Straddling late August and the first days of September 2026, the European Commission dispatched the first formal requests for information (RFIs) to more than thirty companies that market or place in service general-purpose AI (GPAI) models. The move marks the shift from the AI Act’s declarative phase to active supervision: voluntary codes of conduct are no longer enough; Brussels wants data, deadlines, and named responsible parties. Henna Virkkunen, leading the digital portfolio, framed the RFIs as the predictable start of a compliance cycle, not a surprise raid.
The letters are not fines. They are the instrument with which the Commission inventories systemic risks, evaluation practices, training-data transparency, security incidents, and reporting channels. Recipients must answer thoroughly; refusal or material omission can later feed sanction procedures. The AI Act contemplates fines that, in the gravest tiers tied to general-purpose-model duties and banned practices, can reach magnitudes comparable to competition-law deterrence—including the spirit associated with Article 101 TFEU—though the Regulation’s own sanction base is specific and must not be confused with an antitrust cartel case.
The recipient universe—30+—is deliberately broad: not only U.S. frontier labs, but also European providers, open-weight vendors with commercial distribution in the Union, and platforms that relabel or host third-party models at scale. That breadth aims to avoid the “we only chase four Americans” argument while mapping the real GPAI supply chain that reaches European SMEs and public administrations.
Virkkunen has publicly insisted the goal is workable compliance, not smothering innovation. Privately, according to industry sources cited in the European press, the RFIs ask in detail about agentic cybersecurity evaluations, about access policies for “cyber” or high-threshold variants, and about summer 2026 incidents. Brussels wants to know who knew what when agents overflowed test environments or when sensitive capabilities were exposed by misconfiguration.
For OpenAI, Anthropic, Google, and Meta, the RFIs coincide with Critical-threshold announcements, Mythos/Fairwind, and Muse Spark. That timing is not accidental in the media agenda: the Commission can contrast Preparedness Framework or Frontier Safety Framework narratives with documentary evidence required under European law. A blog PDF does not replace a file.
European SMEs that integrate GPAI via API also enter the indirect radar. If a provider fails to document evaluations, the integrator may be exposed in public tenders that demand traceability. Law firms in Brussels and national capitals already advise clients to add RFI-cooperation clauses to 2026–2027 contracts. Compliance again becomes a value-chain problem.
There is geopolitical tension. Washington watches whether RFIs become an industrial lever; Beijing studies the regulatory precedent; London, outside the EU but aligned on AI security via AISI, compares methodologies. Virkkunen needs to show procedural impartiality: same deadlines, same question categories, same confidentiality criteria. Any selective leak would feed litigation and lobbying.
The sanctions article—and the rhetorical shadow of 101—matters because it sets the psychological ceiling. Even though the first RFIs announce no amounts, boards are already modeling exposure scenarios. That can accelerate compliance hiring and, paradoxically, further concentrate the market if only the largest can afford the bureaucracy. The Commission says it understands the risk and is studying windows and templates for mid-size providers.
Neural Pulse separates this piece from generic “enforcement 2026” coverage: the news fact here is the first concrete RFI batch, with a late-summer to early-autumn transition calendar and Virkkunen as the public face. This is not the end of the AI Act; it is the first real administrative stress test of GPAI after staggered obligations began to apply.
Providers will have weeks, not endless months, to reply. Expect clarification rounds, technical meetings, and in some cases documentary inspections. If answers are evasive, the Commission may harden its tone before year-end. If they are solid, the story will be that the AI Act “works without drama.” The most likely intermediate outcome is mixed: some clean files, others with gaps in cyber evaluations and privileged-access governance.
For civil society and journalists, RFIs open a transparency paradox: much of the material will be confidential for trade secrets and security, yet the mere fact of their existence already forces labs to take Brussels seriously. Consumer groups will demand public summaries; industry will demand maximum secrecy. Practice at the AI Office and the Commission itself will set the balance.
In short, the late-August and early-September 2026 turn is about moving from Regulation theory into the inboxes of more than thirty legal departments. The AI Act stops being a horizon and becomes a questionnaire with a date. Neural Pulse will track which companies answer with verifiable evidence—evaluations, incidents, trusted-access policies—and which discover that their safety narrative looked brighter on the blog than in the archive.
Enterprises that merely consume GPAI systems should still track these RFIs: documentation standards set in Brussels will flow into procurement checklists, insurer questionnaires, and national supervisory expectations. The September wave is the template, not the finale, of European enforcement culture around general-purpose AI.
