EU AI Act Enforcement Powers Now Target OpenAI, Anthropic With Fines Up to €15 Million

Anthropic, OpenAI among firms facing new scrutiny under EU AI Act enforcement powers

Anthropic, the White House and the Department of Commerce have been approached for comment. Recent rapid leaps in AI capability have also brought new tensions between AI labs and the EU. The bloc had sought access to Anthropic's Mythos model for months before the company said it would share access. Europe's latest moves come as it scrambles to build up tech sovereignty to stop being so reliant on U.S. systems as tensions with the U.S. administration rise. The EU is in talks with OpenAI and Anthropic after recent cyber attacks by their models, Reuters reported on Friday. OpenAI confirmed it was in contact with the EU AI Office. The European Commission and Anthropic have been approached for comments on the report. Elisabetta Righini, partner at Sidley Austin, told CNBC the powers could be used on any company offering a general purpose AI [GPAI] model in the EU, regardless of where they were based. "A U.S. address does not put a lab outside the EU regulator's reach," she said. "Non-EU providers must also appoint an EU-based authorised representative as the regulator's point of contact." Exposure to risks from fines for AI companies is "real", Righini said. "What's rarely appreciated is that GPAI liability isn't limited to substantive breaches: refusing an information request, giving misleading answers, or blocking a model evaluation is fineable on its own," she added. While the new enforcement powers relate to the AI Act, the Commission has taken steps to clamp down on AI in the past. In January, the bloc said it opened an investigation into Elon Musk's X over the spreading of sexually explicit material by the AI chatbot Grok. "We've collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice, and will continue working together to help Europe realise the benefits of the Intelligence Age," Tom Gordon, VP, EMEA policy at OpenAI, told CNBC when asked to comment on the new powers. A Google spokesperson said: "As the Act and its codes of practice take effect, we remain dedicated to meeting all applicable rules as part of our primary mission: advancing European AI infrastructure and innovation."

E.U. AI Act enforcement powers target OpenAI, Anthropic, Google

The European Commission began enforcing the E.U. AI Act's rules for general-purpose AI models on Sunday, gaining new powers to inspect models, restrict access to the European market, and fine providers up to €15 million or 3% of annual turnover, whichever is higher. The enforcement powers, which took effect August 2, are administered by the Commission's AI Office and cover every company that makes a general-purpose AI model available in the E.U., no matter where that company is headquartered, according to CNBC. That puts U.S. companies including Anthropic, OpenAI, and Google $GOOGL among those subject to the new rules. Under the AI Act, providers of general-purpose AI models must document certain information and share it with competent authorities or downstream providers. They must also establish a copyright policy and publish a summary of the data used to train their models. Providers of the most advanced models, which the Act defines as those that may pose systemic risks, face additional requirements covering potential large-scale harms including cybersecurity threats and risks to fundamental rights, the Commission said. The enforcement regime also covers prohibited AI practices -- including systems that manipulate people, exploit vulnerabilities, or score individuals in ways that threaten their rights -- as well as new transparency requirements. Chatbots and other interactive AI systems must now tell users they are interacting with AI rather than a human, and AI-generated or altered content must carry machine-readable marks. Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy at the European Commission, said in a statement: "Harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale." Elisabetta Righini, partner at law firm Sidley Austin, said that exposure to fines is real and extends beyond substantive violations. "What's rarely appreciated is that GPAI liability isn't limited to substantive breaches: refusing an information request, giving misleading answers, or blocking a model evaluation is fineable on its own," she said. Righini also noted that companies headquartered outside the E.U. are required to designate a local representative through whom regulators can make contact. Tom Gordon, VP of EMEA policy at OpenAI, said in a statement the company would continue working with the Commission. "We've collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice, and will continue working together to help Europe realise the benefits of the Intelligence Age," he said. A Google spokesperson said the company remains committed to meeting all applicable rules. The E.U. has also opened discussions with OpenAI and Anthropic in the wake of cyber attacks that have been linked to their models, according to CNBC. The new enforcement powers arrive after months of tension between the bloc and U.S. AI labs over model access. Anthropic agreed to give the EU's cybersecurity agency ENISA access to its Mythos model after senior Commission officials traveled to San Francisco to press Anthropic leadership directly, following an earlier arrangement in which OpenAI offered the EU access to its GPT-5.5-Cyber model.