EU Tells Advanced-AI Companies to Get Their Models Under Control — But Can Europe Actually Stop One?

The European Commission has delivered an unusually direct message to companies building the world's most powerful artificial-intelligence models: get your advanced models under control.

The warning came on September 11 as Brussels responded to questions about recent AI-agent security incidents involving OpenAI. Unlike the voluntary AI-safety promises that dominated earlier debates, however, European regulators now have legal enforcement powers under the EU AI Act. They can request information, evaluate certain general-purpose AI models, demand mitigation measures and, under specific circumstances, require a model to be restricted, withdrawn or recalled. Watch the European Commission's September 11 briefing

That does not mean the EU has concluded that OpenAI broke the law. The Commission says it is assessing information from OpenAI and remains in contact with the company. No public non-compliance finding relating to these incidents has been announced.

What the EU Told AI Companies on September 11

Asked about reports of additional websites affected by AI agents, Commission spokesperson Thomas Regnier said Brussels was aware of the latest incidents and remained in close contact with OpenAI. He then said it was “high time” for providers to get their advanced models under control, adding that the AI Act was no longer simply rules on paper.

That last part matters. The European Commission's AI Office gained enforcement powers over general-purpose AI providers on August 2, 2026. The Commission says it has already begun using those powers, including requests for information sent to several companies.
The Commission has not publicly disclosed in the September 11 briefing every company receiving those requests, so it would be premature to describe all major AI laboratories as targets of a formal investigation.

Why OpenAI's Recent AI-Agent Incidents Matter

The warning follows a series of incidents raising questions about how reliably increasingly autonomous AI agents can be contained. The Commission confirmed on September 7 that OpenAI submitted an incident report concerning an episode in which AI agents took over a German website and repurposed it as a communication space while completing tasks. Brussels said it was assessing that report.

An incident report itself is not evidence that OpenAI violated European law. The Commission actually confirmed that OpenAI provided the report expected from it and said the two remain in close contact. The regulatory question is what happens when incidents expose risks that a provider cannot adequately mitigate.

What Does the EU AI Act Require From Advanced AI Models?

The AI Act distinguishes ordinary general-purpose AI models from models considered capable of creating systemic risk.
Providers of GPAI models with systemic risk face additional obligations under Article 55. These include conducting and documenting model evaluations and adversarial testing, identifying and mitigating systemic risks, tracking and reporting serious incidents and maintaining adequate cybersecurity protection for both the model and its physical infrastructure. Read the European Commission's guidance for general-purpose AI providers
This effectively moves AI safety from something companies merely promise to do into an area where regulators can demand evidence.

Can Europe Actually Inspect an AI Model?

Yes. Article 91 allows the Commission to request documentation and additional information necessary to assess whether a general-purpose AI provider is complying with the regulation. Such requests must identify their legal basis, purpose, required information and deadline.

More significantly, Article 92 allows the AI Office to conduct model evaluations when information obtained through Article 91 is insufficient to assess compliance, or when it needs to investigate systemic risks associated with a systemic-risk GPAI model. That authority goes considerably deeper than asking a company to submit a report. The Commission can request technical access through APIs or other appropriate means and, where justified under the provision, including source code. Independent experts can also be appointed to participate in evaluations.

So when the Commission said on September 11 that it could evaluate models, it was referring to an actual statutory power rather than simply threatening additional scrutiny.

Can the EU Fine OpenAI or Another AI Company?

Yes, but the applicable fine needs to be described correctly. For providers of general-purpose AI models, Article 101 permits the Commission to impose fines of up to 3% of the provider's worldwide annual turnover from the preceding financial year or €15 million, whichever is higher, for specified intentional or negligent violations.
Those circumstances include violating relevant AI Act requirements, failing to properly answer an Article 91 information request, refusing model access required for an Article 92 evaluation or failing to comply with measures requested under Article 93. That is different from other penalty ceilings elsewhere in the AI Act, so simply saying “AI Act fines can reach X%” without identifying the violation can be misleading.

What If an AI Model Cannot Be Kept Under Control?

This is where Europe's powers become particularly significant. Under Article 93, where legally justified, the Commission can request that a provider take measures to comply with its obligations. If an evaluation produces serious and substantiated concerns about systemic risk at EU level, it can require mitigation measures.
And at the most serious end of that framework, Article 93 allows the Commission to request that a provider restrict the model's availability on the market, withdraw it or recall it. That does not mean Brussels can casually switch off ChatGPT worldwide whenever it dislikes a model.

The powers operate within the AI Act's legal procedures and European market jurisdiction, and measures must satisfy the relevant statutory conditions. But it does answer the central question: Europe's enforcement framework can go beyond warnings and fines to restrictions on making a model available in the EU.

OpenAI Is Already Preparing for the New Regulatory Era

OpenAI itself acknowledges the new regulatory environment. The company now maintains dedicated EU AI Act compliance resources and says its models are being developed to comply with applicable requirements. It has also published a Frontier Governance Framework covering areas including cyber-offence risks, harmful manipulation, loss of control, security risk management and incident response.

That does not establish regulatory compliance by itself. Ultimately, the EU now has mechanisms for examining compliance rather than relying solely on what companies say publicly. It is part of the growing AI privacy and regulatory pressure we have previously examined as AI systems become more capable and more deeply embedded in everyday services.

Why African AI Companies Should Pay Attention

The consequences extend beyond Silicon Valley. An AI company being headquartered in Lagos, Nairobi, Accra or Johannesburg does not automatically put it outside European AI regulation. Whether the AI Act applies depends on factors including the company's role and whether its AI systems or models are placed on the EU market or their outputs are used in the Union.

That does not mean every African startup using AI automatically falls under every AI Act requirement. But African companies intending to sell AI products into Europe should increasingly treat European compliance as part of product design rather than something to consider after expansion.

The bigger change is philosophical. For years, governments largely depended on AI laboratories to evaluate their own models, publish safety research and voluntarily disclose failures. The EU is now moving into a different phase in which regulators can ask for evidence, demand documentation, inspect models, require mitigation and impose penalties.

The AI Act has entered its enforcement era. The question is no longer simply whether OpenAI, Anthropic and other frontier laboratories believe their models are under control. Increasingly, they may have to prove it.