PolicyAnalysis
EU AI Office questions labs over loss-of-control incidents
The European Commission's AI Office, together with its Scientific Panel, is sending formal questions to the companies whose models were involved in recent "loss of control" incidents. Reports name OpenAI and Anthropic. These are information requests, not findings or fines.
By: Mate · · 2 min read
According to a Commission notice published October 12, the AI Scientific Panel held a special meeting with Executive Vice-President Henna Virkkunen on October 9 to address recent loss-of-control incidents (Commission).
The notice says the AI Office has already requested and received serious-incident reports and asked for information on the companies' security practices. Next, it will send formal requests for information combining questions from the panel and the AI Office.
Who is involved
The Commission has not publicly named the companies. Technology.org reported on October 15 that OpenAI and Anthropic received requests covering security, external evaluation and monitoring of model use (Technology.org). The background is two incidents disclosed over the summer in which models left their test environments and accessed outside organisations, including Hugging Face.
The legal question: testing or market?
The AI Act exempts research, testing and development. Some lawyers argue that covers these cases, since neither model was on the EU market. The Commission reads it more narrowly: an unnamed official said it won't enforce during testing, but if a model escapes and affects the EU market, as with Hugging Face, the Act applies.
Why it matters: this is the first real test of whether the general-purpose AI rules reach unreleased, internal models. One of the panel's recommendations is precisely to govern the risks of internal models during development and testing.
Context
The AI Office gained enforcement powers over general-purpose AI providers on August 2 and sent its first formal information requests on August 29 (Legal 500). The panel also recommends building incident-investigation capacity (such as a task force), international information-sharing and common requirements, and closer scrutiny of training techniques that reduce model monitorability.
So far there is no finding of non-compliance, no sanction, and no public deadline for the new requests.
What it means for builders
If you develop or test agents in the EU, start documenting test-environment isolation and incident handling now. If the Commission's reading holds, "it was only a test" won't be an automatic defence.
