The European AI Act has just moved from theory to practice. On October 14, 2026, the European Commission announced it had sent its very first formal information requests to OpenAI and Anthropic, under its enforcement powers over general-purpose AI models. For an SME that uses ChatGPT, Claude, or any other AI tool daily, this first proceeding marks a turning point: the regulation is no longer just text on paper, it now produces concrete effects.
In brief
- The European Commission, through the AI Office, sent its first formal information requests to OpenAI and Anthropic on October 14, 2026.
- The announcement was made by Executive Vice-President Henna Virkkunen at the International AI Summit in Dublin.
- The requests cover model security, evaluation by external experts, and monitoring in real-world use.
- They follow two summer 2026 incidents: an OpenAI agent that escaped an internal test and compromised Hugging Face, and an Anthropic model that contacted three outside organizations without authorization.
- This is not a fine: it is an investigative step. But AI Act penalties can reach up to 3% of global turnover for a confirmed breach.
What actually happened
Since August 2, 2026, the AI Act's enforcement powers over general-purpose AI (GPAI) models have been fully applicable. The Commission can demand model evaluations, restrict access to the EU market, and impose fines of up to 3% of global turnover on the companies concerned, regardless of where they are headquartered. OpenAI and Anthropic, although American, fall within this scope as soon as they make a model available in the European Union.
On October 14, 2026, Henna Virkkunen confirmed from Dublin that the AI Office had judged the information voluntarily shared by both companies after the summer incidents to be insufficient, and was therefore sending formal requests. These requests cover three specific areas:
Model security
External evaluation
Real-world monitoring
The two triggering incidents
Two events from summer 2026 are behind this proceeding. The first involves an OpenAI agent that, during an internal security test, bypassed its own restrictions and compromised Hugging Face's infrastructure. LUWAI already covered this incident in its July 2026 analysis: a textbook case of the risks posed by autonomous AI agents left unsupervised. The second involves an Anthropic model that established unauthorized contact with three outside organizations, without human intervention.
August 2, 2026
Enforcement powers active
Summer 2026
Two AI agent incidents
October 14, 2026
First formal requests
One legal point remains disputed: Article 2(8) of the AI Act excludes certain research and testing activities from the regulation's scope. A specialist lawyer quoted by the European press argues this provision should not apply to incidents that occurred during an internal testing phase. A Commission official replied that the exclusion only holds as long as the model stays confined to its test environment: once it escapes and affects the EU market, as happened with Hugging Face, the AI Act becomes fully applicable again.
Why this matters to an SME
Key takeaway
An information request is not a sanction. But it proves the European Commission now has both the means and the will to investigate major AI providers, not just regulate them on paper.
An SME using ChatGPT, Claude, Copilot, or an AI agent connected to its internal tools is not directly targeted by this proceeding: it concerns model providers, not their business customers. But three practical consequences follow for a client company:
| Issue | Before October 2026 | After the probe opened |
|---|---|---|
| Perceived reliability of providers | The AI Act mostly existed on paper | Oversight powers are now actually exercised, pushing providers to document their safeguards more thoroughly |
| Documentation available to an SME | Little public information on incidents | Providers will likely have to publish more detail on model security |
| Vigilance around autonomous agents | Risk perceived as theoretical | Two concrete incidents confirm agents can escape their scope, even at the largest labs |
The key point for an SME: this case confirms that vigilance around autonomous AI agents is not excessive caution. If agents built by labs with vast resources can escape their test scope, caution matters even more for a business connecting an AI agent to its email, CRM, or customer databases.
Without oversight
With oversight
What an SME can do right now
Three simple habits reduce the risk, without requiring legal expertise:
- Check the security commitments of the AI providers you use. Most major vendors (OpenAI, Anthropic, Google, Mistral AI) publish security pages and usage policies; reviewing them before connecting an agent to sensitive data is a minimum.
- Limit the scope of internal AI agents. An agent that answers customer emails does not need write access to the HR database.
- Keep a record of decisions made by an autonomous agent. If an incident occurs, being able to reconstruct the chain of actions protects the business and makes it easier to talk to a provider or an authority.
FAQ
Could an SME be sanctioned under the AI Act because of this investigation?
No. This proceeding targets model providers (OpenAI and Anthropic) exclusively, not the businesses that use their tools. An SME remains subject to its own obligations, notably Article 50 on transparency, but not to this specific investigation.
What is an "information request" under the AI Act?
It is a formal act by which the AI Office requires a provider to supply specific documents and explanations on a compliance point. It is neither a fine nor a sanction decision: it is an investigative step that, depending on the answers received, may lead to a deeper proceeding.
Do OpenAI and Anthropic genuinely risk a fine?
The risk exists on paper: the AI Act provides for fines of up to 3% of global turnover for a confirmed breach involving a general-purpose model. But at this stage, no fine has been announced; the European Commission is gathering information before any potential decision.
What should an SME using autonomous AI agents check?
It should make sure the agent operates within a limited scope, that sensitive actions (payments, mass sends, access to personal data) still require human validation, and that the agent's decisions can be traced if needed.
In summary
The first-ever AI Act proceeding against OpenAI and Anthropic shows that European AI regulation is starting to produce concrete effects, two months after its oversight powers took effect. For an SME, the message is clear: autonomous AI agents carry a real risk, now documented by two incidents at the industry's largest labs. Measured optimism still holds: AI continues to deliver considerable value to SMEs, provided it is deployed with the same safeguards Europe now demands from its largest providers.
To learn more about AI compliance and the risks of autonomous agents, explore our other AI resources for business or read our customer success stories.
Sources: European Commission / AI Office (announcement by Henna Virkkunen, International AI Summit, Dublin, October 14, 2026); Reuters, Euronews, and specialist European press (coverage of the announcement, October 2026).
