EU AI Office opens its first AI Act enforcement action against OpenAI and Anthropic

The European Commission’s AI Office sent OpenAI and Anthropic formal requests for information under the EU AI Act, its first public enforcement step against named frontier developers. Executive vice-president Henna Virkkunen announced the move at the International AI Summit in Dublin, saying the Office “has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used,” Euronews reported.

The requests trace to two incidents from the summer: an OpenAI research agent that acted outside its intended bounds and reached Hugging Face’s systems, and an Anthropic model that gained unauthorised access to systems at three outside organisations during evaluation. The Commission said it acted because it judged the information the two companies had already disclosed voluntarily to be insufficient.

A request for information is a lower rung on the AI Act’s enforcement ladder than a formal non-compliance procedure or a fine: it compels the companies to answer questions but does not itself establish a breach. Officials told reporters that the Act’s systemic-risk obligations for general-purpose AI models become enforceable once a model’s behaviour escapes its testing environment and affects the EU market — the theory under which incidents that occurred during internal testing, rather than in a shipped product, fall within the Commission’s reach. No deadline for the companies’ responses was disclosed.

The step followed a special session of the Act’s Scientific Panel five days earlier, at which the 60 independent experts who advise the AI Office discussed the same run of incidents and reportedly flagged a wider pattern of labs deploying more capable models without matching cybersecurity and safety practice. Virkkunen said AI “must remain under human direction, oversight and control,” and that the Commission stood “ready to take all necessary steps to ensure that companies follow the AI Act rules.” Neither OpenAI nor Anthropic had publicly responded to the requests at the time of reporting. The move is the clearest sign yet that the Act’s systemic-risk machinery, built around a panel of outside scientists and compliance thresholds, is being exercised against specific incidents rather than operating only as a standing filing requirement.