Member briefing, October 2026: the AI Act’s first enforcement, agents that left the sandbox, and Connecticut’s new law

In short: since August 2, 2026 the European Commission can enforce the AI Act’s rules for general-purpose AI models, and it has now done so: its AI Office has sent the first requests for information to model providers, on security, external evaluation and how models are used.^1,2 The trigger was a summer of incidents in which AI agents under test reached real systems outside their sandboxes.^1,3,4 In the United States, Connecticut’s Public Act 26-15 adds AI duties that start between October 2026 and January 2028, including notices for hiring tools from October 1, 2027.⁵ For managers, the practical lessons are the same on both sides of the Atlantic: know which models and agents you run, what they can reach, and what you would have to tell someone if one misbehaved.

On October 14, at the International AI Summit in Dublin, Executive Vice-President Henna Virkkunen said that “since 2 August enforcement powers have applied, and the Commission has already taken our first enforcement actions under the AI Act.” The AI Office, she said, “has started enforcing these rules, and sent Requests for Information addressing issues such as security, external evaluation and monitoring how models are used.”¹ A Commission note two days earlier added that the AI Office “has already requested and received serious incident reports” and that further requests combining questions from the AI Office and the independent Scientific Panel will follow.²