Blog · EU AI Act · Risk
Brussels Has Started Asking Questions: Lessons from the EU AI Act's First Enforcement Actions
28 October 2026 · 2 min read · By LeadAI
The AI Office is questioning frontier AI providers about incidents. Can you see which of your systems depend on those models?
The news in brief
The AI Office has started enforcing the AI Act's rules for general-purpose AI (GPAI) models. It has sent Requests for Information on three topics:
- security
- external evaluation
- post-market monitoring
It has also requested and received serious-incident reports following loss-of-control incidents. Further, more detailed requests will follow, combining questions from the AI Scientific Panel and the AI Office.
Why it matters if you build on these models
If a provider you depend on restricts a model, changes its terms or issues an incident notice, you need to identify the affected systems in minutes, not weeks.
Checklist
- Model lineage: in each AI system record, link the underlying GPAI model, its version and its provider.
- Provider watchlist: flag providers named in public enforcement actions or incident reports, and set up a review task whenever one is flagged.
- Incident intake: create an "upstream provider incident" category, so that notices from providers lead to an impact assessment.
- Agent controls register: for agentic systems, record tool permissions, network access, human-in-the-loop points and shutdown procedures. These match the security and containment themes in the AI Office's questions to model providers.
- Evidence pack: export your AI literacy and Article 50 transparency evidence now. The AI literacy duty has applied since 2025, and the Article 50 transparency duties since 2026. Both are enforceable, except that machine-readable marking for older generative AI systems follows the transition date below.
Key dates for your compliance calendar
| Date | What applies |
|---|---|
| 2 December 2026 | Article 50(2) marking for generative AI systems already on the market before 2 August 2026, and the new prohibited practice added by the Digital Omnibus |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 |
| 2 December 2027 | High-risk systems under Annex III |
| 2 August 2028 | High-risk systems under Annex I |
Sources
- European Commission: Special meeting of the AI Scientific Panel
- Unite.AI: EU announces first AI Act enforcement actions after AI agent incidents
- Behaviture: The EU AI Act in October 2026 – what companies need to do now
- AI Safety Association: EU AI Act news
This article gives general information and is not legal advice or a substitute for the legislation, the standards themselves or professional advice.