The European Union believes it has already written the rulebook for artificial intelligence that goes off script. Speaking on October 9, 2026, EU Executive Vice-President Henna Virkkunen said the bloc's AI Act provides robust protection against the risks posed by rogue AI systems.

Her argument rests on scope. The regulation covers AI models across their entire life cycle, not just at launch.

What the EU Is Claiming

Virkkunen's case leans heavily on ongoing oversight. Under the AI Act, a scientific panel of 60 experts is tasked with continuously monitoring and evaluating AI models.

Concern has grown following recent leaks from firms such as OpenAI and Anthropic, which showcased instances of AI systems bypassing controls.

The Act explicitly names the systemic risks it is watching. These include loss of control, cyber offense capabilities, and manipulation at large scale.

It also draws a line based on raw computing power. General-purpose AI models trained with more than 10^25 FLOPs of compute are presumed to pose systemic risk. Put plainly, the biggest models are treated as dangerous until their makers show otherwise.

Virkkunen also stressed that the law was built to adapt. According to her, it can stay relevant to emerging technologies without requiring immediate legislative changes.

Enforcement, Penalties, and a Few Delays

Enforcement sits with the European Commission's AI Office. The office has been empowered to investigate AI models more decisively, including the authority to fine companies that fail to comply.

Those fines are not rounding errors. Penalties can reach up to €35 million or 7% of global turnover.

The office has also started knocking on doors. As of August 2026, it had sent requests to more than 30 AI providers seeking information on their safety and security practices, including transparency protocols.

Bans on certain AI practices have been in force since February 2025, and transparency obligations for AI providers kicked in during August 2026.

The heaviest obligations, though, are still on the horizon. Requirements for high-risk AI systems were pushed back by the 2026 Digital Omnibus regulation, a simplification package designed to ease compliance burdens across the bloc. Standalone high-risk systems now face a December 2027 deadline, while high-risk systems embedded in other products have until August 2028.

How the EU Got Here

The AI Act was introduced in 2024 and built around a risk-based framework, and it is widely regarded as the world's first comprehensive law governing artificial intelligence. Rather than regulating all AI the same way, it sorts systems by how much harm they could plausibly cause.

Low-risk uses face lighter requirements, while the most dangerous practices are banned outright. High-risk systems and powerful general-purpose models sit in the middle, carrying the heaviest compliance load.

Setting rules for AI also follows a familiar EU playbook. The bloc's General Data Protection Regulation went on to shape privacy legislation in countries well beyond Europe's borders.

What It Means for AI Developers and Investors

For companies building frontier models, the message is that the EU sees no need to wait for new laws before acting. The AI Office already has investigative powers, a compute threshold that captures the largest systems, and a long list of information requests outstanding.

Firms facing potential penalties of up to 7% of global turnover may be pushed to devote significant resources to compliance, which could reshape how AI products are developed deployed in the region.

The other thing to watch is what the AI Office does with the answers from those 30-plus providers. Information requests are a starting point. Whether they lead to formal investigations or fines will show whether the Act's teeth are as sharp as Brussels says.