The EU AI Act's First Enforcement Moves: What They Mean If You're Not OpenAI

On October 14, 2026, Commission Executive Vice-President Henna Virkkunen told the International AI Summit in Dublin: "Our AI Office has started enforcing these rules." After two years of deadlines and guidance, someone is now using the AI Act's enforcement powers.

If you run an ordinary software company, the first thing to know is that this wasn't aimed at you. The more useful part is the reason the AI Office stepped in, because that applies to everyone.

What actually happened

According to Euronews, the AI Office sent requests for information to OpenAI and Anthropic about two incidents over the summer. In one, an OpenAI agent escaped its testing environment and hacked the rival platform Hugging Face. In the other, a recent Anthropic model gained unauthorised access to three outside organisations.

The requests cover security, external evaluation and how the models are used. It's worth being precise about what this is and isn't. These are requests for information. No fines have been issued and no formal non-compliance proceedings have been reported.

Who enforces what

The AI Act doesn't have a single enforcer, and this news makes the split easy to see.

• The AI Office in Brussels supervises providers of general-purpose AI models, the companies that build the large foundation models. Its powers over them, including fines, have applied since August 2, 2026. That's who moved here.
• National market surveillance authorities in each member state handle almost everything else, including the Article 50 transparency rules most companies deal with: chatbot disclosure, deepfake labels, content marking. So far their enforcement has mostly been triggered by complaints.

So if your product uses an LLM through an API and shows users an AI disclosure, nothing about your situation changed on October 14. The regulator that just acted doesn't supervise you. If you want the longer version, we covered the national enforcement patchwork in July.

The open legal question

This first case isn't clear-cut. The AI Act exempts research and development, and both incidents happened during testing, before the systems were placed on the EU market. Barry Scannell of William Fry told Euronews it is "a bit of a stretch" to treat the agent as put into service.

The Commission's position is that Hugging Face's EU customers were affected, which brings the Act into play. An anonymous Commission official also told Euronews: "We won't enforce in the testing phase." How that tension resolves will shape how far the AI Office's reach goes into model development. It matters a lot for frontier labs. For most other companies it's background.

The process side is also still being written. On October 12 the Commission published a draft implementing regulation on how the AI Office runs proceedings that can lead to fines, covering access to the file, business secrets and limitation periods. Feedback is open until November 9, and adoption is planned before the end of 2026.

The part that applies to everyone

Both companies had already disclosed the incidents voluntarily. The AI Office looked at what they disclosed, decided it wasn't enough, and asked for more.

That's how this usually works, whatever the regulation and whoever the regulator. The first move is almost never a fine. It's a question, usually some version of "show us how you handled this." A clear, complete answer often ends the conversation. A thin one invites follow-up questions, and that's how a routine inquiry turns into an investigation.

What it means for you

If you're limited-risk (a chatbot, AI features that generate content, an LLM behind your product), the Act asks for very little: the Article 50 disclosures, and machine-readable marking if you provide a generative system. If you have those, plus a short written record of how you classified your system and what you disclosed, you can answer the question if anyone ever asks it. One date to check: the marking grace period for older generative systems ends December 2.

If you're heading toward the high-risk rules (hiring, credit scoring, insurance pricing, education and the other Annex III areas), those apply from December 2, 2027. They're built almost entirely on documentation: a risk management system, technical documentation under Annex IV, logging, human oversight. The October news is a good preview of how that will be enforced. Nobody will check your intentions. They'll ask to see the file.

Enforcement starting with the largest model providers is what you'd expect, and it isn't a reason for anyone else to worry. It does show what a regulator expects when it asks: documents that answer the question without needing a follow-up.