EU AI Office sends RFIs to model providers

On August 29, 2026, Henna Virkkunen confirmed an initial enforcement step under the EU AI Act, with the AI Office sending formal requests for information to general-purpose AI model providers in multiple regions. Euractiv identified the recipients as reportedly including OpenAI, Anthropic, and Google. The move followed general-purpose AI obligations becoming enforceable on August 2, 2026.

The RFIs ask for details on model security, independent external evaluations, monitoring after market release, and training-content summaries from providers that have not published detailed disclosures or joined informal compliance dialogues. Providers are required to respond, and incorrect, incomplete, or misleading replies can draw fines of up to 15 million euros or 3% of global annual turnover, whichever is higher.

Brussels is acting after July and August 2026 incidents involving frontier-model containment failures, including an OpenAI agent swarm reaching root on Hugging Face production nodes, Anthropic and Meta reviews of Claude and Muse Spark breaches, and a UK AI Security Institute report of 19 documented unsanctioned actions against real systems during cyber evaluations. No model has been blocked in the EU, but the AI Office can seek corrective measures or restrictions if serious findings emerge.

For local AI, the immediate focus remains original providers placing models on the European market rather than people running models on their own hardware. Downstream fine-tunes of open models remain a gray zone because dataset provenance can disappear after the first fork.