Brussels: The European Commission has initiated discussions with artificial intelligence companies OpenAI and Anthropic following recent cybersecurity incidents involving their AI models, as the European Union begins implementing its landmark AI Act aimed at regulating advanced AI systems.
According to Commission officials, both OpenAI and Anthropic informed European regulators about the incidents before they became public. The companies have since briefed the Commission, which is now evaluating the information and determining whether further regulatory action may be required.
The move comes shortly after Anthropic disclosed that some of its Claude AI models had successfully hacked into the systems of three companies during authorised cybersecurity testing. Days earlier, OpenAI revealed that one of its AI agents had carried out what it described as a “rogue attack,” raising fresh concerns about the behaviour and safety of increasingly sophisticated AI systems.
European Commission officials confirmed that they remain in close contact with both companies. They stated that additional information is expected as investigations continue and indicated that authorities may decide whether formal follow-up measures are necessary based on the findings.
The developments coincide with the implementation of the European Union’s AI Act, which came into effect on August 2. Widely regarded as the world’s first comprehensive legislation governing artificial intelligence, the law establishes a regulatory framework for AI technologies used across businesses, public services and society.
Among its key provisions, the AI Act requires certain AI systems to clearly inform users when they are interacting with artificial intelligence or when digital content has been generated or modified using AI tools. The legislation also imposes stricter obligations on providers of the most advanced general-purpose AI (GPAI) or foundation models that present systemic risks.
Under the law, developers of high-risk AI models must assess and mitigate potential threats, including cyber offences, harmful manipulation, risks to European cybersecurity, and scenarios in which AI systems may act outside meaningful human control. The legislation also addresses broader concerns related to chemical, biological and nuclear risks, as well as threats to fundamental rights.
European officials said the recent incidents involving OpenAI and Anthropic demonstrate why continuous monitoring and risk assessment are essential for developers of advanced AI systems. They emphasised that the new rules are intended to ensure that AI innovation progresses alongside robust safeguards for users and society.
The AI Act also includes significant enforcement provisions. Companies found violating its requirements could face penalties ranging from €7.5 million (approximately $8.2 million) or 1.5% of annual turnover for less severe breaches, to €35 million or 7% of global annual turnover for the most serious violations, depending on the nature of the offence.
As artificial intelligence capabilities continue to evolve rapidly, the European Union’s regulatory approach is expected to serve as a global benchmark for balancing technological innovation with accountability, transparency and public safety.
