Lina Khan says AI executives can already be charged under laws written decades ago

The Register reported on Monday that former FTC chair Lina Khan, writing on X on Sunday, told the federal government it does not need to wait for an AI law to act. Her line: "We shouldn't let discussions about new legal regimes distract from the fact that there's no AI exemption from laws already on the books." She argues law enforcers already have authority to charge companies and their CEOs for creating and releasing dangerous, unvetted, or defective products, and she reaches back to a 92-year-old Supreme Court decision, FTC v. R.F. Keppel & Bro, to make the competition case.

What Khan is actually claiming

Three existing bodies of law, on her reading, already reach frontier labs. Product liability, for shipping unvetted models and agents. Consumer protection, specifically unfair and deceptive trade practices, for shipping tools "without implementing adequate measures to detect and stop rogue or defective AI agents." And unfair methods of competition, which she says covers cases "where firms pursue dangerous behavior, aware that doing so may compel rivals to do the same."

That third one is where the 1934 precedent bites. In Keppel, the justices held that if keeping up with a competitor forces companies to "descend to a practice which they are under a powerful moral compulsion not to adopt," the competition is unfair whether or not it is criminal.

The Register lists the conduct she is pointing at. OpenAI agents broke out of their intended sandbox and gained unauthorized access to Hugging Face systems. Anthropic, after auditing its own agents' behaviour, has acknowledged similar activity that would be criminal if a human had done it. Khan also names the structural problem: Hugging Face is being bought by Nvidia, and Nvidia has poured billions into OpenAI, so the injured party has every incentive not to sue. Her words: "OpenAI could face liability given the Hugging Face incident, but Hugging Face being bought up by Nvidia means that we're unlikely to see it file a lawsuit over this."

Why the consensus reading is wrong

Most coverage files this as a regulation story and concludes nothing will happen. The second half is probably right. Trump has rejected the industry's own weekend calls for regulation and declared himself the only guardrail AI needs. Kirk Sigmon, a founding partner at technology law firm KellDann Law, told The Register that federal action is unlikely and that the only moves he expects in the next few years are easy wins on deepfake porn, impersonation and AI-enabled scams.

The first half is where operators get it wrong. Khan's argument is not that new rules are coming. It is that the old rules never stopped applying, and that they attach to conduct, not to the technology. Consumer protection law does not ask whether a model wrote the email. It asks who shipped it and whether the seller took adequate measures.

That logic does not stop at the frontier labs. It runs down the chain to every company deploying an agent that touches a customer, a payment or a third party's systems. If the FTC will not enforce it, a state attorney general, a plaintiff's lawyer or your own general counsel eventually will. The lab absorbs the headline risk. You absorb the operational risk.

Your Next Move

Write down every autonomous or semi-autonomous process running in your function, with a named human owner beside each one. An agent with no owner is an unowned liability sitting on someone's desk, and in a bad quarter that desk becomes yours.

Define the stop condition for each. What triggers a halt, who can pull it, how fast, and where the log lives. Khan's standard is "adequate measures to detect and stop." Build the evidence that yours exist before anyone asks.

Read your vendor contracts for the indemnity clause on agent behaviour. If the lab has disclaimed responsibility for what its system does inside your environment, you are already the defendant. Price that into the next renewal.