On 29 August, a first enforcement act
On 2 August 2026 went almost unnoticed. That day, the European AI Office, attached to the Commission, received its enforcement powers over providers of general-purpose AI models, those large models capable of performing a multitude of tasks and integrated into countless services. Less than a month later, it used them for the first time.
"As a first step in the application of the AI Act, our AI Office has formally sent requests for information to a number of providers of general-purpose AI models established in different regions of the world." Henna Virkkunen, Executive Vice-President of the Commission, on 29 August 2026 (as reported by ActuIA and Euractiv).
These requests follow two tracks. The first concerns the safety and security of the most advanced models: independent external evaluations, protection against risks, post-market monitoring. According to Euractiv, OpenAI, Anthropic and Google are among the recipients, which the Commission did not confirm by name. The second track concerns transparency and copyright: it targets more than thirty companies that have not published a detailed summary of their training data and have not participated in informal compliance dialogues with the AI Office. On 1st September, spokesperson Thomas Regnier specified that these requests came after several incidents that occurred over the summer.
What the law allows
The legal basis is Article 91 of the AI Act, which authorizes the Commission to require providers to provide the documentation provided for in Articles 53 and 55 and any information necessary to verify their compliance. Each request must specify its legal basis, its purpose, the information expected and a deadline for a response. If the responses are insufficient, the Office may itself evaluate a model (Article 92), require corrective measures (Article 93) and, in serious cases, restrict the availability of a model in the Union.
The sanctions are set by article 101: up to 3 % of global annual turnover or 15 million euros, whichever is higher. They also apply to a provider that fails to respond to a request or provides inaccurate, incomplete, or misleading information. The often-cited cap of 7 % concerns prohibited practices, not general-purpose models.
The timeline is now clear. The AI Act entered into force on 1st August 2024. The obligations for providers of general-purpose models have applied since 2 August 2025, and the Commission's sanctioning powers since 2 August 2026. Models placed on the market before August 2025 have until 2 August 2027 to comply.
A documentary regime above all
One must measure the real scope of the act. A request for information is an investigative measure: it does not open proceedings or notify any objections. The legal risk lies in the response, since incomplete information is itself sanctionable. At the end of August, the Commission's page dedicated to the application of the AI Act mentioned no open proceedings.
The Union also eased the rest of the framework at the same time. The "omnibus" regulation on AI, which entered into force on 27 July 2026, postpones obligations related to high-risk systems to 2 December 2027 for sensitive uses (employment, education, essential services, biometrics) and to 2 August 2028 for regulated products. What became enforceable this summer is therefore mainly a documentary control of large models, accompanied by transparency rules: since 2 August, conversational assistants must declare themselves as such, and deepfakes must be labeled.
The same month, the Commission also designated ChatGPT as a very large online search engine under the Digital Services Act (DSA), on 31 August. For the first time, an AI assistant enters the most demanding regime of the DSA.
A summer of incidents in the background
These initial requests do not come out of nowhere. The summer of 2026 was marked by several incidents involving advanced models. OpenAI acknowledged on 21 July that some of its models, undergoing cybersecurity evaluation, had bypassed the isolation of their test environment and reached Hugging Face's production infrastructure. In the European Parliament, four MEPs called in September for legislation on AI provider liability, pointing out that the AI Act does not cover the testing phase of models.
The European authority put to the test
Most of the likely recipients are American. That is the whole challenge: can the Union impose its rules on companies that do not have their headquarters on its territory? Its leverage is access to the single market. The AI Act applies to any model made available in the Union, regardless of where its provider is established, and the Commission can, as a last resort, restrict its distribution.
This leverage has its limits. Regulation without a comparable industrial base places Europe in the position of a demanding customer rather than a competitor. European providers are not spared: Mistral AI, like Google, OpenAI or Anthropic, is among the signatories of the code of good practices on transparency of AI-generated content. The credibility of the system will depend on the AI Office's ability to analyze complex technical responses and, if necessary, to go as far as sanctions.
What to remember
With the requests of 29 August, the AI Act moved from the calendar to action. The first instrument used is modest, a request for documents, but it is binding: responding poorly exposes one to fines. The future will tell whether Brussels follows up with model evaluations and corrective measures, or whether enforcement remains confined to paper. For European digital sovereignty, this is a test of method as much as of will.
Sources
- Matheson, « The European Commission's first use of EU AI Act investigatory powers », 25 September 2026
- ActuIA, « Régulation de l'IA : l'été où les textes sont devenus des actes », 2 September 2026
- Agence Europe, « La Commission adresse ses premières demandes d'information à plus de 30 fournisseurs d'IA », 2 September 2026
- Euractiv, « EU orders leading AI labs to detail security practices »
- European Commission, "Commission starts enforcing AI Act rules", 31 July 2026
- European Commission, AI Act page (timeline and omnibus)
- Text of the AI Act, Article 91 and Article 101
- Politico, call by MEPs for a law on AI liability, 21 September 2026
