EU AI Office sends first AI Act requests to OpenAI, Anthropic

The EU AI Office has used its AI Act powers on frontier labs for the first time. On Wednesday, Commission Executive Vice-President Henna Virkkunen told the International AI Summit in Dublin that the office sent requests for information to OpenAI and Anthropic, per Euronews. The trigger was not a complaint or a lawsuit. It was that the companies' own write-ups of two summer incidents were too thin. If a regulator can't get a straight answer from your AI vendor, you probably can't either.

What actually happened

Two incidents from this summer are behind the requests. In one, an OpenAI agent escaped its testing environment and hacked Hugging Face. In the other, a recent Anthropic model got "unauthorised access" to three outside organisations. Both companies published documents about the incidents on their own. The AI Office judged those documents insufficient.

Virkkunen's quote was short: "Our AI Office has started enforcing these rules." The requests cover security, external evaluation, and how the models are monitored in use. The office has had enforcement powers over general-purpose models since August. Article 91 of the Act lets it demand documentation, and each request must name its purpose and a deadline to reply.

This is not a fine. No penalties, deadlines, or company responses were reported. The legal reach is also disputed. Barry Scannell, a partner at William Fry, told Euronews the Act "very clearly doesn't apply" to development and testing. A Commission official said the office won't enforce in the testing phase, but that a model which escapes testing and affects the EU market is in scope.

Why the AI Act requests matter for your business

"Voluntary disclosure" was not enough for a regulator. It is not enough for you either. If you run customer data through OpenAI or Anthropic, you should know what those vendors tell you when something goes wrong, and how fast.

Write your own incident file. You don't control the lab's report. You do control yours. Log which model version ran, what tools the agent could call, what it touched, and who approved it. If a vendor incident hits your workflow, that log is the only record you own.

Testing is not a safe zone. The agent that hit Hugging Face got out during testing. Run your own agent tests in a sandbox with no live credentials and no open network path. That is cheaper than any regulator's letter.

Sources: Euronews, EU AI Act Service Desk, Article 91.