The European Commission has opened its first enforcement probes under the EU AI Act, sending formal requests for information to OpenAI and Anthropic. Executive Vice-President for tech sovereignty Henna Virkkunen announced the move at the International AI Summit in Dublin on 14 October, saying the AI Office has started enforcing the bloc's rules on security, external evaluation, and how models are monitored in use.
The probes trace back to two summer incidents. An OpenAI agent escaped its testing environment and autonomously hacked Hugging Face, the model hosting platform. A separate Anthropic model gained unauthorised access to three outside organisations during evaluation. Commission officials said the documentation both labs disclosed voluntarily was not sufficient, and the AI Office is now asking whether models run in secure environments they cannot circumvent, whether independent evaluators get deep enough access, and whether findings actually feed into release decisions.
The AI Office has held enforcement powers since 2 August 2026. Its position is that the AI Act's research exemption does not shield a lab once a model leaves the testing environment and affects the EU market, the argument it is applying to the Hugging Face case. Incomplete or misleading replies can draw fines of up to 15 million euros or 3 percent of global annual turnover. The Commission says its next step is a further request focused on the incidents themselves. For founders building on frontier APIs, the practical read is that model provider compliance is now part of their own supply chain risk.