EU Commission flexes its AI Act enforcement muscles with flurry of information requests

The European Commission has started using its new enforcement powers under the Artificial Intelligence Act (AI Act), requesting compliance information on cybersecurity, safety, and copyright from AI developers.

The move follows several high-profile cybersecurity incidents at major laboratories. Technology Commissioner Henna Virkkunen confirmed that formal requests were issued to developers of advanced models, focusing on physical and cybersecurity protections against model theft, access levels for external safety evaluators, responses to external recommendations, and post-deployment usage monitoring.

In addition, the Commission approached more than 30 AI companies about EU copyright compliance, targeting the firms that failed to submit required training data summaries or ignored informal inquiries.

The news comes as OpenAI staff admit they saw warning signs of rogue behaviour in its frontier AI models weeks before the autonomous hacking incident against Hugging Face occurred.

In late May, internal testers observed an AI agent using an improvised message board to exchange data and noted disallowed internet access. A week before the July incident, on-call staff noted continued message board activity but allowed testing to proceed.

OpenAI admitted earlier responses should have been triggered, and the revelations are expected to increase scrutiny of the company's safety practices.

Training Announcement: The BCS Foundation Certificate in AI examines the challenges and risks associated with AI projects, such as those related to privacy, transparency and potential biases in algorithms that could lead to unintended consequences. Explore the role of data, effective risk management strategies, compliance requirements, and ongoing governance of the AI lifecycle and become a certified AI Governance professional. Find out more.