or the hand-off to people.

The example is hypothetical. It does not assert that this sequence occurred in any of the cases cited by the states. Its purpose is to show why an AI interaction needs something like a batch identity: without stable version references, the company may fix today's system while remaining unable to explain yesterday's.

Privacy and proof pull in opposite directions

The Iowa petition exposes a particularly awkward tension. It asks for deletion of Iowans' data obtained before judgment while federal investigators are seeking records. Privacy protection favours collecting less, retaining it briefly and deleting it when the purpose expires. Accountability favours preserving enough evidence to reconstruct consequential events.

Both instincts can be right. The answer is not indiscriminate logging. A safety case should define a retention map: which events are recorded, why, for how long, under what access controls, with which identifiers, and how litigation holds or regulatory duties suspend ordinary deletion. Sensitive conversation content may need stronger separation from operational facts such as the active model and policy version. A missing record should be disclosed as a limitation, not filled with a confident reconstruction.

This is where product, safety, privacy, legal and marketing teams cease to be neighbouring departments. The public claim must be testable against the product state; the product state must be recoverable from privacy-respecting records; and the remedy must reach the same versions and users implicated by the evidence.

The strongest counter-case

There are good reasons not to turn complaints into a technical specification. Plaintiffs select the facts and remedies most favourable to their theory. A court may reject many allegations, narrow the requested injunctions or decide that existing protections answer part of the case. The AP noted that some cited material may predate OpenAI's August teen product. Broad, state-by-state restrictions could also fragment services and make legitimate safety testing harder.

Those possibilities weaken any prediction about the outcome. They do not remove the evidence problem. Even a company that ultimately prevails needs to show which protection existed, what it knew, how a claim was supported and whether a later design changed the answer. Indeed, a fragmented legal environment makes precise versioning more valuable because a single global description may no longer fit every jurisdiction or account.

Confidence is therefore uneven. It is high that eight states filed actions on 14 October and that the cited complaints seek consequential remedies. It is well reported, but not publicly documented by the FTC itself in the sources reviewed here, that formal demands went to OpenAI and Anthropic that day. It is uncertain which allegations will survive, which remedies a court might grant and whether the cases will produce an industry-wide standard.

The immediate test

For any consequential AI feature, take the strongest public safety sentence and try to trace it backwards. Which users and versions does it cover? What evidence supported it on the date it appeared? Which failure would make the sentence misleading? Who could reproduce the result without relying on the team that wrote the claim?

Then run the chain forwards. If a serious event is reported, can the organisation identify the affected product state, preserve what is necessary, notify the right people, deploy a bounded remedy and show that the remedy reached the relevant population?

The new lawsuits may fail, settle or produce different answers in different states. The FTC may close its investigation without bringing a case. The durable change is procedural: safety assurances are becoming evidence objects. A product that changes every week needs a safety case that can still say what was true last week.

Sources

• Iowa Attorney General, announcement, 14 October 2026.
• State of Iowa v OpenAI petition, filed 14 October 2026.
• Nebraska Attorney General and complaint, 14 October 2026.
• Associated Press, 15 October 2026.
• Axios, 15 October 2026.
• OpenAI: ChatGPT for Teens, 18 August 2026.

Chiappe × OpenAI. Editorial direction by Dominic Chiappe; research, synthesis and production with OpenAI.