EU AI Act RFIs 2026 Explained: First 30-Plus Provider Probe
1 Sep: first AI Act RFIs to 30-plus firms. Two tracks. No list. No infringement finding.
To read the 1 September 2026 EU regulatory story, split two facts: the Commission confirmed it has issued its first formal Requests for Information under the AI Act, to more than 30 companies. That is not a named penalty and not a published finding of infringement.
After Executive Vice-President Henna Virkkunen spoke in late August, spokesperson Thomas Regnier confirmed at the 1 September midday briefing that the AI Office had sent the first enforcement-step RFIs to more than 30 AI firms.
What actually happened
Agence Europe and the Commission audiovisual record of the midday briefing align: two tracks, no public list, dialogue continues.
Safety and security track
Regnier said the first set covers safety and security, including general-purpose models and the most advanced systems. Virkkunen’s written questions: model security, independent external evaluations, and monitoring once models are on the market.
Copyright and transparency track
The second set targets copyright and transparency. Virkkunen wrote that those RFIs went to providers that have not yet published detailed summaries of training content and have not joined informal compliance dialogues with the AI Office.
Silence on names is not a verdict
The Commission said it will not name firms at this stage because these are simple RFIs — the first enforcement steps. Officials were explicit: no infringement finding has been announced.
How to read the timeline
A date list is calmer than “Brussels started fining Silicon Valley.”
-
1
From 2 August, GPAI enforcement tools apply
Legal notes (for example Taylor Wessing) place Commission and AI Office GPAI enforcement powers from 2 August 2026. Information requests, document production, and — if needed — model evaluations sit in that procedure.
-
2
After a summer of incidents, RFIs went out
Virkkunen wrote that models grew more capable and that several incidents occurred over the summer. She called the formal information requests a first step in enforcing the AI Act. Agence Europe dated her note to a Sunday post in late August.
-
3
The 1 September briefing locked “more than 30”
Regnier confirmed a batch of RFIs involving more than 30 AI companies. He also confirmed recent contacts with OpenAI and Anthropic, including cyber risks, and refused to say whether either firm received an RFI.
Do not flatten “talks” into “convicted”
| Claim | Public line | Still missing |
|---|---|---|
| RFI | First enforcement step; answers required | Not a fine decision |
| OpenAI / Anthropic | Recent contacts include cyber risk | RFI receipt not confirmed |
| ENISA | Advanced-model access still bilateral | Briefing: process incomplete |
Why enterprise buyers and compliance stacks care
GPAI providers need showable security evaluations, post-market monitoring records, and a training-content summary if the transparency duty applies. Firms that resell or wrap those models in the cloud still have to tell “provider” from “deployer.” The briefing did not rewrite that split; it only showed Brussels is now collecting a file with RFIs.
This is not the US Commerce remote-access chip rule and not tariff phase two. A compliance huddle does not need an enterprise meeting suite: in figmeet a room ID is enough for voice plus a board; see the guide, features, and the no-account privacy note.
# Public markers (Commission midday briefing, 2026-09-01)
Instrument: AI Act Requests for Information (first enforcement steps)
Count: more than 30 AI companies (unnamed)
Track A: safety / security (GPAI + most advanced models)
Track B: copyright / transparency (training-content summaries)
Also: recent Commission contacts with OpenAI and Anthropic on cyber risks
ENISA advanced-model onboarding: still bilateral, not completeVirkkunen’s direction: models are more capable, the summer produced incidents, and the Commission can require stronger risk mitigation. Do not rewrite “can require” as “already fined.”
- RFI
- Request for Information. A formal step to collect documents and written answers. The briefing called it first enforcement, not a final ruling.
- AI Office
- The Commission unit that supervises general-purpose models and sent these requests.
- GPAI
- General-purpose AI models. The safety track names these and the most advanced systems.
Questions worth checking
Were the 30-plus firms named?
No. Regnier said names stay unpublished for now because RFIs are an early step and dialogue continues.
Must OpenAI and Anthropic be on the list?
The Commission only confirmed recent contacts that included cyber risk, and refused to say who received RFIs. Press guesses are not an official list.
Does this mean fines landed this week?
No. The briefing stressed that no infringement finding has been made. Statutory fines exist; that is not the same as using them.
Must a company that only deploys someone else’s model answer these RFIs?
The public line targets model providers. Deployer duties still follow the AI Act role split. Whether you are in this batch depends on whether you received a formal request.