North Carolina Has No AI Law. The FTC and Chapter 75 Already Are One.

As of September 29, 2026, no statute in Raleigh regulates artificial intelligence. Two laws that predate AI by decades already reach a North Carolina business that markets an AI product, uses one in its own marketing, or manages the reviews under its name: Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), and North Carolina's own Unfair and Deceptive Trade Practices Act, G.S. 75-1.1. This piece names the rules and the dates behind them. It is general information, not legal advice, and what any of it means for a specific business is a question for counsel, not for this page.

The federal rule with no AI in it

Section 5 bans unfair or deceptive acts or practices in commerce. It has run, unchanged, since 1938. Nothing in its text mentions artificial intelligence, and the Commission has said so itself: its posture since 2025 has been to target "bad actors who undermine innovation through deception" rather than to write AI-specific rules. What changed is enforcement, not the statute.

On September 25, 2024, the FTC announced "Operation AI Comply," a sweep of five cases built on the same theory: a business had used the word "AI" to make a claim it could not back up. DoNotPay's "AI Lawyer" cost $193,000 to settle. Ascend Ecom and Ecommerce Empire Builders sold "AI-powered" ecommerce storefronts on income promises the FTC says were false, for a combined tens of millions of dollars. Then-Chair Lina Khan's line at the time still states the theory plainly: "Using AI tools to trick, mislead, or defraud people is illegal."

The case with the most direct bearing on a small business came eighteen months later. The FTC sued Air AI on August 25, 2025, over a "conversational AI" sales agent it marketed with earnings claims the Commission says were false and a refund guarantee it says the company would not honor. The settlement, announced March 24, 2026, bans Air AI's owners from marketing business opportunities, carries an $18 million judgment (largely suspended) and requires $50,000 paid now. The release says plainly that the company "misled many entrepreneurs and small businesses." It is the first Operation AI Comply matter where a small business is the named victim rather than the named defendant, and it reads as a warning in both directions: to a business buying an AI vendor's earnings pitch, and to one making its own.

A second 2026 case reinforces the same point from the seller's side. On August 27, 2026, the FTC finalized orders against Cox Media Group and two smaller firms, totaling $930,000, for marketing an "AI-powered" local ad-targeting service the Commission says never worked as described: it claimed to target ads from conversations captured on customers' smart devices, and, per the FTC, did nothing of the sort. The rule being enforced in both cases is the same one that has always governed an advertising claim: say what the product does, and be able to show it.

Reviews are their own rule, and it names AI directly

A business does not have to buy a bad AI product to be exposed. It can generate the exposure itself, in its own reviews. The FTC's Consumer Reviews and Testimonials Rule, 16 CFR Part 465, took effect October 21, 2024, and it names the mechanism: a business may not write, buy, or solicit a review "by someone who does not exist, such as AI-generated fake reviews," or one from someone with no actual experience of the product. Civil penalties run up to $53,088 per violation (the figure adjusts for inflation; this is the post-January-2025 cap), and the FTC has already used the rule. Rytr, an AI writing tool that let subscribers generate reviews wholesale, was part of the original 2024 sweep. In December 2025, the Commission reopened and set aside Rytr's order, on the theory that a tool-maker needs to know its customers will misuse it before the FTC will hold the tool liable. That narrows the exposure of an AI vendor. It does not touch the exposure of the business that posts the review, buys the review, or asks an AI tool to write one and puts it up under a customer's name. Under Part 465, that business is the one holding the violation.

What Raleigh adds: treble damages

Nothing above requires a North Carolina statute, and none exists. What North Carolina adds is Chapter 75. G.S. 75-1.1 declares unfair or deceptive trade practices unlawful, in the same general terms as Section 5, with no AI carve-out and no size threshold. The difference from federal law is the remedy: G.S. 75-16 requires a court to award a prevailing private plaintiff three times its proven damages, and G.S. 75-16.1 lets a court add attorney's fees against a defendant found to have violated the statute willfully. A federal Section 5 claim is the FTC's to bring. A Chapter 75 claim is any injured customer's, with treble damages attached by statute.

No North Carolina court has yet applied G.S. 75-1.1 to a business's AI tool. The closest reasoning anywhere on point is Canadian: in Moffatt v. Air Canada (2024 BCCRT 149), a tribunal held the airline to a bereavement-fare discount its own website chatbot had invented, on the reasoning that "it should be obvious to Air Canada that it is responsible for all the information on its website." The decision binds nothing in North Carolina. It is persuasive only, from a small-claims-tier tribunal in another country. But the underlying question, whether a business answers for what its own AI tool tells a customer, is exactly the question G.S. 75-1.1 is built to ask, and nobody has asked it here yet.

No NC AI statute, only an order and a stalled bill

North Carolina's executive branch has acted once. Executive Order No. 24, signed September 2, 2025, created an AI Leadership Council and an AI Accelerator inside the Department of Information Technology. It governs state agencies. It puts no duty on a private business.

The General Assembly has a bill: H1161, the Omnibus Artificial Intelligence Protections Act, filed April 30, 2026. Its most consequential section for a business would be a Fair Artificial Intelligence Hiring Act, requiring an independent bias audit and advance notice before an employer relies on an AI hiring tool, with a private right of action and a 15-employee exemption drawn from Title VII's own threshold. The bill passed first reading and was referred to committee on May 4, 2026. No committee has acted on it since. Under the General Assembly's own adjournment resolution, a bill still sitting in committee cannot be taken up in this year's reconvened sessions, which run through sine die on December 18, 2026. H1161 is introduced, in committee, and dead for the 2026 session; anything like it would need to be refiled as a new bill in 2027.

The fight in Washington is not about this

The loudest AI policy fight this year is in Washington, over whether the federal government should stop states from writing AI laws at all. Executive Order 14365, signed December 11, 2025, ordered a Justice Department task force to challenge state AI laws, a Commerce Department list of "onerous" ones, and an FTC policy statement on when state AI rules are preempted. The one time Congress voted on stopping states directly, it refused: a ten-year moratorium on state AI legislation, folded into the 2025 reconciliation bill, was stripped from the Senate text 99 to 1 on a floor vote at 4:08 in the morning on July 1, 2025. The sole vote to keep the moratorium came from North Carolina's own Thom Tillis.

None of this touches North Carolina today, because North Carolina has no AI statute for a federal order to preempt. The FTC's own proposed policy statement, issued July 1, 2026 and not yet final, argues that a state law forcing an AI system to alter its truthful output can itself be a Section 5 violation. Read plainly, that argument does not shrink Section 5's reach. It assumes Section 5 already applies to AI claims, and builds a preemption theory on top of that assumption. The federal fight over the framework has not, so far, changed the one federal rule that already binds a business making or buying an AI claim.

Room for disagreement. A statute the FTC has not yet applied to a given fact pattern is not a rule a small business can plan around, and settlement is the FTC's preferred outcome in every case named above, which means none of them sets a precedent a lawyer can cite with confidence. A vendor building an AI product cannot read a case that has not been brought. That complaint is fair, and it is also the complaint every general consumer-protection statute has always drawn, AI or not. Section 5 and G.S. 75-1.1 were general on the day they were written, and they still are.

Where OCI stands

OCI builds and runs AI agents for North Carolina businesses. We are not a law firm. What we can do, and what this piece tries to do, is name the rules that already touch a business today, with the date and the primary source behind each one. We do not describe a product, a workflow, or a client as "compliant" with anything; that word belongs to a lawyer, applied to a specific set of facts, never to a general description on a blog. Where a decision reaches a real person, hiring, credit, health, or a customer's money, the decision goes to counsel, not to us.

If any of this raises a question about a specific business, the honest answer is that this piece cannot give it. We would rather have that conversation directly.