The EU’s fight to regulate AI models entered a new chapter on 2 August 2026, when the European Commission’s AI Office and national authorities began enforcing the AI Act.
The AI Act is the EU’s law regulating AI, the first broad legal framework of its kind. It creates a common set of rules for AI systems used or sold in the EU, with the goal of encouraging innovation while protecting people’s safety and fundamental rights.
In recent weeks, we’ve witnessed powerful AI models managing to breach systems despite oversight. An OpenAI benchmark model escaped its sandbox and breached Hugging Face’s infrastructure hunting for test answers.
Then, on 30 July, Anthropic disclosed that three of its Claude models had breached real organizations during cybersecurity evaluations, after a misconfiguration left supposedly isolated test environments with live internet access.
These are precisely the incidents Brussels is trying to get ahead of, and the reason its enforcers now have the power to hold the world’s largest AI companies accountable. With fines reaching €15 million or 3% of worldwide annual turnover, whichever is higher, the penalties should be enough to get even the largest providers’ attention.
However, Edwin Weijdema, Field CTO at Veeam, expects corrective orders to outnumber major financial penalties during the first year of enforcement, drawing a comparison to how GDPR and NIS2 played out early on. He said the bigger risk likely won’t be the fine. It’ll be getting told to stop using a system until compliance can be proven, a disruption he argues could hit harder than a one-time penalty.
To make enforcement work in practice, the AI Office rolled out several tools aimed at individuals and businesses.
Complaints tool
The AI Act complaints tool allows individuals and organizations to report suspected violations by providers or deployers of AI systems under the Office’s authority.
The Commission describes it as a way for people to “support and strengthen the rule of law.”
Complaints must fall within Article 85 of the AI Act, ruling out issues tied to national laws, other EU legislation, or GPAI model obligations covered separately under Articles 53 to 55.
The process is not anonymous. Applicants must submit identification and contact details along with a description of the incident and the country where it occurred, in any official EU language.
Once filed, a complaint receives a reference number, and the AI Office reviews it confidentially, with the option to forward it to a national market surveillance authority if warranted.
Whistleblower Tool
This one is built for people with inside knowledge, engineers, contractors, compliance staff, professionally connected to providers of general-purpose AI (GPAI) models or of AI systems falling within the AI Office’s enforcement remit, meant to help “make AI in Europe safe, transparent, and trustworthy.”
If you’ve seen something that could endanger fundamental rights, health, or public trust, this is the channel designed for you.
The standout feature is anonymity. You submit your report, in any EU language, through a secure inbox that also lets you track its progress and answer follow-up questions without ever revealing your identity.
Alongside the secure tool, the AI Office has committed to a high standard of confidentiality, with documented internal procedures meant to protect whistleblowers’ identities.
The downstream complaints channel
This channel is narrower and more technical. It’s for downstream providers, companies that build an AI system on top of someone else’s general-purpose AI model, who suspect the underlying model provider has infringed Articles 53 to 55 of the AI Act.
Under Article 89(2), these providers can lodge a complaint with the European Commission.
This concerns obligations for providers of all GPAI models, covering:
- technical documentation obligations
- information owed to downstream providers
- copyright policy
- publishing a summary of training data
- incident reporting and cybersecurity
- risk evaluation for the most advanced, systemic-risk models
To file, you explain why you qualify as a downstream provider, lay out a reasoned case, and attach supporting evidence where you can. The completed and signed form goes by email to the AI Office’s downstream provider complaints address.
Like the general complaints tool, this channel isn’t anonymous, and it isn’t meant for issues that fall under the AI Office’s other complaint routes.
Whether any of this actually takes hold remains to be seen. Most seem to agree that AI models need firmer regulatory oversight, though a smaller share worry it’ll leave European companies falling further behind in the race against American and Chinese rivals.