23JUL

EU sends AI labs loss-of-control queries

3 min read

19:31UTC

Henna Virkkunen convened the 60-member AI Scientific Panel on 9 October; with the AI Office it drafted questions for frontier AI developers about recent loss-of-control incidents.

← Back to Germany's caverns stop buying gas Jump to analysis ↓

EconomicDeveloping

Key takeaway

Brussels is testing whether its AI rulebook reaches frontier labs based outside Europe.

The European Commission will send requests for information to the developers of frontier AI models, the most capable systems behind the big chatbots, about what it calls recent loss-of-control incidents⁠¹. Executive Vice-President Henna Virkkunen convened a special meeting of the AI Scientific Panel on 9 October to set the requests up. No Commission text names a company or a model.

The 60-member panel drafted the questions jointly with the AI Office, the Commission unit that supervises general-purpose AI models under the EU AI Act. The AI Office says it has already requested and received serious-incident reports from providers, and sent separate requests on their security practices⁠². the Commission's 12 October account lists the chair's four recommendations: governance of internal models during development and test deployment; a stronger EU capability to detect, evaluate and investigate incidents; an international initiative to share information and respond jointly to crises; and closer scrutiny of training techniques that make models harder to monitor⁠³.

Nearly every frontier lab sits outside the EU, so the requests test whether Europe's rulebook reaches the companies it buys its most capable models from. Until this month the Commission's general-purpose AI supervision had shown up as dates and registers: a fining power that took effect against a stale contact list, then the AI Omnibus widening the AI Office's reach to models inside large platforms. The 9 October meeting turns that machinery on incidents for the first time on the public record.

A request for information carries no penalty. Under the AI Act a fine on a provider of a systemic-risk model follows only a finding of breach, and the requests sit a step before that. Virkkunen's claim that "the EU has the first law in the world that addresses systemic risk from AI" will be judged on what the AI Office does with the answers⁠⁴.

Deep Analysis

In plain English

Frontier AI models are the most powerful AI systems, the ones behind the big chatbots. A loss-of-control incident is a case where such a system does something its makers did not intend and could not easily stop. The European Commission is the EU's executive arm. Its AI Office enforces the EU AI Act, the bloc's main AI law, for these large models. The AI Scientific Panel is a group of 60 independent experts that advises it. The panel and the office have written questions for the companies involved. Most of the world's frontier labs are based outside the EU. A request for information is not a fine; it is the step a regulator takes to gather facts before deciding whether a law was broken.

Deep Analysis

Root Causes

The AI Act puts general-purpose model supervision in one Brussels unit rather than 27 national regulators. That design lets the Commission question a lab directly, which no national authority could do for a provider with no EU establishment.

The chair's recommendation on internal models points at a gap in the law itself: the Act regulates models placed on the market, while the systems a lab tests before release sit largely outside it. Loss-of-control incidents in test deployment fall into that gap.

The fourth recommendation, on training techniques that make models harder to monitor, reflects a technical constraint: if a model can mask its own behaviour, an incident report filed by the provider is the only window the regulator has.

What could happen next?

Precedent
The AI Office now has a working route to question non-EU labs about safety incidents, which later requests can follow.
Medium term · Assessed
Risk
US trade officials may cite the requests as a further EU digital trade barrier in the 2027 National Trade Estimate.
Short term · Suggested
Consequence
Labs that answer will create the first EU record of loss-of-control incidents, which any future enforcement case would draw on.
Medium term · Assessed

Source Landscape

This story draws on neutral-leaning sources from Belgium

Belgium×2

Primary parallel: On 12 October 2023 the Commission sent its first Digital Services Act request for information to X over content linked to the Hamas attack, and opened formal proceedings that December. The request was the opening move in an enforcement file, not a stand-alone inquiry.

Counter-parallel: GDPR applied from May 2018, but the largest fine against a US platform, Meta's €1.2bn for data transfers, came only in May 2023. Information powers moved fast; penalties under a regime run through a lead authority took five years.

The fine ceiling for a general-purpose model provider is €15m or 3% of global annual turnover, whichever is higher. For the largest labs that ceiling runs into hundreds of millions of euros, which is why the request stage matters: it builds the evidence file any later penalty would rest on.

The structural cost falls on compliance teams at the labs, which must now answer the same questions in Brussels that they answer in London and Washington, under three different disclosure regimes.

Consensus view: the Commission's own account treats the requests as an extension of supervision it already runs: the AI Office says it has collected serious-incident reports and asked providers about their security practices, and the panel chair's four recommendations aim at internal models, detection capacity, crisis coordination and training methods that resist monitoring.

Counter-view: Washington reads EU digital supervision of American firms as a trade question, not a safety one. The US Trade Representative named the EU among markets to be assessed for digital trade barriers on 14 September, and Jamieson Greer said in July that the Google fine created massive uncertainty for US exports.

Key tension: Whether a request for information can extract internal-model detail from labs based outside the EU before any breach finding gives the AI Office leverage to compel it.

Sources:European Commission·European Commission

Mentions:European Commission →AI Office →Henna Virkkunen →EU AI Act →Jamieson Greer →Google →Washington →Meta →Hamas →GDPR →AI Omnibus →Digital Services Act →GPAI →

First Reported In

Update #17 · EU questions AI labs over loss of control

European Commission· 22 Oct 2026

Read original →

Causes and effects

Caused by

AI Act fines land on a stale register

The AI Act fining power that began on 2 August stands behind the AI Office's first requests on loss-of-control incidents.

Occurred 2 Aug 2026

Read story →

Omnibus widens the AI Office's reach

The AI Omnibus widened the AI Office's supervisory reach before it turned that reach on frontier incidents.

Occurred 27 Jul 2026

Read story →

This Event

EU sends AI labs loss-of-control queries

The requests are the first public test of whether the AI Act's systemic-risk rules reach frontier labs based almost entirely outside the EU.

Different Perspectives

Cross-border power traders

The France-Germany day-ahead spread flipped from a EUR 17.20 German premium on 1 August to a EUR 4.15 French premium on 3 August, the same day French curtailment peaked. They cannot yet attribute the flip to curtailment alone, since a like-for-like overnight comparison shows French nuclear output rising while wind fell and demand returned on the weekday step.

EDF

River-cooling limits took 7.6 GW, 12 per cent of its fleet, offline on 3 August, the highest curtailment since the heatwave began, with an easing forecast to 4.3 GW on 4 August and 3 GW after. It manages the cut as a recurring seasonal constraint, expecting it to lift with river temperature, not repair.

Gasunie

TTF, the Dutch hub it operates, drifted to roughly EUR 55 to 58 per MWh across the window, staying inside its recent range through both the German spark reversal and the French curtailment. It reads a flat hub price as evidence that neither event this window carried enough weight to move the fuel leg on its own.

German gas-fired generators

Record German solar of 18,761 MW on 2 August pushed the clean spark spread to minus 18.48 EUR/MWh, a loss-making day, before it returned to plus 16.20 on 3 August. They now price dispatch against post-solar residual load rather than wind alone, since the sign flipped inside 48 hours on unchanged fuel and carbon costs.

European Commission (DG Energy)

Its implementing-measures register logged transposition notices from only Portugal and Slovakia against Wednesday's Article 94 deadline for Directive (EU) 2024/1788, with 25 states silent. It expects the register to fill only gradually, since filing routinely lags legislating and any infringement track against non-notifying states runs on a slower clock than the deadline itself.

Spain's LNG terminal operators

Spain's 9,145 GWh terminal inventory is the largest single stock in the EU LNG network, an option value that can reroute cargoes wherever the winter strip pays best rather than a cavern gas obligation tied to a fixed date. That flexibility matters more as Germany's cavern shortfall pushes more of the winter security question onto import infrastructure.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.