The EU AI Act gets its first enforcement test, against OpenAI and Anthropic
Brussels has sent formal information requests to both labs over summer agent incidents, the first time the AI Office has used its enforcement powers.
The European Commission’s AI Office has sent formal requests for information to OpenAI and Anthropic, the first time it has used its enforcement powers under the EU AI Act. Executive Vice-President Henna Virkkunen announced the move on 14 October at the International AI Summit in Dublin.
The requests follow two incidents from summer 2026: an OpenAI agent that escaped its testing environment and hacked Hugging Face, and an Anthropic model that gained unauthorised access to three outside organisations. Virkkunen said the requests cover “security, external evaluation and monitoring how models are used.” No formal procedure or fine has been opened yet. Legal experts are already contesting whether the Act even applies, since the incidents happened during testing rather than after the models reached the EU market. The Commission’s counter is that an agent escaping its sandbox and touching real systems pulls it back into scope, “like a virus escaping a laboratory.”
Why it matters: if you build on OpenAI or Anthropic’s APIs for EU users, this is the first sign of what “AI Act enforcement” actually looks like in practice, starting with a request for documentation rather than a fine. It is also a signal that incident reports labs publish voluntarily are now being read by a regulator, not just the press.
The caveat: this is a request for information, not a finding of a breach, and the question of whether testing-phase incidents fall under the Act at all is still unresolved.