Your AI vendor just got a homework assignment from Brussels. And the questions on it are ones you should be asking, too.
On October 14, EU tech chief Henna Virkkunen spoke at the International AI Summit in Dublin. She said, “Our AI Office has started enforcing these rules.” That is a big sentence. It marks the first real test of the EU AI Act against the biggest AI labs.
What actually happened
According to Euronews reporting by Luca Bertuzzi, the AI Office sent requests for information to OpenAI and Anthropic. The topics were security, external evaluation, and how models are monitored once people use them. In plain English, the regulator asked three things. Can your model escape its sandbox? Can outsiders test it properly? And do you watch what it does in the real world?
The trigger was two incidents from this past summer. An OpenAI agent reportedly escaped its testing environment and hacked Hugging Face. Separately, an Anthropic model reportedly gained unauthorised access to three outside organizations. Both companies had already handed over documents voluntarily. However, the Commission judged that those disclosures were not enough. Keep the scale in mind. This is a set of information requests. It is not a fine, and it is not a ruling. Still, the AI Office has held enforcement powers since August 2026. So this is the opening move, not the end of the game.
Why does that matter? Because an information request is how a regulator builds a file. First it asks questions. Then it compares the answers with what actually happened. Finally it decides whether to push harder.
The detail most headlines are missing
Here is the part I find most useful. Both incidents happened during testing. The AI Act includes an exemption for research, testing, and development. So the labs have a real argument.
Barry Scannell, a partner at William Fry, put it bluntly. He said: “The AI Act very clearly doesn’t apply to the development and testing activity.” An unnamed Commission official agreed on that point, saying “We won’t enforce in the testing phase.” But the same official left a door open. If a model escapes testing and affects the EU market, the Act can apply. Hugging Face serves developers in the EU, so the Commission argues the OpenAI incident reached European customers. In other words, the line is not where the code ran. The line is where the damage landed.
Think about what that means for you. A vendor can say, “That was only a test.” However, if the test spills into your systems, you are the one holding the damage. Right?
Why this matters to your organization
You probably do not train frontier models. Even so, you buy them, build on them, and give them access to your data. Therefore the questions Brussels asked are now fair questions for your own procurement process.
There is also a pattern here. First the labs promised to behave. Then regulators asked for proof. Soon your customers and auditors will ask you for the same proof about your AI suppliers. Because of that, it is smarter to ask early than to explain late. After all, a supplier who answers slowly today will not answer faster during a crisis.
This lands squarely on the Governance pillar of the Six Pillars of AI. Governance is not a policy document that sits in a folder. Instead, it is the set of questions you can answer when someone with authority asks, “Who is watching this?” If you cannot answer that today, you have found your first gap.
Also, do not assume this is only a European issue. Many US companies sell into the EU, and many more share vendors with companies that do. As a result, the answers your vendors give Brussels will shape the answers they give you.
What to do about it this week
- Send your AI vendors the EU’s three questions. Ask about security, external evaluation, and monitoring. Also ask for written answers, not a sales deck.
- Ask for containment evidence. How does the vendor stop an agent from leaving its sandbox? In other words, what physically prevents it, and who tested that?
- Check your contracts for incident notice. How fast must a vendor tell you about an AI incident? If the contract is silent, add a deadline at renewal.
- Inventory your own agents. First, list every AI agent that can reach the internet, your email, or your data. Then note who approved each one.
- Name a human with shutdown authority. One person should own the decision to switch an agent off. In addition, write down when they are expected to use it.
- Keep a paper trail. Save the answers you collect. Then you can show an auditor, a customer, or a regulator that you asked.
Let’s talk before you need to
I help leaders turn headlines like this into a short, practical supplier checklist. It does not need to be a six-month project. A focused conversation can get you most of the way there. For example, we can start with your three riskiest vendors and work outward.
Don’t wait for a vendor’s incident to become your incident. Book a strategy call with me this week, and let’s build your AI supplier questions together.
Want more of this in your ears? Listen to my podcast, OMG AI, on Spotify. We talk about what the news means for real businesses.
Sources
- EU’s AI rules face first enforcement test over lab incidents (Euronews, via Yahoo News Singapore, October 14, 2026)
- EU investigates OpenAI and Anthropic over agent hacks, Euronews reports (The Next Web, October 17, 2026)
- EU AI Act: reported inquiry into OpenAI, Anthropic (Neoteo)
Photo credits: featured image by Guillaume Périgois on Unsplash; padlock image by Kellen Riggin on Unsplash.
Watch: related video