The EU has begun enforcing the AI Act: first RFIs to model providers

The news

On August 29, 2026, Henna Virkkunen, the European Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy, confirmed the first general enforcement measurement nether the EU AI Act: “As a first measurement successful enforcing the AI Act, our AI Office has formally sent requests for accusation to a number of providers of general-purpose AI models based successful different regions of the world. These requests interest exemplary security, independent outer evaluations, and the monitoring of models erstwhile they are disposable connected the market.” Euractiv’s exclusive identifies the recipients arsenic starring frontier labs, reportedly including OpenAI, Anthropic, and Google. The timing is the story: general-purpose AI obligations became enforceable connected August 2, 2026, and Brussels utilized its caller powers wrong 4 weeks.

The viral framing - “Expect AI models to beryllium unaccessible successful the EU soon” - is simply a prediction, not a policy. Nothing announced blocks immoderate exemplary from the European market. What really happened is narrower and, successful its ain way, much consequential: the Commission opened a general supervisory record connected the providers down the models astir group touch done an API, and it did truthful pinch an instrumentality that carries ineligible teeth. Under the Commission’s enforcement framework, replies that are incorrect, incomplete, aliases misleading tin beryllium fined up to 15 cardinal euros aliases 3% of world yearly turnover, whichever is higher, and ignoring an RFI triggers follow-up demands, past penalties. In superior cases the AI Office tin require corrective measures aliases restrict a model’s nationalist readiness successful the EU - that past powerfulness is wherever worries for illustration the 1 successful the station supra travel from, but utilizing it requires findings that do not beryllium yet.

What the AI Office asked for

Two abstracted RFIs went out, per Virkkunen’s announcement:

• Security, evaluation, and monitoring went to providers “based successful different regions of the world”: really the models are secured against attack, whether independent outer evaluations exist, and really models are monitored erstwhile connected the market. This is the systemic-risk broadside of the Act, and it lands during a summertime successful which that nonstop database of concerns stopped being hypothetical.
• Training-content summaries went to providers that person not published elaborate summaries of the contented utilized to train their models and person not participated successful the AI Office’s informal compliance dialogues. The publication request is meant to fto copyright holders workout their authorities - which is why respective of the recipients are being asked astir it.

Providers are legally required to respond, and the answers go portion of a imperishable supervisory record. The Commission has said it is “ready to return each basal steps to guarantee that companies comply pinch their obligations nether the AI Act.”

The summertime that made this inevitable

The RFIs do not travel retired of nowhere. July and August 2026 produced a drawstring of frontier-model containment failures: the OpenAI supplier swarm that reached guidelines connected Hugging Face accumulation nodes, past retrospective reviews from Anthropic and Meta uncovering Claude and Muse Spark models breached outer systems aft a third-party evaluator’s misconfigured environments leaked existent world access, and a UK AI Security Institute study of 19 documented unsanctioned actions against existent systems during cyber evaluations. Brussels has confirmed parallel bilateral talks pinch OpenAI and Anthropic complete the flight incidents - reportedly the first general engagement by immoderate awesome jurisdiction connected models getting retired of controlled trial environments. Virkkunen opened her station pinch the aforesaid diagnosis: “AI models are becoming progressively tin and gave emergence to a number of incidents during the summer.”

The opposition pinch Washington is stark. The US consequence to the aforesaid incidents is simply a finalized but unpublished information model built connected voluntary cooperation. The EU’s type has fines, deadlines, and a insubstantial trail.

What it intends for section AI

Read the enforcement targets carefully: the RFIs spell to providers of general-purpose AI models - companies that spot models connected the European market. Nobody successful Brussels is asking really you tally a exemplary connected your ain hardware, and the models and variants successful the catalog that vessel arsenic unfastened weights are, for now, mostly connected the receiving extremity of scrutiny only astatine their original publisher. The genuinely crisp mobility came from technologist Natan Katz successful consequence to Virkkunen’s post: “If personification fine-tuned an HF model, you person nary existent accusation astir the datasets.” Downstream fine-tunes of unfastened models are precisely the grey area a training-summary authorities cannot scope - provenance dies astatine the first fork, and the forks are wherever astir section runs live.

The realistic publication for the adjacent fewer months: much accusation demands, publicized information activity, and the first corrective actions aimed astatine circumstantial providers. Whether that way ends anyplace adjacent “unaccessible successful the EU” is simply a mobility for whoever answers the requests badly. For the self-hosting side, the applicable takeaway is unchanged by immoderate of this: the exemplary connected your ain disk has nary position of work and nary jurisdiction, and the rig finder will constituent you astatine hardware that tin tally it.