Brussels Sends the Questionnaire

Brussels has started asking questions it has the power to punish wrong answers to. In its first use of the information-gathering powers that came into force August 2, the European Commission’s AI Office has sent formal requests to more than thirty general-purpose AI providers, asking how their models are secured, who tested them, what happens to them after deployment, and — for some — what went into the training data. The Commission has not named the recipients. Reporting has: OpenAI, Google and Anthropic are said to be among the companies that got the letters.

The legal instrument is Article 91 of the AI Act, and it is blunter than it looks. An information request is not an investigation, and the Commission has been careful to say so — no finding of wrongdoing, no presumption of guilt. But the obligation to answer is not optional, and the penalty structure makes it adversarial: incorrect, incomplete or misleading information can trigger fines of up to €15 million or 3 percent of global annual turnover, whichever is higher. The questionnaire arrives with a number attached.

What the AI Office wants splits into two tracks. The first is model security: how providers protect systems against attack, whether independent external evaluations exist, how models are monitored once they are in the world. The second is copyright and transparency: training-data summaries and the public documentation the Act requires of general-purpose providers. The first track reads like a direct response to the summer’s incident record — the wiki episode, the caged-model rollout, the hacking spree that already had the Commission in talks with OpenAI and Anthropic in July. The second reads like the industry’s oldest argument, arriving with statutory teeth.

The answers are compulsory. The fines are not theoretical. Brussels has stopped writing letters it cannot enforce.

The Envelope Is the Enforcement

The design of the AI Act’s enforcement is easy to miss from a distance: it is not primarily courtroom litigation, it is paperwork. The AI Office’s powers — information requests, model evaluations, corrective measures, fines — all run through documents the providers must produce on schedule. The companies that dominate this market are American, and their instinct in a regulatory encounter is to litigate. But a demand for information is not a claim to defend against; it is a condition of doing business in Europe, and every answer becomes a record that can be checked against the next one. The questionnaire is not a step toward enforcement. It is enforcement, in its first and cheapest form.

For the frontier labs, the questions are answerable but not comfortable. Security practices exist — sandboxed release tiers, misuse monitoring, external red teams, the incident-response framework OpenAI published after the wiki confirmation. But the paperwork asks for the boundaries: what is monitored, what is not, who has seen the weights, what happens when an evaluation fails. Every honest answer narrows a marketing claim. The training-data track is blunter still: summaries of copyrighted material ingested at industrial scale, written by the companies being sued for it in American courts.

The Commission has said it will not comment on individual recipients, and the deadline structure — legally binding response windows under Article 91 — means the answers, or the first refusals, will arrive on a deadline the companies do not set. Either way, the first enforcement record of the AI Act will be written by the companies themselves. Brussels has not fined anyone yet. It has done something more durable: it has made thirty-odd companies describe their own machinery, in writing, under penalty.

The American answer to all of this remains voluntary frameworks and a senate bill that asks nicely. The European answer arrived as envelopes. Thirty-one, thirty-five, “more than thirty” — the exact count will be disclosed in time. The precedent does not depend on the number.