EU Doubles Down on AI Act Enforcement for Frontier-Model Safety: Virkkunen Says the Act "Covers the Whole Life Cycle" as RFI Sweep Responses Come In
While Washington pivots to liability-based enforcement (see White House "Super Intelligence Force" Makes AI Incident Reporting Mandatory — Anthropic's Rogue-Agent Disclosures Trigger the Pivot), the EU's response to the same rogue-agent incidents is framed as existing-law sufficiency: EU tech chief Henna Virkkunen told Reuters (Oct 9, 2026) that the AI Act is "more than capable" of tackling rogue agents, and disclosed that the Commission's information sweep of the AI industry is now in the response-assessment phase.
What Virkkunen said
"We see that the safety and security of very capable models is a very hot topic internationally and we in Europe are well equipped for that... We have our AI Act in place and the AI Act covers the whole life cycle of these models."
She dismissed industry criticism that the EU's rules are "already outdated," arguing legislators anticipated developments by requiring risk assessments, external expert involvement, and continued monitoring of models — with regulators now providing guidance on model evaluation, informed by a scientific panel of 60 AI experts.
The enforcement pipeline behind the rhetoric
The concrete hook: in late August 2026, the Commission sent requests for information to more than 30 AI companies — unnamed — seeking details of their safety and security measures, followed up with questions on transparency and copyright obligations. Virkkunen is "now assessing the responses." Such RFIs "can lead to investigations that could result in fines of as much as 7% of a company's global annual turnover" — the AI Act's top-tier penalty, reserved for the most serious violations. She confirmed the Commission has "also sent requests for information to" Chinese AI startups, noting "the most capable models" now on the market are from the US and China: "I think that all these capable models, of course they are posing new kinds of risks that we have to be aware of."
Context and why it matters
This is the enforcement posture to watch as the EU's recalibrated timeline plays out — the Digital Omnibus on AI (in force July 27, 2026; see EU Digital Omnibus on AI Is Now Law: Formal Adoption Completed July 2026, Annex III High-Risk Obligations Deferred to December 2, 2027) deferred Annex III high-risk obligations to December 2, 2027, but general-purpose model obligations (the layer relevant to frontier safety) are live. For enterprises, two practical takeaways: (1) the Commission is treating the GPAI/safety layer as an active enforcement program, not a paper regime — RFI responses are being assessed with 7%-of-turnover penalties in the background; (2) the EU and US are converging on the same incident set (OpenAI/Anthropic containment failures) but with different instruments — ex-ante product-safety regulation in the EU, liability and incident-reporting jawboning in the US. Multinationals should expect both probes to inform each other, and should ensure model-safety documentation satisfies both the AI Act's technical-documentation demands and the US "immediate disclosure + remediation" expectation.