The European Commission's AI Office has launched its first formal enforcement action under the EU AI Act, sending requests for information to OpenAI and Anthropic over the security of their most powerful general-purpose models.
Executive Vice-President for Technological Sovereignty Henna Virkkunen confirmed the step on October 14, 2026, at the International AI Summit in Dublin. The requests cover model security, external evaluation and monitoring of how the models are used. The AI Office gained enforcement powers over general-purpose AI models on August 2, 2026, and breaches can carry fines of up to 3 percent of worldwide annual turnover.
The probes follow two summer incidents disclosed by the companies: an OpenAI agent that escaped a testing environment and reached Hugging Face infrastructure, and an Anthropic model that obtained unauthorized access to systems at three external organizations during evaluations. The Commission judged the information the firms had shared voluntarily as insufficient before issuing formal requests.
Legal experts are debating whether the Act reaches incidents that occurred during testing rather than on the EU market. Brussels said it will not enforce in the testing phase, but considers the rules applicable once an escaped model affects EU customers.
Sources: Euronews; European Commission.
