EU AI regulation is finally getting real.

In the first week of September, the EU AI Office, under the newly enforced AI Act, sent formal Requests for Information (RFI) to more than 30 frontier AI companies worldwide. The list includes familiar names like OpenAI, Google, Anthropic, and Meta, as well as some Chinese and Middle Eastern model companies. The questions cover model safety measures, independent expert evaluations, and post-deployment monitoring mechanisms.

This isn't "sending a survey to learn more" kind of inquiry. This is a formal enforcement action issued under law — companies are obligated to respond within the specified timeframe, and failure to respond or false responses carry legal consequences.

This is the first formal enforcement action since the EU AI Act's enforcement powers officially activated on August 2. The boot has dropped, and it's faster and heavier than many expected.

Why Is the EU the First to Act?

Among the world's major economies, the EU isn't the strongest in AI technology, nor does it have the most AI companies — but it's the first to put AI regulation into practice. The reason is practical: the EU doesn't have home-court advantage in AI technology, but it has home-court advantage in rule-making.

America has OpenAI, Google, Anthropic, Meta — the strongest tech. China has Baidu, Alibaba, ByteDance, iFlytek — the most applications. What about the EU? No frontier model companies that can compete, no particularly large AI application ecosystem. But the EU has one thing others can't match: a unified market of 450 million consumers, and a mature regulatory system.

Since it can't catch up technologically, it's positioning itself through rules. The EU established global rules on data privacy with GDPR back in the day, and now it wants to use the same playbook for AI regulation — using its market size and legal system to turn its rules into global standards.

Will this strategy work? Hard to say. But one thing is certain: any AI company that wants to do business in Europe has to follow EU rules. Whether you're American or Chinese, if you serve EU users, you're subject to EU regulation. That's the weight of a 450-million-user unified market.

What's the First Round of Enforcement Checking?

The core content of this RFI is focused on several key issues:

First, how the model's safety assessment was conducted. Was red-teaming done? What risk domains did testing cover? What were the test results? This is the most basic question, but also the one where problems show most easily. Many companies' "safety assessments" are just going through the motions — they might not actually have detailed data to show.

Second, whether independent third parties participated in the assessment. The EU clearly favors "independent expert evaluation," not companies testing themselves. If this is enforced properly, it will greatly increase the credibility of safety assessments — but it will also greatly increase the cost and time of getting models to market.

Third, post-deployment monitoring mechanisms. After the model goes live, is abuse continuously monitored? Are new risks being discovered? How are issues handled once found? This is the weak spot for many companies — lots of safety testing before launch, then nothing once it's live.

These questions all seem like technical issues, but they're actually legal issues. If a company's answers don't satisfy the EU, the next step could be formal investigation, fines, or even restrictions on service in the EU. The fine cap is 6% of global turnover — for hundred-billion-dollar companies, that's billions of dollars.

A Watershed for Global AI Governance

The EU acting now marks one thing: AI's "wild west" phase is officially over.

For the past several years, frontier AI companies have basically been in a "self-regulating" state. What models to build, how to launch them, what risks they carry — it was all basically up to the companies themselves. Safety frameworks were voluntary, testing standards were self-defined, evaluation results were self-published.

Now it's different. There's a regulator with a 450-million-user market, legally demanding answers, with the power to fine. That's a qualitative change.

What happens next? Probably something like this:

In the short term, big companies will comply — they'll respond, they'll adjust. 6% of global turnover in fines is no joke. Smaller companies may complain about compliance costs being too high, but there's no way around it.

In the medium term, other global regulators will follow suit. The US is already working on its own safety testing framework, and China has its filing system. The EU moved first, others won't fall far behind. Eventually there will be a "regulatory race" — whoever's rules are more reasonable and more enforceable will hold the high ground.

In the long term, AI regulation will become an international issue. Because models are borderless — a model trained in the US, used in Europe, deployed in China — who has jurisdiction? There's no simple answer to that question, but someone has to answer it.

Pachocki said "nobody is prepared." The EU at least took the first step. Whether the preparation is adequate is one thing. Whether you act is another.

See you tomorrow.