The EU AI Office sent formal information requests to more than 30 AI providers on Sept. 1, exactly one month after its investigative and enforcement powers went live on Aug. 2. Commission spokesman Thomas Regnier confirmed the sweep to Agence Europe, marking the first concrete use of the tools the start of the AI Act’s enforcement era put in Brussels’ hands.

Two strands are running in parallel. One targets the safety and security of advanced models. The other, per Commission VP Henna Virkkunen, focuses on copyright and transparency, and singles out companies that skipped the AI Office’s informal compliance dialogues. Virkkunen told reporters Brussels is “ready to take all necessary steps” to enforce the Act. Fines top out at €15 million or 3% of worldwide annual turnover for GPAI breaches, and €7.5 million or 1% for RFI violations.

The escalation pattern matters more than the headline numbers. Wilson Sonsini notes the AI Office still treats technical compliance dialogues as its preferred first tool. The 30-plus RFIs are what happens when firms decline the quiet route.

For small businesses, the perimeter is wider than it looks. Article 50, whose chatbot and deepfake transparency rules going live framed the summer, reaches deployers, not just model providers. Any owner using generative AI for EU-facing outreach is inside it.

That’s the operational read on services like LemonLime, which prepares customer-growth work but requires the customer to approve and trigger every send. Human approval before dispatch preserves the oversight layer the framework expects of deployers.

The regulatory template of the 2018 GDPR rollout, whose extraterritorial reach quietly rewrote global product defaults, is the relevant precedent. The AI Act is following the same path, one RFI at a time.

Sources

Sources