Executive summary

The EU AI Act has moved from implementation to enforcement.

On 1 September 2026, the European Commission confirmed that it had sent the first requests for information in the context of AI Act enforcement to more than 30 AI companies.

According to the Commission, the requests concern two broad areas.

The first concerns safety and security, including general-purpose and the most advanced AI models.

The second concerns copyright and transparency issues.

The development is significant because the European Commission’s enforcement powers concerning providers of general-purpose AI models became applicable on 2 August 2026.

The first requests show that documentation, risk management, copyright compliance and transparency arrangements are no longer merely matters of preparing for future supervision. Companies may now have to explain and substantiate their compliance directly to the regulator.

The AI Act has entered its enforcement phase

The AI Act has applied progressively since 2025.

A major further stage was reached on 2 August 2026, when the Commission’s enforcement powers concerning general-purpose AI became applicable and further AI Act requirements entered into application.

Only weeks later, the Commission has now confirmed its first enforcement requests for information.

This is an important change in the practical risk environment.

For AI companies, compliance documentation may now serve not merely as internal governance material but as evidence requested by the European AI Office or Commission during an actual supervisory process.

What has the Commission confirmed?

During its 1 September 2026 press briefing, the Commission stated that enforcement action had started through requests for information sent to more than 30 AI companies.

It identified two principal areas of attention:

• safety and security, including issues concerning general-purpose and advanced AI models; and
• copyright and transparency.

The Commission did not publicly identify all recipients or disclose the detailed content of the requests.

Businesses should therefore avoid drawing conclusions about particular companies unless their involvement has been officially confirmed.

The broader message, however, is clear: AI Act supervisory powers are now being used in practice.

The Commission has significant information-gathering powers

Article 91 of the AI Act gives the Commission the power to request documentation and information from providers of general-purpose AI models where necessary to assess compliance with the Regulation.

A request must identify its legal basis and purpose, specify the information required and establish a deadline for responding.

Importantly, the request must also refer to the fines that can apply where information supplied is incorrect, incomplete or misleading.

Providers therefore need appropriate internal procedures not only for preparing the substantive documentation but also for ensuring that regulatory responses are complete and accurate.

Technical documentation is becoming regulatory evidence

Providers of general-purpose AI models are already required under the AI Act to prepare and maintain technical documentation concerning their models.

Depending on the model and the applicable obligations, this may include information concerning:

• training and testing;
• model evaluation;
• capabilities and limitations;
• systemic-risk assessment;
• risk mitigation;
• cybersecurity;
• copyright compliance; and
• information provided to downstream AI-system providers.

The first enforcement RFIs demonstrate why these documentation obligations matter operationally.

Documentation should be capable of supporting the position a provider takes when interacting with the AI Office.

Copyright is an enforcement issue

Copyright has been one of the most debated aspects of generative AI development.

The AI Act requires providers of general-purpose AI models to put in place a policy to comply with EU copyright and related-rights law, including mechanisms addressing reservations of rights under the Copyright in the Digital Single Market Directive.

Providers must also publish a sufficiently detailed summary of the content used to train their models in accordance with the template provided by the AI Office.

The fact that the Commission has identified copyright and transparency as an area covered by the first RFIs shows that these obligations should not be treated as secondary to technical AI governance.

Safety and security are under scrutiny

The Commission has also identified safety and security as an area of the first enforcement activity.

For providers of the most advanced general-purpose AI models, this potentially intersects with the AI Act’s requirements concerning systemic risks.

The Commission’s powers go beyond requesting documents.

Where appropriate, the AI Office may conduct model evaluations. The Commission may also request access through APIs or other appropriate technical means and, in certain circumstances, source code.

Where necessary and appropriate, the Commission can subsequently request compliance or mitigation measures and, in more serious circumstances, restrictions on making a model available, withdrawal or recall.

This matters beyond the companies receiving the first requests

The immediate targets of the Commission’s enforcement activity are AI providers.

But the implications extend further across the AI value chain.

Businesses acquiring, deploying or integrating third-party AI increasingly depend on their providers’ ability to demonstrate compliance.

Enterprise customers may therefore want stronger contractual provisions covering:

• AI Act compliance;
• regulatory cooperation;
• information and documentation;
• copyright claims;
• model changes;
• safety and cybersecurity issues;
• regulatory investigations; and
• suspension or withdrawal of models.

Similarly, technology M&A involving AI businesses will increasingly require due diligence not only into what a model can do, but into whether the company can substantiate its regulatory compliance.

AI due diligence is becoming more evidence-driven

For acquisitions of AI companies, documentation quality may increasingly be an indicator of regulatory maturity.

Buyers may need to assess:

• whether the target qualifies as a provider of a GPAI model or another regulated actor;
• which AI Act obligations already apply;
• whether technical documentation is complete and current;
• how model training data and copyright issues are addressed;
• whether systemic risks have been identified and mitigated;
• what regulatory communications have occurred; and
• whether statements made to authorities are consistent with internal documents and technical evidence.

Regulatory RFIs and investigations may also affect warranties, disclosure, indemnities and transaction timing.

What AI businesses should do now

1. Confirm the organisation’s AI Act role.

   Determine whether the company acts as a provider of GPAI models, AI systems, deployer, importer, distributor or another regulated actor.

2. Review technical documentation.

   Ensure required documentation is complete, internally consistent and capable of supporting regulatory scrutiny.

3. Review copyright compliance.

   Assess policies for copyright and related-rights compliance, rights reservations and training-content transparency.

4. Review safety and security governance.

   Confirm that model evaluations, risk assessments, mitigation measures and cybersecurity processes are documented.

5. Create an RFI response process.

   Identify who coordinates regulatory requests across legal, engineering, product, security and management teams.

6. Verify information before submission.

   Responses to regulators should be reviewed carefully because incomplete, incorrect or misleading information can itself create enforcement exposure.

7. Preserve regulatory evidence.

   Maintain appropriate records of testing, decisions, evaluations and mitigation measures.

8. Review AI contracts and transactions.

   AI compliance, regulatory cooperation and information rights should increasingly form part of procurement, licensing and M&A documentation.

FAQ

Has AI Act enforcement actually started?

Yes. On 1 September 2026, the Commission confirmed that its first enforcement requests for information had been sent to more than 30 AI companies.

What issues are being investigated?

The Commission identified two broad areas: safety and security, including issues concerning general-purpose and advanced AI models, and copyright and transparency.

Can the Commission require an AI provider to provide documents?

Yes. Article 91 of the AI Act allows the Commission to request documentation and additional information necessary to assess compliance by providers of general-purpose AI models.

Can the AI Office examine the model itself?

Potentially. Article 92 provides powers to conduct evaluations and, in defined circumstances, request access through APIs or other technical means, including source code.

Does this matter to companies that merely buy or deploy AI?

Yes. Although the Commission’s GPAI enforcement powers principally concern model providers, customers and downstream providers increasingly depend on the compliance of upstream AI providers. Contracts, procurement diligence and AI governance should take that regulatory dependency into account.

Sources

• European Commission, Midday Press Briefing, 1 September 2026, confirmation of first AI Act enforcement requests for information.
• European Commission, Commission starts enforcing AI Act rules and new transparency requirements on 2 August, 31 July 2026.
• Regulation (EU) 2024/1689 (Artificial Intelligence Act), in particular Articles 53 and 89–93.
• European Commission, Guidelines for providers of general-purpose AI models.