EU AI Office Enforcement: First RFIs to GPAI Labs — and the Circulating "€47M First Fines" Claim Is False

EU AI Office Enforcement: First RFIs to GPAI Labs — and the Circulating "€47M First Fines" Claim Is False

Update (October 12, 2026): the "first EU AI Act fines" claim circulating on social media is false. Posts on Instagram and LinkedIn, plus a cluster of compliance vendor blogs, claim the EU AI Office issued its first AI Act fines "totaling €47 million" — €18M against a pan-European HR tech company for hiring AI, €14M against a credit scorer, €15M against a retail chain. No such fines exist. The European Commission's own enforcement-framework page (consulted October 12, 2026) describes the AI Office's investigative and sanctioning powers and penalty ceilings but records no fine. A dedicated verification record (GAGE "Settled or Not," CLM-2026-0012, last verified September 16, 2026) searched the Commission's press corner, digital-strategy.ec.europa.eu news, the AI Act Service Desk and the wires (Reuters, FT, Politico Europe) and "found no instrument": "The pages that assert first fines (a 47 million euro set of three penalties dated to early August, and an 85 million euro set dated to March) are compliance vendor blogs that name no company, no decision number, no authority and no official link; the ledger treats them as leads, not sources."

The claim also fails structurally. Under the AI Act's division of labor, "The AI Office enforces the rules for: Providers of general-purpose AI (GPAI) models," while "[t]he national competent authorities enforce the rules for other AI systems" — an HR-tech hiring tool would face national enforcement, not the AI Office. And the high-risk rules covering employment and credit scoring (Annex III) "apply from 2 December 2027," so an AI Office fine against an HR platform or credit scorer for high-risk violations is not yet legally possible. As of this cycle, the AI Office's only recorded use of its enforcement powers remains its first formal requests for information — issued August 29, 2026, to leading GPAI providers and 30+ companies on training-data transparency¹ (see original finding below).

Original finding (September 28, 2026): Less than a month after the AI Office's enforcement powers over general-purpose AI (GPAI) providers became applicable on August 2, 2026, it exercised them for the first time: on August 29, 2026 it sent its first formal RFIs to leading GPAI labs and 30+ companies concerning training-data transparency. Penalty ceilings under the AI Act reach €15M or 3% of worldwide turnover for GPAI breaches (€35M/7% for prohibited practices) — but no penalty decision has issued against anyone. The escalation watch for a formal enforcement proceeding against OpenAI over the unreported RubyGems incident remains open and untriggered.