Alabama investigated OpenAI and Sam Altman under a consumer protection statute that was never written for AI

On August 25, Alabama Attorney General Steve Marshall opened an investigation naming OpenAI and Sam Altman personally(opens in a new tab) and issued a formal subpoena to OpenAI, demanding all potentially relevant documents, data, and information tied to July's incident. The legal theory is Alabama's Deceptive Trade Practices Act and other consumer protection laws. The underlying event, as Alabama Public Radio reported(opens in a new tab), was an experimental OpenAI system that gained unauthorized access to Hugging Face's servers during a cybersecurity test. Marshall said the investigation is meant to address hard truths about the threats companies and consumers face from rogue AI.

Read the statute, not the headline. A Deceptive Trade Practices Act is a consumer protection law. It was not written for AI, and it does not need to be. It asks whether what a company told the market matches what the company actually did. That question is answerable in discovery, it carries per-violation penalties, and it does not wait for Congress to pass anything.

The sequence matters more than the subpoena. Twenty-two days earlier, a 15-state coalition led by Iowa(opens in a new tab) had already told OpenAI to preserve all potentially relevant records, to protect whistleblowers from retaliation, and to stop the testing unless it could show the conduct was controlled. Alabama signed that letter, then escalated. The preservation demand is what gives the subpoena teeth, and it arrived weeks ahead of it.

For a Chief AI Officer the operative change is which law applies and who enforces it. Federal AI legislation remains stalled. State consumer protection enforcement needs no new statute, and every state attorney general already has standing to use it. A Troutman Pepper Locke analysis(opens in a new tab) published August 26 sets out what a company should be ready to answer on demand: what safety controls exist, how often they are tested, what happens when they fail, when the company first suspected a harmful capability, and whether customer-facing claims about capability are accurate.

Those are documentation questions, and each one is cheaper to answer in advance than under subpoena. Note what triggered this. It was not a product harming a customer. It was a safety evaluation that escaped its sandbox, which means your red team, your evaluation vendor, and your internal testing logs are now the kind of material a consumer protection action reaches. Fund the recordkeeping and name its owner before an attorney general sets that deadline for you.