xAI's Regulatory Rap Sheet: Grok, Deepfakes and Two Government Investigations

xAI's Regulatory Rap Sheet: Grok, Deepfakes and Two Government Investigations

This is a busy week for Elon Musk's companies. SpaceX is set to list on June 12 under the ticker SPCX, Tesla is still explaining its robotaxi shortfall, and searches for the ethics of Musk-affiliated businesses reliably spike whenever one of them dominates the headlines. We have already published the SpaceX record and the Tesla record.

xAI deserves its own entry. Not because of what the company says about itself, but because of what regulators, attorneys general and plaintiffs have put on the public record over the past five months.

Nine days, 1.8 million images

In late 2025, Grok's image tools began producing sexualized deepfakes of real women at industrial scale. A New York Times review found that Grok generated roughly 1.8 million sexualized images of women in a nine-day period.

That number matters because it removes the usual defence. A handful of harmful outputs can be framed as edge cases that slipped past safety filters. 1.8 million outputs in nine days is a product behaving as designed, or at minimum a product shipped without functioning safeguards.

RAND researchers made the same point in February: Grok is not a glitch, it is a regulatory reckoning. The episode exposed a gap between AI companies' stated safety commitments and what their deployed systems actually do.

Two governments opened formal investigations

The regulatory response was fast and crossed jurisdictions. Ofcom, the UK's online safety regulator, opened a formal investigation into Grok's image generation. The European Commission opened its own. Two of the world's most consequential tech regulators are now examining the same product at the same time.

In the United States, New York Attorney General Letitia James demanded xAI take more action to stop Grok producing sexualized imagery, joined by 34 other state attorneys general. That is 35 state law enforcement offices on one letter.

For investors, the distinction between criticism and enforcement is the whole game. Commentary fades. Formal investigations produce findings, fines and binding remediation orders. The EU's Digital Services Act allows penalties of up to 6 percent of global revenue.

The lawsuits are stacking up

Alongside the regulators, women depicted in Grok-generated imagery are suing. The 19th reported in March on litigation brought by women and girls over nonconsensual deepfakes, and the docket has kept growing since. The newest suit was filed on June 3, 2026, one week ago.

Civil litigation matters for a different reason than regulation. Discovery forces internal documents into the open. What xAI knew about Grok's outputs, when it knew, and what it chose to ship anyway will eventually be a matter of court record rather than corporate communications.

The plaintiffs also change the timeline. Regulators can settle quietly; individual women suing over images of themselves generally do not. Each new filing extends the period during which xAI's safety decisions stay under examination, and each one adds to the documentary record that scoring systems like ours draw on.

What the evidence says: xAI's Mashinii scorecard

Mashinii scores companies from exactly this kind of evidence. Not sustainability reports or self-assessments, but court filings, regulatory actions, attorney general letters and investigative journalism. The Grok episode is a near-perfect illustration of why: xAI publishes no ESG report, yet its conduct record is extensively documented by adversarial sources.

Here is how xAI scores across the values where we hold evidence:

Every score is negative. The worst is not the deepfake scandal. It is Planet-Friendly Business at -50, driven in large part by the emissions record of xAI's Memphis data centre, where the company ran dozens of gas turbines to power its Colossus supercomputer in a community already burdened by industrial pollution. The -30 on No War No Weapons reflects xAI's push into defence contracting.

The Grok deepfake record feeds the Safe & Smart Tech score of -10 and the Respect for Cultures & Communities score of -20. As the open investigations conclude and the June 3 suit proceeds, those scores will move with the evidence.

How xAI compares to its rivals

Frontier AI labs are not interchangeable on conduct. On Safe & Smart Tech, the value most directly tested by the Grok episode, the spread is wide.

Anthropic, which we covered in our IPO ethics review, holds the strongest record in the sector at +40. OpenAI sits at zero, with positives and negatives offsetting. xAI sits below both, and the gap is likely to widen if Ofcom or the Commission issues adverse findings.

That spread is the practical takeaway. "AI exposure" in a portfolio is not one risk. It is a set of company-specific conduct records, and they diverge sharply.

What to do with this

If you are weighing Musk-cluster exposure this week, treat the SPCX listing, Tesla's robotaxi numbers and xAI's regulatory position as separate questions with separate evidence bases. xAI's, right now, consists of two government investigations, a 35-state demand letter and active litigation.

Check whether your funds carry xAI exposure by running a portfolio audit, or search any company to see what the court filings and regulatory record actually say.