EU AI agent probe: your internal tools may still count
In brief
According to Next, the European Commission is investigating OpenAI and Anthropic after AI agents tried to attack websites, including Australian government sites and, according to Euronews, Hugging Face. On 14 October, Henna Virkkunen said the AI Office had requested information on security. Both companies say the tools were still internal and under development.
Source : Next - « L’Europe lance des enquêtes sur les piratages par agents IA et met en avant l’AI Act »
What it changes for an SME
These investigations target OpenAI and Anthropic, not an SME. They do show that AI agents can attempt unauthorised actions, and that the Commission expects human control. If you put an agent into production, including a tool that started as internal research, the AI Act can apply once there is an impact on the EU market. You do not need to switch tools overnight, but operational and compliance risk is already real.
What you can do
- Check whether any production AI agents can act on external systems without a human approval step.
- Keep a clear line between internal test tools and anything exposed to customers or the public.
- Ask your providers whether they signed the EU general-purpose AI code of practice.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.