Brussels: The European Commission opened its first round of AI Act enforcement on 1 September 2026, when the bloc’s AI Office sent formal information requests to more than thirty artificial intelligence providers, barely a month after the law’s core enforcement powers took hold. The move marks the moment AI Act enforcement stopped being a paper threat and became a live regulatory process affecting some of the world’s best-known AI developers.
Commission spokesperson Thomas Regnier told reporters in Brussels that investigators are pursuing two separate strands of AI Act enforcement at once. “The first concerns safety and security, notably the use of and the most advanced AI models,” Regnier said, adding that a second track “focuses more on copyright and transparency issues.” The dual-track approach lets the AI Office triage the highest-risk general-purpose systems while also chasing firms that have so far avoided cooperating with regulators.
Executive Vice-President Henna Virkkunen said the companies targeted in the second strand of requests “have not taken part in informal compliance dialogues with the AI Office,” a signal that Brussels is running out of patience with providers who skipped the voluntary engagement process built around the General-Purpose AI Code of Practice. That code, drawn up with industry input earlier in 2026, was meant to give companies a lighter-touch route to demonstrating compliance before formal information requests began landing in their inboxes.
The requests draw their legal force from Regulation (EU) 2024/1689, the AI Act itself, whose obligations for general-purpose AI models and its wider enforcement architecture became applicable on 2 August 2026. Under the law, the European Commission’s official enforcement guidance gives the AI Office the power to demand data, documentation and technical evidence from model providers, with financial penalties for companies that supply false, incomplete or misleading answers.
Commission officials say the safety and security track responds directly to a string of incidents involving advanced AI models during the summer of 2026, though they have not named the systems or providers involved in those episodes. The copyright and transparency track instead targets a narrower group of firms whose products fall under the AI Act’s rules on training-data disclosure and marking of synthetic content, obligations that critics in the tech sector had long dismissed as unlikely to be enforced quickly.
For AI companies operating in the EU, the requests are the clearest evidence yet that AI Act enforcement will not wait for the law’s full 2027 timeline to bite. The Commission confirmed in its 2 August enforcement notice that transparency obligations, including labelling requirements for AI-generated content, now sit alongside the safety rules that regulators are actively testing in the field. Legal advisers tracking the file describe the shift as the end of a period in which the AI Act functioned mostly as a compliance exercise on paper.
Brussels has not disclosed the identities of the more than thirty providers under scrutiny, nor set a public deadline for their responses, but officials say the AI Office intends to expand its use of information requests as it builds a fuller picture of how general-purpose models are trained, secured and disclosed to users across the single market. The two-track structure of the current enforcement effort suggests further requests, and potentially the bloc’s first formal investigations, are likely before the end of 2026.
