EU Questions OpenAI and Anthropic: What AI Regulators Can Examine

The European Commission is requesting information from OpenAI and Anthropic about their AI models. The EU’s digital chief, Henna Virkkunen, confirmed the requests in an October 9 interview with European Newsroom. For users and businesses, the main significance is that safety promises are meant to become verifiable. The request itself does not establish a legal violation.

Key takeaways

• Virkkunen named OpenAI, Anthropic, and unspecified Chinese companies as recipients of information requests that had already been sent.
• The Commission’s AI Office can request documentation, evaluate models, and demand further measures when the legal conditions are met.
• General-purpose AI models with systemic risk face additional requirements for risk assessment, incident reporting, and cybersecurity.
• The confirmed requests are neither an imposed fine nor an announced ban on ChatGPT or Claude.

What the Commission can ask for

A request for information, or RFI, gathers material for regulatory review. Article 91 of the EU AI Act allows the Commission to request technical documentation and additional information needed to assess compliance with the law. Such a request must state its legal basis and purpose, specify the information required, and set a response deadline.

This turns a broad safety debate into questions that can be investigated: what capabilities does a model have, which risks were examined, and what safeguards exist? For a technical assessment, the underlying documentation matters more than a product presentation. A model can appear reliable in a demonstration while producing problematic actions under different conditions.

In its current explanation, the Commission distinguishes between simple requests and formal requests issued by a Commission decision. The consequences of an incorrect, misleading, incomplete, or missing response depend on the form used. The published interview does not establish the precise form of each letter. Nor does it make their full questions and deadlines public.

Virkkunen’s statement confirms that the letters had already been sent. It does not establish that they were sent on the interview date. That distinction matters: the news is the public confirmation of the named recipients, rather than a documented common starting date for every review.

Which models face additional safety requirements

The EU AI Act distinguishes between general-purpose AI models and those with systemic risk. General-purpose models can perform many different tasks and underpin a range of applications. The additional risk category addresses potential harm extending far beyond a single incorrect chat response. A familiar brand name alone therefore does not establish which obligations apply to a particular model.

Article 55 requires models with systemic risk to undergo evaluations using appropriate procedures, including documented testing designed to identify dangerous capabilities. Providers must assess and mitigate possible systemic risks. Serious incidents and possible corrective measures must be reported without undue delay. An adequate level of cybersecurity protection is also required for the model and its physical infrastructure.

That is a different standard from asking whether a chatbot usually gives helpful answers. For an agent using tools, relevant considerations include how its actions are constrained and what happens after an erroneous action is detected. Documented investigations and safeguards are consequently a separate focus for regulatory review.

The rules for general-purpose AI model providers have generally applied since August 2, 2025. The Commission’s corresponding enforcement powers have applied since August 2, 2026. For models already on the market before August 2, 2025, the guidelines specify a transition period ending August 2, 2027. A blanket claim that every detail has applied equally to every older model since August would therefore be too broad.

What could follow from the review

The available tools extend beyond exchanging letters. According to the Commission, the AI Office can evaluate models and request access for that purpose. It can also require measures to ensure compliance, including restrictions on public availability where necessary. Those possibilities describe its legal powers. They do not mean that such a restriction has already been adopted against OpenAI or Anthropic.

For breaches of general-purpose AI model obligations, the Commission lists fines of up to 15 million euros or three percent of worldwide annual revenue, whichever is higher. A maximum is not a prediction for an individual case. Relevant factors include the nature, severity, and duration of an established infringement.

The difference from a voluntary commitment is nevertheless substantial. As our analysis of Washington’s AI pact explains, announced layers of oversight do not replace binding requirements. An authority with investigative and enforcement powers can check whether the promised measures actually exist.

For businesses buying AI services or integrating them into their own offerings, this suggests useful questions: what documentation does the provider supply? How are relevant incidents communicated? Which model changes can customers track? These are practical implications of regulatory oversight, rather than a claim that the current letters target ordinary end users.

The next meaningful development is the outcome

The confirmation establishes an information-gathering process. The details of the responses, their assessment, and possible further decisions remain open. Reading an imposed fine or the end of a service in Europe into that confirmation would skip the decisive steps.

Readers should therefore watch for the next documented stage: a published assessment, specific remedies, or a formal decision. That will show whether European AI oversight turns safety announcements into inspectable evidence and, where needed, effective changes.