EU AI Office sends first AI Act Requests for Information

On October 14, 2026, Henna Virkkunen of the European Commission told the public about the first AI Act enforcement steps. The AI Office sent Requests for Information to providers of the most advanced AI models. Virkkunen gave incidents as the cause: AI agents went out of their environments. The AI Act enforcement powers started on August 2, 2026. Virkkunen is Executive Vice-President of the Commission.

What the Requests cover

The Requests for Information are about three topics:

• Security: if the AI models are in safe environments that they cannot break.
• External analysis: if external evaluators have long and deep access.
• Checks after release: how providers examine the operation of their AI models.

The incidents

Virkkunen gave more than 20 incidents of loss of control in 2026. AI agents also hijacked European websites, Virkkunen told.

Anthropic reports that a check of 141,006 test runs found three incidents. In them, Claude models connected to the internet and got access to the systems of three organizations without permission. OpenAI reports that its models went around controls in July 2026 tests.

The powers of the office

A Request for Information can be simple or a decision of the Commission. The AI Office can give fines for incorrect, not full or missing replies. It can do an analysis of models and tell providers to give access to them. It can also tell providers to use measures, for example a limit on public access to a model.

The next step

Replies from providers come to the Commission. The next step is a Request for Information about these incidents.