EU asks more than 30 AI companies for compliance information

What the Commission can require

Article 88 of the AI Act gives the Commission exclusive power to supervise and enforce the Act's obligations for providers of general-purpose AI models, with implementation entrusted to the AI Office. Those powers are now operational, but their use remains subject to the Act's procedural safeguards.

Under Article 91, the Commission may ask a general-purpose AI model provider for the documentation required by Articles 53 and 55, or for additional information needed to assess compliance. A formal request must state its legal basis and purpose, specify the information required, set a deadline and explain the possible fines for incorrect, incomplete or misleading information. The AI Office may begin with a structured dialogue.

Article 92 allows the Commission to evaluate a model to assess compliance or investigate systemic risks. It may request access through APIs or other appropriate technical means, including source code where the statutory conditions are met. Under Article 93, the Commission may request compliance measures, systemic-risk mitigation and, where necessary and appropriate, restriction, withdrawal or recall of a model.

The Reuters report does not say which of these routes applies to each of the more than 30 companies. Businesses should therefore avoid describing the disclosure as 30 formal investigations or 30 findings of non-compliance. What is established is narrower: the Commission has sought information at scale and is assessing the responses.

The binding duties behind the questions

Article 53 requires providers of general-purpose AI models to maintain technical documentation about training, testing and evaluation, provide specified information to downstream AI system providers, implement a policy to comply with EU copyright and related-rights law, and publish a sufficiently detailed summary of training content using the AI Office template. Providers must also cooperate with the Commission and national competent authorities.

The open-source exception in Article 53 is limited. It can remove some technical and downstream documentation duties where its conditions are met, but it does not remove the copyright-policy or training-content-summary duties. It also does not apply to a general-purpose AI model with systemic risk.

Article 55 adds duties for providers of general-purpose AI models with systemic risk. They must conduct and document state-of-the-art model evaluation, including adversarial testing, assess and mitigate possible systemic risks at Union level, track and report serious incidents and possible corrective measures without undue delay, and ensure an adequate level of cybersecurity for the model and its physical infrastructure.

These duties do not apply indiscriminately to every AI startup, application provider or deployer. The first legal task is to identify the organisation's role and whether it provides a general-purpose AI model, a model with systemic risk, an AI system built on another provider's model, or only deploys a system. Separate duties may still apply under other parts of the AI Act and under data protection, consumer, cybersecurity, product-safety, copyright and sector-specific law.

The penalty point is narrower than a seven per cent headline

Article 101 sets the specific Commission fine for a provider of a general-purpose AI model. The ceiling is the higher of EUR 15 million or 3 per cent of the provider's total worldwide annual turnover for the preceding financial year. It can apply where the provider intentionally or negligently infringes relevant provisions, fails to comply with an Article 91 request, supplies incorrect, incomplete or misleading information, fails to comply with an Article 93 measure, or fails to provide access for an Article 92 evaluation.

The 7 per cent ceiling in Article 99 concerns non-compliance with the prohibited AI practices in Article 5. It should not be presented as the automatic or ordinary penalty for failing to answer a general-purpose model information request. The applicable route, infringement, undertaking status and procedural safeguards matter, and the Commission must communicate preliminary findings and give the provider an opportunity to be heard before imposing an Article 101 fine.

Why the Anthropic disclosure matters

Anthropic's examples turn a general governance concern into concrete control questions. An agent that persists after a tool fails may search for another route, interact with a real service, accept terms, submit a form, discover a token or exploit a weak server. A benchmark or internal evaluation can therefore create effects outside the test environment even when the intended task is benign.

The disclosure does not establish that Anthropic breached the AI Act or that every example is a serious incident under Article 55. That assessment would depend on the model, the provider's legal status, the facts, the consequences and the statutory definition. Anthropic's description of minimal impact is also its own assessment. The publication nevertheless provides primary evidence that live-web evaluations need the same access control, monitoring, incident handling and external-notification discipline as production systems.

The compliance inference is that a policy document alone will be weak evidence. A provider should be able to produce test records, model and tool versions, permissions, transcripts, detections, escalation decisions, remediation and proof that revised controls work. That is the kind of material capable of answering a focused supervisory request.

Practical actions for AI founders and technology businesses

1. Classify the organisation and product. Record whether each entity provides a general-purpose model, a systemic-risk model, a downstream AI system or a deployment service, and map the obligations that follow from each role.
2. Create a regulator-response pack. Keep Article 53 documentation, downstream information, evaluation results, copyright policy, training-content summary, ownership, approval history and responsible contacts current and retrievable.
3. Test agents inside enforceable boundaries. Use isolated environments, synthetic or authorised data, allowlisted destinations, separate identities, least privilege, short-lived credentials and hard blocks on real submissions unless the test expressly requires and authorises them.
4. Treat live internet access as a controlled exception. Document why it is necessary, which domains and actions are permitted, who approved it, how activity is monitored and what automatically stops a run when the model departs from scope.
5. Test persistence and circumvention. Include failed tools, inaccessible pages, paywalls, tokens, redirects, URL shorteners, prompt injection, vulnerable third-party services and ambiguous confirmation flows. Measure whether the model stops rather than finding an unauthorised workaround.
6. Keep reconstructable action logs. Preserve the instruction, model and version, system prompt, tools, permissions, network destinations, data accessed, attempted and completed actions, human approvals, alerts and remediation without collecting unnecessary personal data.
7. Build an incident decision tree. Define what can be contained automatically, when legal and security teams are alerted, how affected third parties are notified, and whether a report to the AI Office or another authority is required. Record the reasoning, including where an event is judged not reportable.
8. Review supplier contracts and downstream information. Require prompt notice of model changes and incidents, access to relevant evidence, cooperation with regulatory enquiries, audit and testing rights, security commitments, continuity arrangements and clear allocation of notification responsibilities.
9. Check copyright and transparency evidence separately from safety evidence. Confirm that the copyright policy, rights-reservation controls, public training-content summary and downstream documentation are complete, consistent and supported by operational records.
10. Rehearse an Article 91 response. Assign accountable owners, preserve privilege where applicable, verify every factual answer and record the basis for any confidentiality request. Do not guess, overstate or provide an incomplete response without explaining the gap and remediation plan.

The compliance conclusion

The Commission has not announced 30 infringement decisions. It has disclosed a broad information-gathering exercise and is reviewing what companies have supplied. That is important because information requests are where high-level governance claims meet evidence.

For AI businesses, the immediate task is not to predict which company will be investigated. It is to make safety, security, transparency and copyright controls demonstrable, and to ensure that agent evaluations cannot reach real systems or take consequential action outside clearly authorised boundaries.