What the Rule Actually Prohibits
The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) became effective October 21, 2024. It prohibits businesses from creating or selling reviews written by someone who does not exist, was not a genuine customer, or does not reflect that person's honest opinion. It prohibits procuring or disseminating reviews a business knows or should know are fake, including reviews generated through third-party or automated systems. It also prohibits undisclosed insider reviews from officers or managers, suppression of negative reviews through threats or intimidation, misrepresenting a company-operated review platform as independent, and buying or selling fake indicators of social media influence.
The FTC's supplementary materials state directly that these prohibitions apply regardless of whether the deceptive content was produced by a human or by AI or algorithmic tools. This is not guidance. It is a formal trade regulation rule, which means violations can carry civil penalties under the FTC Act.
Why This Is an AI Governance Problem, Not Just a Legal One
Most compliance teams treat this rule as a marketing or legal review issue: check the review policy, train the marketing team, move on. That approach misses where the actual risk now sits. Enterprises increasingly use AI agents to draft review responses, generate review summaries, moderate incoming reviews, rank or personalize which reviews display to which users, and translate or adapt review text. Each of these is a workflow, not a policy document, and each one can produce non-compliant output without a human ever reviewing it before publication.
The rule's language about knowing or should-have-known standards means an enterprise cannot plausibly claim ignorance if its AI agents were operating without oversight. Compliance exposure here is a function of what your agents are permitted to do, what gets logged, and whether a human checkpoint exists before output reaches production.
Technical Implications for AI-Touched Review Workflows
AI systems that draft or suggest review text create direct exposure if that text is published as though written by a genuine customer without disclosure. AI moderation or ranking systems that apply sentiment-based filtering, even unintentionally through model bias, can implicate the rule's suppression provisions if negative reviews are disproportionately removed or buried.
Review summarization features, the kind that generate a short AI summary of hundreds of reviews on a product page, require accuracy checks to avoid misrepresenting the balance of underlying sentiment. Personalization systems that selectively surface reviews to specific segments raise exposure if that selective display is undisclosed and materially distorts perceived consumer sentiment. None of these are hypothetical AI ethics concerns. They map to specific provisions in the rule.
Operational and Governance Considerations
Accountability should be explicit and split across three functions: marketing owns the customer-facing review program, legal or compliance owns interpretation of the rule, and AI governance owns what the agents are actually permitted to do and how that is enforced at runtime. Approval workflows should require sign-off before an AI agent with review-generation or moderation capability goes live, not after a complaint surfaces.
Audits should be run against the rule's specific prohibited practices, not against general AI ethics frameworks, since the FTC's enforcement standard is grounded in the rule's text. Because the FTC has not yet issued enforcement action specifically targeting AI-generated reviews, and no dedicated technical guidance exists on required audit log formats, organizations should maintain a conservative posture rather than wait for case law to clarify edge cases.
Where Runtime Controls Fit
Policy documents and training do not stop an AI agent from generating a fabricated review or an AI moderation system from suppressing negative feedback in production. That requires enforcement at the point where the agent acts: permissioning what a review-facing agent is allowed to generate, publish, or suppress; requiring tool approval before an agent can push content to a live review surface; and logging every action an agent takes against review content so provenance can be reconstructed if a regulator asks.
Trussed AI provides runtime governance and security for enterprise AI agents, including agent permissions, least privilege enforcement, tool approval workflows, and audit logging. These are infrastructure-level controls that support the operational requirements described above; they do not constitute legal compliance advice or a compliance guarantee.