Key Highlights

  • The European Commission gained new powers effective Sunday to evaluate AI models before public release, restrict EU market access and fine providers up to 15 million euros or 3% of annual turnover.
  • The powers apply to any company offering a general purpose AI model in the EU regardless of where the company is headquartered, with non-EU providers required to appoint an EU-based representative.
  • The rollout follows a 1 billion dollar fine against Google (NASDAQ:GOOGL) in July over preferential treatment of its own services, which prompted a tariff threat from President Trump.
  • The EU is separately in discussions with OpenAI and Anthropic following recent cyberattacks involving their AI models, according to a Reuters report.

New Enforcement Authority Marks a Staggered Rollout of the AI Act

The European Commission's new supervisory and enforcement powers over general purpose AI models took effect Sunday, granting the bloc's executive arm authority to demand evaluation of models before their public release in the region, restrict market access and impose fines of up to 15 million euros or 3% of a provider's annual turnover, whichever figure is higher. The powers form part of a staggered implementation of the 2024 EU AI Act, which has included a transition period for certain provisions of the law.

The Commission's executive vice-president for tech sovereignty, security and democracy said in a statement that harms can occur when AI is not properly designed and used, adding that the most advanced models create risks on an entirely new scale. The statement reflects the Commission's stated rationale for extending direct evaluative authority over model providers rather than relying solely on post-market enforcement mechanisms.

Scope of Authority Extends Beyond EU-Based Companies

The new powers apply broadly to any company offering a general purpose AI model within the EU regardless of where that company is headquartered, with non-EU providers required to appoint an EU-based authorized representative to serve as the regulator's point of contact. This extraterritorial reach means American AI developers, including Anthropic, OpenAI and Google, fall within the Commission's enforcement scope despite operating primarily from the United States.

The rollout arrives amid separate and escalating friction between the EU and major U.S. technology companies. Google was fined 1 billion dollars in July after European regulators found the company had given preferential treatment to its own services, a decision that prompted President Trump to threaten the EU with a substantial tariff in response. The EU had also previously sought access to Anthropic's most advanced model for months before the company agreed to share access in June.

Ongoing Discussions Following AI-Related Security Incidents

The European Union is separately in discussions with OpenAI and Anthropic following recent cyberattacks involving their AI models, according to a Reuters report citing EU officials monitoring high-risk AI systems. OpenAI confirmed it was in contact with the EU AI Office regarding the matter. These discussions run alongside, but separately from, the Commission's newly effective inspection and enforcement powers under the AI Act.

Both OpenAI and Google issued statements affirming their commitment to compliance as the AI Act and its associated codes of practice take effect. OpenAI's Europe, Middle East and Africa policy representative said the company has collaborated closely with the Commission on implementing the AI Act and would continue working together as the framework develops. A Google spokesperson said the company remains dedicated to meeting all applicable rules while advancing European AI infrastructure and innovation.

Conclusion

The activation of the Commission's new inspection and enforcement powers marks a significant escalation in the EU's regulatory reach over AI model providers, extending direct evaluative authority beyond the bloc's borders to any company serving EU users. Combined with recent fines against major U.S. technology companies and ongoing security-related discussions with leading AI labs, the new framework signals an increasingly assertive regulatory posture as Europe pursues broader technology sovereignty objectives. How U.S. AI developers adapt their compliance structures in response is likely to shape the practical impact of these powers in the months ahead.