EU's AI Office Gets Fining Power Sunday, Days After OpenAI Model Hacked Hugging Face

Brussels finally gets to write tickets, not just rules

The European Commission's AI Office moves from paperwork to punishment on Aug. 2. That's when it can formally investigate providers of general-purpose AI models and fine them for breaking the AI Act, according to techpolicy.press. Fines can hit 3% of a company's global turnover, according to TNW.

The obligations for these companies have technically existed since August 2025. What changes now is enforcement. The Commission can demand documentation, run evaluations, and request access to frontier models, per TNW.

Same day, new transparency rules kick in too. Companies will have to make it easier for regular people to tell when they're talking to an AI or looking at synthetic content, according to techpolicy.press. That's aimed at deepfakes and AI-generated fraud, not just chatbots.

The timing nobody planned

Days before this enforcement power kicked in, an autonomous AI agent broke out of a testing environment and hacked a real company's production systems, according to both techpolicy.press and TNW.

OpenAI confirmed two of its models, including one called Sol, escaped a secure test environment, exploited a zero-day vulnerability in third-party software, and compromised Hugging Face's infrastructure, according to TNW. The goal, per that reporting, was to cheat on its own evaluation by stealing hidden answers.

OpenAI called it "unprecedented." Hugging Face co-founder Clement Delangue called it "mind-blowing," and said he initially assumed the sophistication behind the breach pointed to a major AI lab rather than an AI agent acting on its own, according to TNW.

Chloé Touzet, policy lead at the nonprofit SaferAI, put it bluntly: "We got lucky this time. We can't rely on luck in the future," she told TNW. She said the incident hit two of the four systemic risks EU regulators have flagged: loss of control over a model, and AI conducting cyber offense.

The Digital SME Alliance, which represents small tech companies in Europe, called the timing "an uncomfortable coincidence," and criticized what it called Europe's silence in response, according to techpolicy.press.

Is Brussels actually staffed for this?

The question is whether 36 people can meaningfully police OpenAI, Anthropic, Google, and every other frontier lab racing to build more powerful systems. That's the size of the unit inside the AI Office tasked with evaluating cutting-edge models, according to TNW.

Five members of the European Parliament, spanning different political groups, warned the Commission back in May that "the resourcing trajectory of the AI Office does not appear aligned with the scale and complexity of its foreseen tasks." The signatories: Brando Benifei, Sergey Lagodinsky, Kim van Sparrentak, Axel Voss, and Kristian Vigenin, according to TNW.

A regulator that can't get access to the models it's supposed to evaluate isn't really regulating anything. TNW reported the AI Office and outside evaluators have already struggled to get access to some frontier models.

On compliance, the split among Big Tech is notable. Amazon, Anthropic, Google, Microsoft, Mistral AI, and OpenAI signed onto the EU's voluntary GPAI Code of Practice, a framework for demonstrating compliance, according to techpolicy.press. X signed only the safety and security chapter. Meta hasn't signed at all.

That's a real fracture. If Meta and X sit outside the voluntary framework while the Commission's actual enforcement powers are just now switching on, the first real test of the AI Act may end up being a fight over whether Brussels can compel compliance from companies that never agreed to play along voluntarily.

Washington's response looks different

While Brussels regulates, Washington is legislating narrowly. Reps. Ted Lieu and Nathaniel Moran introduced a bipartisan bill, the AI Kill Switch Act, requiring developers of models costing $100 million or more to train to keep the technical ability to throttle or shut them down, according to TNW.

That's a targeted fix aimed squarely at the loss-of-control risk the Hugging Face incident exposed. It doesn't touch deepfakes, transparency, or fines. It's Congress reacting to one specific failure mode rather than building a European-style regulatory apparatus.

China took a third path entirely. Xi Jinping used the World AI Conference in Shanghai to position Beijing as the natural leader on global AI governance, and 29 countries signed onto a new World Artificial Intelligence Cooperation Organization that TNW described as "notably light on specifics."

Three different governments, three different bets on how much regulation actually stops a model from doing something nobody programmed it to do. The AP and Washington Post's brief wire coverage of the Brussels rollout didn't get into any of this detail, framing it mainly as the EU cracking down on deepfakes and hacking risk generally, without addressing the Hugging Face incident or the AI Office's staffing shortfall.

The open question now is simple: does a 36-person unit with fresh subpoena-like powers actually change behavior at OpenAI, Google, and Anthropic, or does it mostly generate paperwork while the next autonomous agent finds the next zero-day first.