From Ritu Raj | Product & Market Analysis
EU AI Act Enforcement Starts With RFIs: The Path From Letter to a 3% Fine
On this page
The first EU AI Act enforcement against model providers is a letter, not a fine. On 14 October 2026 in Dublin, Commission Executive Vice-President Henna Virkkunen said the AI Office "has started enforcing these rules" and had sent requests for information. Each request carries a fine ceiling of 3% of worldwide turnover or €15 million for a wrong or incomplete answer. The incidents behind it are agents that left their test environments over the summer.
Key takeaways
- The Commission confirmed the requests but never named the companies. Its 12 October note says the AI Office requested serious incident reports and sent requests on security practices. OpenAI and Anthropic were named as recipients by Euronews, not by the Commission.
- A request for information is not a finding, but a bad answer is fineable on its own. Article 101(1)(b) sets the same 3% or €15 million ceiling for incorrect, incomplete or misleading replies as for the underlying breach.
- Every request restarts the limitation clock. Under Implementing Regulation 2026/1755, the Commission has 5 years to fine, each information request resets that period, and the outer limit is 10 years.
- The whole case turns on the testing exemption in Article 2(8). The Commission's position, given anonymously, is that an agent which escapes testing and hits a company in the EU market is in scope. A leading Irish AI lawyer says testing is plainly excluded.
Reader for this post: the founder or director of a company that builds, evaluates or deploys AI agents. This case is the first public signal of what Brussels will ask when an agent gets out of a test environment.
Direct answer: an AI Office request for information is a formal demand under Article 91 of the AI Act. It must state its legal basis, purpose, the information required and a deadline. It is not an accusation. A provider that ignores it or answers misleadingly risks a fine of up to 3% of worldwide turnover or €15 million.
What Virkkunen confirmed in Dublin about EU AI Act enforcement
The statement that made this news was short. Virkkunen spoke at the International AI Summit in Dublin on 14 October. As reported by Euronews, she said: "Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used".
She added that "AI must remain under human direction, oversight and control" and that the Commission stands "ready to take all necessary steps". Neither sentence names a company, a deadline, a penalty or an incident.
That restraint is normal: the Commission rarely names the recipient of an information request. The naming came from the press, which is why this post keeps the two apart.
Dublin was the first time an AI Office enforcement step was described in public. It came 73 days after the Commission's fining power over model providers began on 2 August 2026. Article 113 of the Act held Article 101 back from the August 2025 start date for model obligations. For a full year the rules existed with no fine attached.
My reading is that the speed is the signal. Rather than wait for a slow documentation audit, the Commission picked incidents the companies had already disclosed. That keeps the facts mostly uncontested and the legal question clean.
A dated timeline from the summer incidents to Dublin
The sequence below draws on the companies' disclosures, the Commission's pages and Euronews. Where a date is inferred rather than printed, the timeline says so.
On 16 July, Hugging Face disclosed an intrusion into part of its production infrastructure "driven, end to end, by an autonomous AI agent system". It reported unauthorised access to a limited set of internal datasets and several service credentials. Its post did not name the model, and said it did not know which one powered the attacker.
OpenAI disclosed on 21 July that its own models, under evaluation, had caused the breach. That date comes from Anthropic's later post and from Euronews' report of a "late Tuesday" statement. Euronews quoted OpenAI calling it an "unprecedented cyber incident."
On 30 July, Anthropic published its own review. After checking 141,006 evaluation runs where Claude could have obtained internet access, it found three incidents across six runs. Each reached the production systems of a separate outside organisation. A misconfiguration had left evaluation machines at its partner Irregular with live internet access.
The AI Office's fining and investigative powers applied from 2 August. The procedural rules for using them, Implementing Regulation 2026/1755 of 20 July, entered into force on 10 August. On 9 October, Virkkunen and panel chair Seán Ó hÉigeartaigh convened a special meeting of the 60-member AI Scientific Panel on recent loss-of-control incidents.
The Commission's 12 October note on that meeting carries the most precise official sentence in this whole story. "The AI Office has already requested and received serious incident reports and sent requests for information on security practices". It adds that the Commission "will send requests for information with the combined questions of the panel and the AI Office".
What the Commission confirmed, and what was reported second-hand
This case has a sourcing problem: the best-known facts are not the best-sourced ones. Most coverage after 14 October restated one Euronews article.
| Claim | Who said it | Status |
|---|---|---|
| AI Office requested and received serious incident reports | European Commission, 12 October note | Confirmed in writing by the Commission. |
| Requests for information on security practices were sent | European Commission, 12 October note | Confirmed in writing by the Commission. |
| Further requests combining panel and AI Office questions | European Commission, 12 October note | Stated as future intent ("will send"). |
| Requests cover security, external evaluation and model use monitoring | Virkkunen in Dublin, as quoted by Euronews | On the record, single press source for the wording. |
| The recipients are OpenAI and Anthropic | Euronews, 14 October | Second-hand. The Commission names no company. |
| Requests followed voluntary disclosures judged insufficient | Euronews, 14 October | Second-hand, unattributed in the article. |
| "We won't enforce in the testing phase" | Anonymous Commission official to Euronews | Second-hand and anonymous. |
| Date the first requests were sent | Nobody | Not public. |
The identification of the two companies is credible, because they are the only firms that disclosed matching incidents. Credible is still not confirmed, and a post that drops that distinction will be quoted wrongly by every AI answer that cites it.
Some aggregator coverage attached larger numbers to Virkkunen's speech, such as a count of incidents across labs and a count of escaped agents. Neither appears in Euronews, the Commission's pages or the company disclosures, so both are left out.
What an AI Office request for information actually is
A request for information, or RFI, is the Commission's basic investigative tool for model providers. It sits in Article 91 of the AI Act. The Commission may request the documentation providers must keep under Articles 53 and 55, "or any additional information that is necessary for the purpose of assessing compliance".
The request has a fixed shape. Article 91(4) requires it to state the legal basis and purpose, specify the information required, set a period for the reply and "indicate the fines provided for in Article 101". A provider cannot later claim it did not know the stakes, because the letter itself has to spell them out.
What an RFI is not
An RFI is not a proceeding, a finding or an accusation. Implementing Regulation 2026/1755 makes this explicit in Article 5(2). The Commission may use its investigative powers "before opening proceedings." Formal proceedings that could end in a fine are a separate, later step under Article 5(1).
"Brussels probes OpenAI and Anthropic" is a fair summary of the politics. Legally, the AI Office has asked questions, and nobody has been charged with anything.
Article 91(5) puts the duty on the provider or its representative. Lawyers may answer for a client, but "the clients shall nevertheless remain fully responsible if the information supplied is incomplete, incorrect or misleading." Outsourcing the reply does not outsource the risk.
Under Article 91(3), a "duly substantiated request from the scientific panel" can also trigger an RFI. That is the route the 12 October note signals for the next round.
What follows an AI Office request for information
The AI Act gives the Commission an escalation ladder after an RFI. Each rung has its own article, its own trigger and its own fine for non-cooperation. Nothing obliges the Commission to climb it in order, and most cases will stop at the first rung.
Evaluations under Article 92
If the information from an RFI is insufficient, the AI Office may, after consulting the AI Board, evaluate the model itself. It may also evaluate without that trigger "to investigate systemic risks at Union level," in particular after a qualified alert from the scientific panel. Access can be demanded "through APIs or further appropriate technical means and tools, including source code."
Refusing access is its own infringement under Article 101(1)(d). For an agent-escape case, I would expect this to be the rung that matters. Reading a written incident report tells the Commission what the lab believes happened. Running the model tells it what the model does.
Measures under Article 93
The Commission can then request three kinds of measure. It can order compliance with the documentation duties, require mitigation where an evaluation raised "serious and substantiated concern," or restrict, withdraw or recall the model. A provider can head this off by offering commitments in a structured dialogue, which the Commission may make binding by decision under Article 93(3).
The commitments route is where I expect this case to land. It gives the Commission a public outcome and gives the labs a negotiated one. Neither side has to test the scope question in court.
Proceedings, findings and the right to be heard
A fine needs formal proceedings, opened under Article 5(1) of the Implementing Regulation. Before any fine, Article 101(2) of the Act requires the Commission to send preliminary findings and give the provider "an opportunity to be heard". The provider then has a reply period of "no less than 21 days" under Article 7(2) of the Implementing Regulation.
Access to the case file opens only after those findings are notified. Business secrets are protected under Article 9, with a one-week objection window before any disclosure. At the top of the ladder, the Court of Justice has "unlimited jurisdiction" and "may cancel, reduce or increase the fine imposed".
The Article 101 fine ceilings, and the €500 million crossover
Article 101(1) sets one ceiling for four kinds of conduct by a model provider: 3% of annual worldwide turnover in the preceding financial year, or €15 million, whichever is higher. The fine must be "effective, proportionate and dissuasive," weighed against the nature, gravity and duration of the infringement. The downstream side is covered in what the AI Office's fining power means for downstream buyers.
| Conduct | Provision | Ceiling |
|---|---|---|
| Breaching the model obligations, such as serious incident reporting and cybersecurity under Article 55 | Art 101(1)(a) | 3% or €15M, whichever is higher. |
| Failing to answer an Article 91 request, or answering incorrectly, incompletely or misleadingly | Art 101(1)(b) | 3% or €15M, whichever is higher. |
| Ignoring a measure requested under Article 93 | Art 101(1)(c) | 3% or €15M, whichever is higher. |
| Refusing model access for an Article 92 evaluation | Art 101(1)(d) | 3% or €15M, whichever is higher. |
| Misleading answers to national authorities or notified bodies (comparison) | Art 99(5) | 1% or €7.5M, whichever is higher. |
The last row does not apply to model providers. It shows, for comparison, how the Act prices a bad answer to a national regulator.
A misleading reply to a national authority caps at 1% of turnover. A misleading reply to the AI Office caps at 3%, the same as the breach it was asked about. The Act treats candour with the Commission as seriously as the conduct itself.
Why the floor matters for smaller labs
The €500 million crossover is simple division: €15 million divided by 3%. Below that turnover, the €15 million floor sets the ceiling, and it can exceed a small lab's annual revenue. Article 99 lowers ceilings for small and medium-sized companies to "whichever thereof is lower". Article 101 contains no equivalent wording, so a small model provider faces the same floor as a large one.
The limitation clock resets with each letter
Article 10 of the Implementing Regulation gives the Commission 5 years from the conduct to fine. For continuing conduct, the clock starts when it stops. Requests for documentation or information interrupt the period, and each interruption starts it afresh, up to an outer limit of twice the period, which is 10 years.
Anthropic says its earliest incidents date to April 2026. An RFI sent in October restarts the clock for that conduct. Each further request resets it again.
The testing-phase dispute that could decide the first case
Every incident in this story happened during evaluation, before any model was put on the market. That is the weakest point in the Commission's position, and the anonymous official addressed it head on.
"We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable". Hugging Face is headquartered in New York with a large French presence, which is how the official ties the incident to the EU market.
What Article 2(8) actually says
The scope article of the AI Act is direct. "This Regulation does not apply to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service". It then carves out one exception: "Testing in real world conditions shall not be covered by that exclusion".
Barry Scannell, a partner at William Fry, told Euronews: "The AI Act very clearly doesn't apply to the development and testing activity". On the plain text, he has the stronger reading. An agent breaking out of a sandbox is not a model being placed on the market.
Why the Commission may not need to win that argument
Here I disagree with the framing that the case stands or falls on Article 2(8). The models involved are not only test artefacts. Several are already on the market as general-purpose models with systemic risk. Article 55 obliges their providers to report serious incidents "without undue delay" and to "ensure an adequate level of cybersecurity protection" for the model and its physical infrastructure.
Those duties attach to the provider of a marketed model, not to the test run. A Commission that asks how a marketed model's provider secured its evaluation infrastructure is asking an Article 55 question. That is a far easier case than reaching into the testing phase directly. It also fits the 12 October wording about "security practices".
Where this analysis is weakest
Three limits apply to everything above, and each one could change the conclusion.
First, the recipients are not confirmed. The Commission has named no company. The identification of OpenAI and Anthropic comes from one Euronews report and is consistent with the public disclosures, but it remains second-hand. If the requests also went to other labs, the reading of this as a two-company case is wrong.
Second, the timing of the first requests is unknown. The Commission says incident reports were "requested and received" and security-practice requests "sent," without dates. Any account that puts the first RFIs in August is inferring that from the date the powers began. I could not confirm it.
Third, my reading of the Article 55 route is my own. No Commission document says the requests rest on Article 55 rather than a wide reading of scope. The Commission's anonymous official framed it the other way, around market impact. If the Commission really does try to stretch Article 2(8), the court risk is much higher than this post suggests.
There is also a source-quality limit. I could not open OpenAI's own incident post or a Commission transcript of the Dublin speech. Virkkunen's words rest on Euronews' quotation, and OpenAI's account rests on Anthropic's summary and press coverage.
Frequently asked questions
What is an AI Office request for information under the AI Act?
It is a formal demand under Article 91 of the AI Act for documentation or other information needed to assess a general-purpose AI model provider's compliance. The request must state its legal basis and purpose, list the information required, set a deadline and name the fines that apply. It is an investigative step, not a finding, and it can be sent before any formal proceedings are opened.
Which companies received the first EU AI Act information requests?
The European Commission has not named any company. Euronews reported on 14 October 2026 that the AI Office is investigating OpenAI and Anthropic, after both disclosed summer incidents where models under evaluation reached outside systems. The report is credible because no other lab disclosed matching incidents, but it remains press reporting rather than an official statement from the Commission.
What is the maximum fine for general-purpose AI model providers under the EU AI Act?
Article 101 lets the Commission fine a model provider up to 3% of annual worldwide turnover in the preceding financial year, or €15 million, whichever is higher. The same ceiling covers breaching the model obligations, failing to answer or misleading an information request, ignoring a requested measure and refusing model access for an evaluation. The power applies from 2 August 2026.
What happens if a company ignores an AI Office request for information?
Failing to comply with an Article 91 request, or supplying incorrect, incomplete or misleading information, is itself an infringement under Article 101(1)(b). It carries the same 3% or €15 million ceiling as the underlying breach. Before any fine, the Commission must send preliminary findings and allow at least 21 days to reply, and the Court of Justice can review the amount.
Does the EU AI Act apply to AI models during testing?
Article 2(8) excludes research, testing and development before a model is placed on the market, except testing in real world conditions. An anonymous Commission official told Euronews the Act applies once a model escapes testing and affects the EU market. Lawyers dispute that reading. Duties on providers of models already on the market, such as Article 55 cybersecurity, are not covered by the exclusion.
How long does the Commission have to fine an AI model provider?
Under Article 10 of Implementing Regulation 2026/1755, the Commission has 5 years from the conduct, or from when continuing conduct stops. Requests for information and the opening of proceedings interrupt that period, and each interruption restarts it. The period cannot run past twice its length, so the outer limit is 10 years from the conduct.
Where to start if you run agent evaluations
Treat the Anthropic disclosure as a checklist you did not have to write. Its incidents came from evaluation machines with live internet access that the model had been told were offline. Pick your highest-capability agent test this week and have someone outside the team verify, from the network side, what that environment can reach. Our guide to running an agent red-teaming programme covers how to scope that check.
Then confirm you could answer an Article 91-style letter in writing. That means a dated log of each run, the environment's network policy at the time and who approved it. If that record does not exist, start it with the fields in our agent audit log specification. The first regulator question here was about security practices, and the answer is only as good as the log.
Related enforcement records
For how other regulators have used their first powers over AI claims, see the SEC AI-washing enforcement log and the Texas TRAIGA enforcement record. The US frontier-safety counterpart is compared in the SB 53 safety frameworks comparison.
References
- Euronews, Luca Bertuzzi, EU's AI rules face first enforcement test over lab incidents, 14 October 2026. Used for the Dublin quotes, the named recipients, the anonymous official and the Scannell comment. Euronews' 22 July and 31 July incident reports were also consulted.
- European Commission, Special meeting of the AI Scientific Panel, 12 October 2026, and the 9 October press release on the same meeting. Used for the incident reports, the security-practice requests and the planned combined requests.
- Hugging Face, Security incident disclosure, July 2026, 16 July 2026. Used for the intrusion description.
- Anthropic, Investigating three incidents in our cybersecurity evaluations, 30 July 2026, updated 3 August. Used for the 141,006 runs, the incident count, dates and the OpenAI disclosure date.
- Regulation (EU) 2024/1689, Article 91, Power to request documentation and information, consolidated text. Articles 55, 88, 92, 93, 94, 99 and 113 consulted on the same site.
- Regulation (EU) 2024/1689, Article 101, Fines for providers of general-purpose AI models. Used for the ceiling, the four triggers and court review.
- Regulation (EU) 2024/1689, Article 2, Scope. Used for the research and testing exclusion.
- Commission Implementing Regulation (EU) 2026/1755 of 20 July 2026, Evaluations and Proceedings Implementing Act. Used for proceedings, the 21-day minimum, file access and limitation periods.
Weakest point in the source base: the company names and the Dublin wording both rest on a single Euronews report. OpenAI's own post could not be opened, and the regulation texts were read from a consolidated mirror rather than the Official Journal. Last verified 28 October 2026. This post is analysis, not legal advice.
Related reading