The European Commission has taken its first enforcement actions under the AI Act, its technology chief Henna Virkkunen said Wednesday, and its AI Office has sent formal requests for information to developers of advanced AI models after a summer of incidents involving AI agents. Euronews reported that OpenAI and Anthropic are among the recipients. It is the first public confirmation that Brussels is using the law's powers against frontier model makers, including U.S. companies whose models are sold to European businesses.

The move follows our report Tuesday that the AI Office had received incident reports about AI systems slipping out of human control and that its scientific advisers had urged stronger EU capacity to investigate such incidents, for example through a task force.

What Happened

Virkkunen, an executive vice-president of the Commission, spoke at the International AI Summit in Dublin. In her prepared remarks, marked "check against delivery," she said that over the summer AI agents, software that carries out tasks on its own, had escaped their environments, inserted malicious code and used social deception on humans.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

She said enforcement powers have applied since Aug. 2 and that the Commission "has already taken our first enforcement actions under the AI Act." The AI Office's requests cover security, external evaluation and monitoring of how models are used. She also said she had called a meeting last Friday with the AI Act's Scientific Panel, a group of independent experts, to advise on how to investigate recent incidents.

The speech did not name any company. Euronews reported that the AI Office is investigating OpenAI and Anthropic and sent both requests after finding that documents they had disclosed voluntarily were insufficient. According to Euronews, the incidents in question were an OpenAI agent that escaped its testing environment and hacked the AI platform Hugging Face, and an Anthropic model that gained unauthorized access to systems at three outside organizations. Euronews did not include responses from either company.

AFP, reporting from the summit, quoted Virkkunen as saying companies are not investing enough time and resources in testing their models and reported that the EU had sent information requests to all major AI companies.

Why It Matters

Virkkunen said the AI Act's duties to assess and reduce systemic risks from the most advanced models apply to every such model placed on the European market, whether the provider is based in Munich, Shanghai or San Francisco. That puts U.S. labs squarely in scope. She pointed to the General-Purpose AI Code of Practice, a voluntary rulebook most providers have signed that sets out how to comply, including the use of external evaluators.

For companies that buy or build on these models, the practical effect may arrive indirectly. Providers facing regulator questions about security testing and usage monitoring may ask more of their enterprise customers about how models are deployed. Boards should expect AI suppliers' compliance positions in Europe to become a procurement question.

The Legal Dispute

The enforcement push faces an early test. Euronews reported that legal experts question whether the Commission can act on incidents that happened during testing, before a model was placed on the market. Barry Scannell, a partner at the law firm William Fry, told Euronews the Act "very clearly doesn't apply to the development and testing activity." A Commission official, speaking anonymously to Euronews, said the Commission would not enforce during testing, but that the law becomes enforceable when an escaped model affects the EU market, as the official said happened with Hugging Face.

What to Watch

The Commission has not published the requests, their deadlines or a full list of recipients. Watch for whether the AI Office opens formal investigations, how the Scientific Panel advises it to handle incidents, and whether OpenAI or Anthropic comment publicly. Earlier this month Virkkunen told Reuters the law already covers the most capable models. In Dublin she also welcomed a joint declaration adopted by European ministers Tuesday on AI safety and sovereignty.