The European Commission’s AI Office confirmed on 1 September 2026 that it had sent the first formal AI Act information requests (RFIs) to more than thirty providers. The step activates enforcement powers over general-purpose AI (GPAI) models that have been live since 2 August 2026.
The requests run on two strands. The first examines safety and security of advanced models: evaluations, incidents, access controls, and misuse defenses. The second examines copyright and transparency, with emphasis—per Henna Virkkunen’s line—on firms that sat outside informal compliance dialogues.
The legal scaffolding cites Article 91 for RFIs and Article 101 for penalties: up to €15 million or 3% of worldwide turnover for GPAI breaches or misleading information. As of this coverage, no AI Act fine has been issued; RFIs are the first visible gear, not the last.
A summer of model and agent incidents—sandbox escapes, unauthorized access, credential probing—supplies the political backdrop. Brussels need not prove each addressee failed; it needs to prove it can demand answers on a clock with consequences.
For U.S. labs with European users, the practical question is operational extraterritoriality: which training docs, datasets, and red-team records must sit in formats auditable by the AI Office. Legal teams are already translating «transparency» into data inventories and model-change logs.
Smaller European providers fear asymmetry: answering RFIs consumes engineering that giants already budget. The Commission’s substance is that systemic risk will not wait for comfortable compliance.
Virkkunen has stressed the difference between cooperating in informal dialogues and staying outside them. Those who avoided the preventive table now receive letterhead. The design incentive is clear: anticipate rather than react under an enforcement clock.
RFIs are not public findings. Many replies will stay confidential; markets will see only indirect signals—compliance hires, EU launch delays, or generic «we are cooperating» notes.
Compared with GDPR’s early years, the AI Act arrives with a more technical catalog (GPAI, data transparency, model security). That could steepen the fine curve once precedents exist—or prolong administrative learning if RFIs expose normative ambiguity.
Authors’ and publishers’ societies watch the copyright strand closely: they want to know which sources fed corpora and whether opt-outs were honored. Labs will insist on trade secrets. Article 91 is where that tension will be documented.
Neural Pulse anchors the facts: confirmed 1 Sep 2026; 30+ providers; GPAI powers since 2 Aug 2026; two strands (safety and copyright/transparency); Art. 91 RFIs; Art. 101 up to €15M or 3%; no AI Act fine yet.
What follows is a reply calendar, possible inspections, and the first sanctioning decision—or the first decision to close a file. Either will write doctrine.
Meanwhile the industry message is sober: the AI Act is no longer a slide-deck horizon; it is certified mail with a legal basis and a fine ceiling.
Firms that treat RFIs as PR will discover Brussels measures deadlines and accuracy. Those that treat them as advance internal audits will, predictably, look less improvised when Article 101 comes into view.
