On 1 September 2026, the European Commission confirmed that the AI Office had sent its first formal requests for information (RFIs) to more than 30 artificial-intelligence providers under the AI Act, whose key general-purpose-model obligations have applied since 2 August. Spokesperson Thomas Regnier outlined two strands: safety and security of the most advanced models, and copyright plus transparency—especially toward firms that skipped informal compliance dialogues.
Executive Vice-President Henna Virkkunen had telegraphed the move days earlier. Reporting from Agence Europe, 2EU.brussels and EU Perspectives agrees there are not yet infringement findings or a public recipient list, though coverage suggests frontier labs such as OpenAI, Google and Anthropic sit in the plausible universe. Brussels also confirmed recent exchanges with OpenAI and Anthropic on cybersecurity risks without saying whether either received an RFI.
Article 101 of the AI Act turns an incorrect, incomplete or misleading reply into fine territory of up to €15 million or 3% of global annual turnover, whichever is higher. It is the first time Brussels has used those powers since they became enforceable. The message to corporate counsel is unambiguous: the coffee-chat period is over; the file has been opened.
In parallel, September reporting describes a first wave of coordinated inspections with national market-surveillance authorities on high-risk AI in HR, retail banking and healthcare, though official sources still emphasize information-gathering and supervision. The AI Office has about 38 dedicated enforcement staff—few relative to the market, enough for targeted investigation.
For GPAI providers above the 10^25 FLOPs training threshold, September is also systemic-risk evaluation season. The RFI plus systemic-risk filing combo creates double documentary pressure: explain model safety and transparency/copyright, with corrective measures possible if dossiers fail to convince.
The backdrop is a summer of advanced-model incidents that politicized supervision. Brussels needs to show the AI Act is not symbolic. Labs, in turn, fear leaks of red-teaming secrets and training-data details when they answer with the specificity the Commission can demand.
Tension around ENISA and Glasswing-style access to frontier models illustrates the bottleneck: regulators want to look inside; labs want to control who looks. RFIs are the intermediate instrument—paper before on-site weight inspection—but the path toward more intrusive evaluation is signposted.
EU deployer enterprises are not the primary target of these first model-provider RFIs, yet they should prepare: the same market-surveillance machinery asking foundations today will ask banks and hospitals tomorrow about high-risk systems. Agent inventories, logging and impact assessments are no longer nice-to-have.
Neural Pulse reads the RFIs as the true political go-live of the AI Act after 2 August. Without public recipients yet, the deterrent already works: nobody wants to be the first 3% turnover fine file.
Open questions include response deadlines, confidentiality of technical annexes, and whether the Commission will publish aggregated guidance without burning specific firms. Also whether copyright/transparency RFIs will stay cleanly separated from safety strands so authorship debates do not blur into CBRN risk debates.
In short, as of early September 2026—with continuing echo through the 22nd—the European Commission activated AI Act enforcement with RFIs to more than 30 providers on safety, copyright and transparency, under real Article 101 fine threat.
We will track any recipient leaks, deadlines, and interaction with the U.K. Parliament’s 13 October hearing and with bilateral lab stress-test pacts.
For industry, the age of compliance theatre is ending; the age of the sworn regulatory PDF is beginning.
The AI Office, small in headcount, just showed that the size of the legal stick matters more than the size of the team—at least in round one.
