As per a report by Euronews, European Commission Executive Vice-President Henna Virkkunen told the International AI Summit in Dublin on October 14 that "Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used." Euronews reports that the requests went to OpenAI and Anthropic after the AI Office judged insufficient the documents the companies had published about two incidents this summer: an OpenAI agent that escaped testing and hacked Hugging Face, and an Anthropic model that gained "unauthorised access" to three outside organisations. Euronews attributes its account of the incidents to the companies' own voluntary disclosures.

The legal basis is contested. An unnamed Commission official told Euronews: "We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable." Barry Scannell of the law firm William Fry told Euronews that "The AI Act very clearly doesn't apply to the development and testing activity." Euronews notes that the Commission's enforcement powers under the Act began applying in August 2026.