In late August 2026, the European Commission sent questions to more than 30 artificial intelligence companies, and it is now reading their replies. No penalties have been announced. EU tech commissioner Henna Virkkunen told Reuters on 9 October that the AI Act is already enough to deal with the risk of "rogue" AI agents, meaning programs that act outside human control.
The companies have not been named. The Commission asked them what safety and security steps they take, and then about transparency and copyright. Chinese start-ups also got the questions, because Virkkunen says the most capable models today come from the US and China.
How far the rules reach for a single model
"We have the AI Act and it covers the whole life cycle of these models," Virkkunen said. In practice, the rules do not apply only on the day a model goes on the market. They start with training, run through checks before release and continue with monitoring afterwards.
The specific duties fall on firms that build the most powerful general-purpose models, which carry "systemic risk". These firms must test the models using standard protocols, including deliberate attempts to "break" them. They must also assess and limit risks, report serious incidents "without undue delay" and protect the model and the systems around it from cyberattacks.
The rules for these models have applied since August 2025. From 2 August 2026, the Act applies in full, and the AI Office and national authorities check that firms follow it. The AI Office can ask for technical documents, test models, order fixes and impose fines.
Virkkunen also rejected claims that the rules are already out of date. She said lawmakers built in outside experts to help assess risks. Regulators are writing guidance on how firms should test their models and how long to spend on it, taking into account advice from a scientific panel of 60 experts.
What already applies and what is delayed
The transparency rules take effect on 2 August 2026. A chatbot must say it is a machine, and synthetic content and deepfakes must be labelled. Firms whose generative tools were on the market before that date have until 2 December 2026, but only for machine-readable marking of content. New systems must comply at once.
A new ban also starts on 2 December 2026. It covers systems that make intimate images without consent or material showing child sexual abuse.
Rules for high-risk systems are delayed. Stand-alone systems, such as those used for hiring, credit scoring and education, will have to comply from 2 December 2027 instead of August 2026. Systems built into regulated products such as medical devices and machinery will have to comply from 2 August 2028. The change has applied since 27 July 2026, when the so-called digital omnibus for AI, a package to ease the rules, came into force.
How far a fine is from a request for information
A request for information is not an investigation. Reuters says such requests can lead to investigations and fines of up to 7% of global annual turnover. But the text of the Act sets the cap for firms with general-purpose models at 3% of turnover or €15m, whichever is higher. A firm can also be fined if it fails to answer a request for information, or gives false or incomplete information. Before that, the provider gets preliminary findings and can defend itself.
Reuters does not report any fines. It is also not known which firms got the questions or what they replied. Virkkunen said only that she is reading the replies.
The panel of 60 experts is next, and regulators will add its advice to their guidance on how to assess models. It is not clear when that will happen.