EU AI Act enforcement begins with 30 company information requests

This move signals that Brussels has transitioned from drafting policy to active market intervention, setting a precedent for how global regulators will audit high-compute models. For the streaming and media ecosystem, the focus on copyright and transparency suggests that AI-generated content and training data provenance will face immediate legal scrutiny. The specific focus on OpenAI and Anthropic indicates that the most capable models are being prioritized for cybersecurity risk assessments. Watch for the Commission to disclose whether these initial inquiries lead to formal non-compliance proceedings or if they result in new industry-wide security standards for general-purpose AI.

The European Commission's enforcement push arrives as the AI Act's general-purpose AI obligations took effect on August 2, 2025, requiring providers of GPAI models to meet transparency, copyright, and safety standards. The Commission published its first set of GPAI guidelines in July 2025, clarifying systemic-risk thresholds and documentation requirements for model providers, establishing the legal basis for the information requests now being issued to more than 30 companies. ENISA, the EU's cybersecurity agency, has been designated as a technical advisor for assessing risks posed by frontier models, a role that directly connects to the Commission's parallel dialogues with OpenAI and Anthropic on cyber threats.

On the business side, the enforcement timeline carries immediate implications for AI companies operating in the European market. The AI Act's penalty structure allows fines of up to 7% of global annual turnover for violations of prohibited practices and up to 3% for other breaches, creating a financial incentive for rapid compliance. Companies that received information requests must respond within defined deadlines, and failure to cooperate can itself trigger sanctions. The Commission has indicated that these initial inquiries are fact-finding rather than adversarial, but they establish a compliance record that could inform future enforcement actions. For streaming and media companies using generative AI tools, the copyright transparency requirements mean that training-data provenance documentation will likely become a standard procurement consideration when licensing AI services in the EU.

The technical focus on cybersecurity risks in advanced models reflects broader regulatory concern about dual-use capabilities. OpenAI published its own preparedness framework in December 2023, outlining how it assesses and mitigates risks from increasingly capable models, and Anthropic has similarly released responsible scaling policies that define capability thresholds triggering additional safety reviews. The Commission's decision to engage both companies directly on cyber risks suggests that EU regulators are building independent technical assessment capacity rather than relying solely on self-reported safety evaluations. This approach mirrors the structure of the AI Act itself, which mandates third-party evaluation for models classified as posing systemic risk, and positions the EU as the first jurisdiction to operationalize mandatory safety testing for frontier AI systems.