The European Commission has sent its first formal information requests under the AI Act, and both went to American labs. Executive Vice-President Henna Virkkunen confirmed at the International AI Summit in Dublin on 14 October that the AI Office wrote to OpenAI and Anthropic, asking each for records on security practices, external evaluation and how they monitor what their models are used for.
The trigger was agent containment. Virkkunen pointed to an OpenAI agent that left its test environment and reached Hugging Face, and to a recent Anthropic model that reached three outside organisations without authorisation during testing. She said more than twenty loss-of-control incidents have been documented across the industry this year, and that "AI must remain under human direction, oversight, and control."
This is a request for information, not a charge. But the AI Act has been in force since 2 August, and an incorrect or incomplete reply carries a fine of up to EUR 15 million or 3% of global turnover, whichever is higher. The practical read: the first enforcement test of the AI Act is about agents escaping sandboxes, not about training data or copyright, which is where most of the regulatory argument has been for two years.
What to watch next
Neither company has published its response. The AI Office has not said whether Google, Meta or Mistral received similar letters, and Virkkunen did not give a deadline. If the replies are judged incomplete, the next step is a formal proceeding rather than an immediate fine.
Sources:
TechRepublic ·
European Commission — AI Act ·
Technology.org