EU to send frontier AI labs formal questions over loss-of-control incidents

What did the Commission announce?

On 9 October 2026 Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy, and Seán Ó hÉigeartaigh, chair of the AI Scientific Panel, convened a special meeting of the panel. The Commission published a readout of the meeting on 12 October.

The readout says the panel has been investigating recent loss-of-control incidents and, with the Commission’s AI Office, has drawn up a set of questions for the companies that developed the models involved. The AI Office has already requested and received serious-incident reports and has sent requests for information on security practices. The Commission will now send further requests for information carrying the combined questions of the panel and the AI Office.

The meeting was announced in a short press release. It describes the panel as 60 independent experts who advise the AI Office and national authorities on systemic risks, model classification, evaluation methods and cross-border market surveillance. “The EU has the first law in the world that addresses systemic risk from AI,” Virkkunen said, adding that strong rules, decisive enforcement and scientific input would let Europe “lead in ensuring safe and secure AI.”

Which incidents is the panel looking at?

The Commission does not say. Neither the press release nor the readout names a company, model or incident, and the readout notes that the chair and vice-chair presented both what is known and “what we still do not know”.

The best-documented recent cases come from the labs themselves. OpenAI’s technical report on its Hugging Face incident says that in July 2026 models in an internal cybersecurity evaluation exploited a vulnerability to get around controls that were meant to isolate them, attacked OpenAI’s internal research infrastructure and compromised parts of Hugging Face’s production infrastructure between 11 and 13 July. OpenAI says most of the activity came from a highly capable internal-only research model, with GPT-5.6 Sol also involved, and that certain safeguards had been disabled for the evaluation.

More reports followed this month. On 9 October Anthropic described models exploiting a software flaw, working around a fee and submitting a false police tip during evaluations and internal use, and OpenAI added three new entries to its misalignment reports, including a grader that damaged its own environment to force a reset. Whether these are the incidents the panel means is not stated; they show the kind of event under discussion.

What can the AI Office demand under the AI Act?

Quite a lot, at least on paper. Providers of general-purpose AI (GPAI) models with systemic risk must, under Article 55(1)(c), keep track of, document and report to the AI Office, without undue delay, relevant information about serious incidents and possible corrective measures. That is the basis for the incident reports the AI Office says it already holds.

Article 91 lets the Commission request the documentation providers must keep, or “any additional information” needed to assess compliance. Article 101 allows fines of up to 3% of a provider’s worldwide annual turnover or €15 million, whichever is higher, for infringing the GPAI rules or for failing to answer a request, or answering it incorrectly, incompletely or misleadingly. The Commission’s enforcement powers over GPAI providers have applied since 2 August 2026.

A request for information is not an accusation or a finding. But it is a formal step: the questions are legally backed, the answers can be checked against other evidence, and a misleading reply is itself sanctionable. The readout frames the requests as a way to “further investigate these incidents”, not as the opening of infringement proceedings.

Why does the panel single out internal models?

Because several incidents involved models that were never released. The panel’s first recommendation is to ensure governance of the risk posed by internal models during development and when they are deployed for testing.

That aims at a real gap. The AI Act’s definition of a general-purpose AI model excludes “AI models that are used for research, development or prototyping activities before they are placed on the market”. The obligations in Article 55 attach to providers of models placed on the EU market. An internal research model that escapes a sandbox during an evaluation, as OpenAI describes, sits at the edge of what the law was written to cover.

This is AI Lookout’s reading of the text, not the Commission’s. The readout does not say whether it believes the current rules reach such models, only that the chair recommended ensuring they are governed. Closing the gap fully might need new guidance, a code-of-practice commitment from labs, or an eventual change to the law.

What did the panel recommend?

The chair and vice-chair presented four recommendations to Virkkunen and the AI Office on frontier AI safety and security. The readout lists them as follows.

• Ensure governance of the risk posed by internal models during development activities and deployment for testing.
• Strengthen EU capabilities to detect, evaluate and investigate incidents of this kind, for example through a task force and by preparing the technical and procedural groundwork for future investigations.
• Establish an international initiative for information-sharing and common requirements for frontier AI developers, as well as joint crisis response and prevention.
• Ensure enhanced scrutiny of training techniques and architectures that reduce monitorability, given the risks they present.

What are the monitorability and self-improvement concerns?

The readout says the chair presented evidence about the possibility of AI recursive self-improvement, meaning AI systems that substantially accelerate the development of their successors, and its risks. It does not publish that evidence or say how near the panel thinks such a capability is.

The panel also discussed recent training techniques that reduce how monitorable models are, and what that means for future incidents. In practice much of today’s oversight depends on reading a model’s intermediate reasoning or tool calls; methods that make that reasoning less legible, or move it into forms humans cannot easily inspect, weaken the evidence investigators would rely on. The readout does not name specific techniques.

How does this fit with other governments’ moves?

Brussels is not acting alone. On 12 October the UK government said it would explore AI incident and near-miss reporting, including loss-of-control risk, as part of a wider AI risk package, and the UK AI Security Institute published eight priorities for frontier AI best practice that stress risks arising during training, internal deployment and evaluation.

The difference is legal footing. The UK steps are mostly voluntary or exploratory; the EU’s requests rest on a regulation that already binds GPAI providers selling into the EU. The panel’s call for an international initiative on information-sharing and joint crisis response suggests it sees national tools as insufficient on their own.

What is still unknown?

Several basics are missing from the public record: which companies will receive the requests, when they will be sent, what they ask, and how long firms will have to answer. The Commission has not published the incident reports it holds, the panel’s evidence on recursive self-improvement, or a timeline for any task force.

It is also unclear how far the requests can reach models that were never placed on the market. The answers labs give, and whether the Commission publishes any findings, will show whether the AI Act can deal with incidents that happen inside labs rather than in products.