AI Act Enforcement Begins: Brussels Questions OpenAI and Anthropic

AI Act enforcement has begun. In October, the EU AI Office sent OpenAI and Anthropic formal requests for information after summer incidents in which their models, during testing, broke into the systems of outside companies. There are no fines or charges yet, but it shows the Commission intends to use the powers it has held since August.

What actually happened?

Henna Virkkunen, Executive Vice-President of the European Commission, announced on 14 October 2026 at the International AI Summit in Dublin: “Our AI Office has started enforcing these rules” (as quoted by Euronews). The requests cover safety, external evaluations and monitoring of how the models are used. The Office sent them because it found the documents both companies had handed over voluntarily insufficient.

This is, of course, about two high-profile incidents from the summer:

1. OpenAI – an agent escaped its test environment and broke into the infrastructure of Hugging Face, a platform that customers in the EU also use.
2. Anthropic – as the company admitted at the end of July, Claude models (including the most powerful one, Mythos 5) gained unauthorized access to the systems of three outside organizations during testing (interestingly, Anthropic’s models got internet access because of a misunderstanding with the partner running the evaluation).

What does AI Act enforcement against model providers actually involve?

Obligations for providers of general-purpose AI (GPAI) models have applied since 2 August 2025, but the Commission’s powers to enforce them only took effect on 2 August 2026. Supervision belongs exclusively to the Commission, which entrusts it to the AI Office (Art. 88).

A request for information is a tool under Art. 91: the Commission can demand the model’s documentation and any information needed to assess compliance. The provider must reply within the set deadline. This is serious, because Art. 101 allows fines of up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher. That also covers supplying incorrect, incomplete or misleading information in the reply.

Do tests like these even fall under the AI Act?

… and that is exactly where it gets unclear. The AI Act does not cover research, testing or development carried out before a model is placed on the market. Barry Scannell of the law firm William Fry told Euronews that the rules “very clearly” do not apply to development and testing. A Commission official responds that they will not enforce the rules during testing, but if a model escapes its test environment and affects the EU market, the AI Act applies.

If the Commission wins this argument, labs will have to show Brussels not only their finished models but also how they secure their tests.

What does this mean for a European company that uses AI?

The requests went to the model providers, not to their customers. If you use ChatGPT, Claude or these companies’ APIs, you don’t have to change anything overnight. Still, I would draw two lessons:

1. Mind your own obligations. Since 2 February 2025, Art. 4 has required companies that deploy AI systems to ensure a sufficient level of AI literacy among the staff who use them. Other obligations depend on what the AI is used for.
2. Limit what your agents can reach. Both incidents started with agents that had internet access they should not have had. If you connect an agent to company systems, give it only the permissions and connections the task needs.

TL;DR

Have OpenAI or Anthropic been fined?

No. As of 15 October 2026, the AI Office has only sent requests for information. A fine would require preliminary findings and a hearing of the provider (Art. 101).

Who enforces the AI Act against AI model providers?

The European Commission, through the AI Office. National market surveillance authorities are responsible for AI systems used in companies (for example, prohibited practices or high-risk systems).

Does the AI Act apply to my European company if I only use ChatGPT or Claude?

The obligations for general-purpose models rest with their providers. As a company deploying AI, however, you have your own obligations, above all regarding staff AI literacy (Art. 4), and further ones depend on the use case.