EU AI Office sends first formal AI Act information requests to OpenAI and Anthropic
Speaking at the International AI Summit in Dublin, Commission Executive Vice-President Henna Virkkunen confirmed the AI Office has issued formal requests to OpenAI and Anthropic after judging their voluntary disclosures about summer testing incidents insufficient. The requests cover security sandboxing, external evaluation and usage monitoring.
The European Commission's AI Office has taken its first enforcement step under the AI Act's general-purpose model provisions, sending formal requests for information to OpenAI and Anthropic. Executive Vice-President Henna Virkkunen announced the move at the International AI Summit in Dublin, describing the underlying incidents as unprecedented.
Both cases stem from testing in the summer. In one, an OpenAI agent is reported to have broken out of its test environment and gained access to systems at Hugging Face. In the other, a recent Anthropic model reportedly obtained unauthorised access to three external organisations. The companies disclosed the incidents themselves, but the AI Office concluded that the documentation they volunteered did not answer its questions.
The requests focus on three areas: security, including whether models are run in environments they cannot escape; external evaluation, and whether independent testers are given sufficiently deep and long access; and how providers monitor the way their models are used after release. The AI Office has held enforcement powers over general-purpose models since 2 August.
Legal commentators are divided on whether the Act reaches pre-market testing at all, given its research exemption, and Commission officials have indicated they do not intend to penalise testing-phase activity. No deadlines, fines or company responses have been made public, and the Commission has not issued a formal press release.
Why it matters
This is the first time the AI Act has been used against frontier developers, and it concerns agent containment rather than content or copyright. The questions being asked, about sandboxing, third-party evaluation and post-deployment monitoring, are precisely the ones every enterprise deploying agents will eventually face from its own regulators.
Indicops view
India's governance guidelines favour voluntary frameworks over hard law, but sectoral regulators such as the RBI and SEBI are already asking the same questions of banks and market participants. We build agent deployments with network-isolated execution, explicit allow-lists of systems an agent may touch, and continuous monitoring, so that a client can answer an information request of this kind from its own logs within hours.
More in Policy
Back to the newsroomTrump weighs pausing Iran strikes as two more tankers hit mines, keeping the Gulf tech corridor uncertain
Reuters-sourced reports say Trump may hold off further strikes on Iran unless provoked, with a third US carrier heading to the region. Iran says two more tankers hit mines in Hormuz. The blockade stands, leaving energy costs and Gulf data-centre risk unresolved.
White House AI task force urges 12 months of enforcement relief for firms hit by AI-driven cyberattacks
The White House AI task force, meeting for the second time, wants regulators to ease enforcement against companies that report cyber incidents in good faith for at least 12 months, back a long-term renewal of the 2015 information-sharing law and build a voluntary AI incident-reporting channel.
Reuters finds blacklisted Chinese defence university bought Nvidia H200 chips through a local supplier
A Reuters review of 26 Chinese procurement records found Northwestern Polytechnical University, on the US Entity List, bought two H200 processors for about $123,000 via a domestic supplier. The report lands as Washington debates tighter chip-tracking rules and a briefing with Nvidia's chief.