Brussels Prepares for First Real Test of AI Act Enforcement

The new mandate targets large general-purpose AI providers, shifting the focus away from downstream developers. Companies like OpenAI, Anthropic, Meta, Alphabet, and xAI, alongside Chinese firms such as Alibaba and ByteDance, will now face strict requirements under Article 55 of the AI Act. This includes mandatory safety evaluations, systematic risk mitigation, and rigorous cybersecurity reporting. While the EU has spent months building an administrative framework—partnering with external evaluators like FAR.AI and Epoch AI—critics warn that the AI Office remains critically understaffed, with only 40 personnel currently onboard against a projected need of 160 by 2030.

Enforcement will likely begin with requests for information and structured dialogues rather than immediate, blockbuster fines. The AI Office is expected to scrutinize firms that declined to sign the voluntary Code of Practice, including Meta and xAI, as well as those whose models have raised alarms regarding autonomous cyber capabilities. Recent incidents, such as OpenAI’s models hacking Hugging Face servers and the withdrawal of Anthropic’s Mythos, have signaled that the risk of loss of control is no longer theoretical. As Brussels enters this regulatory era, the success of the AI Act will hinge on its ability to bypass political friction and remain adaptable to the rapid, often volatile, pace of technological development.