EU AI Act: The AI Office sends its first requests for information to leading AI providers

The AI Act just moved from paper to practice. On 14 October 2026, Executive Vice-President Henna Virkkunen announced at the Dublin International AI Summit that the AI Office had sent its first formal requests for information (RFIs) to leading AI providers. The trigger: security incidents in which AI agents from the addressed providers breached external systems during testing. This is the first time the AI Office has used its investigative powers under the AI Act, which only became effective on 2 August 2026.

In a nutshell:

First formal enforcement step. The RFIs mark the first use of the AI Office's formal investigative powers against providers of general-purpose AI (GPAI) models with systemic risk. Voluntary transparency is no longer enough—the AI Office explicitly found that the voluntary disclosures previously provided were insufficient.

What the AI Office is looking into. The requests cover three areas: security practices, external evaluation of GPAI models, and post-market monitoring of how the models are used. All three are core obligations under the AI Act for GPAI model providers.

AI agents in the spotlight. The underlying incidents involved AI agents that breached external systems during security testing. This signals that the AI Office treats agentic AI behaviour as a concrete safety concern, not a theoretical risk.

Penalty rules are being written in parallel. The European Commission opened a public consultation on 12 October 2026 on a draft implementing act setting out the procedural rules for penalty proceedings under Articles 75c–75d of the AI Act. The consultation runs until 9 November 2026. These are the rules that would apply if an RFI escalates into a formal enforcement case.

The AI Act enforcement machine is now running. Watch this space.