Enforcement development · GPAI
The AI Office has moved from enforcement readiness to formal information requests.
European Commission Executive Vice-President Henna Virkkunen publicly confirmed that the AI Office sent formal requests for information to a number of GPAI providers in different regions, covering model security, external evaluation, post-market monitoring and training-content transparency.
Published and legally reviewed: 5 October 2026 · Reviewed by Constantin Razvan Gospodin.
Direct answer
This is an enforcement development, not a new amendment to the AI Act.
The legal power already exists in Article 91. What changed operationally is that the AI Office has begun using formal requests as part of GPAI supervision after the Commission's enforcement powers became applicable on 2 August 2026. Virkkunen's public statement does not identify the recipients, and the existence of a request does not itself establish an infringement.
What the first requests cover
The questions point directly at evidence a GPAI provider should already be able to produce.
Model security
The Commission's public confirmation identifies model-security practices as a subject of the requests, linking enforcement to technical risk controls rather than policy statements alone.
Independent external evaluation
Providers of the most advanced models should be prepared to explain how independent testing is enabled, scoped, governed and incorporated into risk-management decisions.
Post-market monitoring
Once a model is available on the market, monitoring evidence should show how incidents, emerging capabilities, misuse patterns and other relevant risk signals are identified and escalated.
Training-content transparency
Virkkunen also stated that requests were sent to providers that had not yet published detailed summaries of training content and had not participated in informal compliance dialogues with the AI Office.
Article 91
A request for information has a defined legal structure.
Article 91 allows the Commission to request Article 53/55 documentation or other information necessary to assess GPAI-provider compliance. The request must state its legal basis and purpose, identify the required information, set a response period and indicate the Article 101 exposure for incorrect, incomplete or misleading information.
Article 101
Response quality is itself an enforcement issue.
For GPAI providers, Article 101 permits fines up to 3% of worldwide annual turnover or €15 million, whichever is higher, for specified intentional or negligent infringements. The listed grounds include failing to comply with an Article 91 request or providing incorrect, incomplete or misleading information, subject to the Regulation's procedural safeguards and proportionality requirements.
Read the Regulation 2026/1755 enforcement-procedure analysis →
Regulator-response readiness
What providers should have ready before an information request arrives
- A named owner and escalation path for AI Office requests.
- A current map of Articles 53 and 55 documentation and responsible evidence owners.
- Versioned records for model evaluations, safety/security controls and post-market monitoring.
- Traceable support for the public training-content summary and copyright-policy implementation.
- A factual-review process that checks completeness and consistency before information is submitted.
- Legal review of scope, confidentiality, business-secret handling and response deadlines.
External enforcement signals
The AI Office now has multiple channels feeding supervision.
The Commission has also opened an AI Act complaints tool, an anonymous whistleblower channel for eligible professionally connected persons, and a specific complaint route for downstream providers alleging breaches of GPAI obligations under Articles 53–55. These channels do not prove wrongdoing, but they increase the number of routes through which evidence can reach the regulator.
What remains uncertain
Do not infer enforcement outcomes that have not been published.
The public confirmation does not identify all recipients or establish that any recipient violated the AI Act. As of 5 October 2026, this article does not treat the requests as evidence of a fine, model restriction or final non-compliance finding. The material development is the move from available enforcement powers to their documented operational use.
Sources
Legal text, Commission channels and implementation context
Henna Virkkunen — public confirmation of formal AI Office information requests
AI Act Service Desk — Article 91
AI Act Service Desk — Article 101
European Commission — AI Act complaints tool
European Commission — AI Act Whistleblower Tool
European Commission — downstream GPAI complaints channel
Secondary implementation context: The EU AI Act Conversations — interview with AI Office Director Lucilla Sioli.