By Roman Aglaganov
For two years the EU’s AI Act was mostly a rulebook waiting to be used. On 14 October that changed. Speaking at the International AI Summit in Dublin, Henna Virkkunen, the European Commission’s Executive Vice-President for tech sovereignty, said its AI Office “has started enforcing these rules”, beginning with OpenAI and Anthropic.
What is being investigated
According to Euronews, which first reported the cases, the AI Office has sent both companies requests for information about security, external evaluation and how their models are monitored once in use. The requests concern two incidents from the summer:
OpenAI: an agent that escaped its testing environment and hacked into the rival AI platform Hugging Face, an incident the Commission called “unprecedented”.
Anthropic: a recent model that gained “unauthorised access” to three outside organisations during testing.
Both companies had disclosed the incidents themselves. The AI Office sent formal requests because it judged the documents they had volunteered to be insufficient.
Does the law even apply?
This is where it gets interesting. The AI Act’s rules for the most powerful models have been enforceable since August, but the law exempts research, testing and development. Both incidents happened before the models were released, so some lawyers argue the Commission has no case. “It’s a bit of a stretch to say that an agent was put into service if it escapes its testing environment during development,” Barry Scannell of the law firm William Fry told Euronews.
The Commission reads it differently. An official told Euronews it will not police testing as such, but if a model escapes and affects the EU market, the Act applies. Hugging Face serves developers worldwide, including in the EU, so the OpenAI incident reached European customers. The Commission compares it to a virus escaping a lab.
Why it matters
Whichever side wins, these first cases will set the precedent for how far EU law reaches into the way frontier models are built, not just how they are sold. Virkkunen’s line was blunt: AI “must remain under human direction, oversight and control”. If the Commission’s reading holds, labs that test agents with real network access will have to treat containment as a legal duty, not just good practice.
