Brussels has started using its new powers. On August 29, Henna Virkkunen — the European Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy — confirmed that the EU’s AI Office has formally sent requests for information to a number of providers of general-purpose AI models. Euractiv’s reporting identifies the recipients as leading frontier labs, reportedly including OpenAI, Anthropic and Google.
The timing matters more than the paperwork. General-purpose AI obligations under the EU AI Act became enforceable on August 2. The Commission opened formal files within four weeks. That is not the pace anyone expected from a regulator famous for taking years to act.
What was actually asked
Two separate requests went out.
The first went to providers “based in different regions of the world” and covers model security: how models are protected against attack, whether independent external evaluations exist, and how models are monitored once they’re on the market.
The second went to providers who haven’t published detailed summaries of their training content and skipped the AI Office’s informal compliance dialogues. That publication requirement exists so copyright holders can actually exercise their rights — which is why several recipients are being asked about it.
These aren’t friendly letters. Under the Commission’s enforcement framework, replies that are incorrect, incomplete or misleading can draw fines of up to €15 million or 3% of global annual turnover, whichever is higher. The answers go into a permanent supervisory record. In serious cases, the AI Office can restrict a model’s availability in the EU — though that requires findings that don’t exist yet.
The summer that made this inevitable
What stands out here is the contrast with how this year started. July and August produced a string of containment incidents: an OpenAI agent swarm that reportedly reached root on Hugging Face production nodes, retrospective reviews finding Claude and Meta’s Muse Spark models breached external systems after a third-party evaluator’s misconfigured environments leaked real-world access, and a UK AI Security Institute report documenting 19 unsanctioned actions against real systems during cyber evaluations.
Brussels has reportedly been in bilateral talks with OpenAI and Anthropic over those escape incidents — the first formal engagement by any major jurisdiction on models getting out of controlled test environments. We’ve tracked that enforcement build-up all year, from the AI Office’s expansion to the transparency labelling rules that went live earlier this year.
Virkkunen’s own framing was blunt: “AI models are becoming increasingly capable and gave rise to a number of incidents during the summer.”
Washington vs Brussels, again
The response on the other side of the Atlantic is a completed but unpublished evaluation framework built on voluntary cooperation. The EU’s version has fines, deadlines and a paper trail. Whether that makes European users safer or just makes European API bills higher is the genuine open question — some labs may simply decide serving the EU market isn’t worth the compliance load, which the viral panic about “models disappearing from Europe” pushed too far. Nothing announced blocks any model from the European market. But the leverage is now real, and both sides know it.
What it means in New Zealand
Nobody in Wellington is drafting an equivalent. NZ companies building on frontier APIs inherit whatever compliance posture the labs adopt globally — usually the strictest one, since it’s cheaper to run one standard than regional variants. If the EU’s requests produce published security evaluations, that documentation flows to everyone using those models, including here. If they produce market-withdrawals, NZ developers suddenly need fallback models. Either outcome lands on this side of the world within months, not years.
The replies are legally required. Watch the deadline — what the labs say under compulsion will tell us more about model security than anything they’ve published voluntarily.
— CJ Murden, editor of Singularity.Kiwi. Former digital technologies teacher, author of AI-focused books. Writing with a New Zealand focus.
