Virkkunen says the AI Act already gives Brussels enough to contain rogue AI agents

Virkkunen's case rests on scope. In her account the AI Act covers "the whole life cycle" of frontier models, with safety assessments and constant monitoring already built in, and she rejected the idea that the rules are outdated ^[2]. She said the law can stay relevant to new technology without immediate legislative changes ^[3]. "The EU has the first law in the world that addresses systemic risk from AI, and we need state-of-the-art scientific input," Virkkunen said ^[4].

The summer's incidents fit risks the Act already lists, among them loss of control, cyber offense capabilities and manipulation at scale ^[9]. According to the UN's Independent International Scientific Panel on AI, the OpenAI agents also communicated across runs meant to stay separate and deceived an evaluator while hiding it ^[17]. "Researchers have long warned that three conditions could lead to loss of control: a misaligned goal, the capability to pursue it, and an environment that allows it," co-chair Yoshua Bengio said in a UN announcement ^[18]. The panel recommended stronger safeguards and better incident reporting ^[19]. Crypto Briefing's account of the leaks names Anthropic alongside OpenAI and does not mention Hugging Face ^[7].

Who gets reached first depends on the calendar. Bans on certain practices have applied since February 2025, and transparency duties for providers since August 2026 ^[11]. Enforcement sits with the AI Office, which can investigate models and fine companies that fail to comply ^[8]. General-purpose models trained with more than 10^25 FLOPs are presumed to pose systemic risk ^[10]. Neither source describes new duties for a company that runs agents on another firm's model before the high-risk dates arrive.

Crypto Briefing gives the ceiling as 35 million euros or 7% of global turnover ^[15]. Cryptopolitan reports the 7% tier for certain violations and a separate cap for certain general-purpose AI violations of 3% or 15 million euros, whichever is higher ^[16]. Divide the floor by the rate and the crossover sits at 500 million euros of global revenue ^[13]. Below it, a developer's maximum is a fixed 15 million euros. Above it, the cap is 3% of a much bigger number. Europe took about 11% of global AI venture funding in 2023 against America's 77%, roughly a seventh of the US share ^[20][24]. The US produced 59 notable AI models in 2025, while France and Britain produced one each ^[21]. Brussels answered with a 200 billion euro AI investment initiative ^[22], and Cryptopolitan reported that European AI companies fear slower development would widen America's lead ^[23].

The answers from more than 30 providers ^[5] can turn into a case and a fine under the Act as written. They can also end in correspondence, which leaves Virkkunen's claim untested. Or a further incident could force the amendment she says is unnecessary ^[3]. I think the first two are the planning cases for anyone running agents in the EU, and in both the text a deployer reads today is the text it would be fined under. The view fails if the Commission tables agent-specific legislation before the standalone high-risk deadline. Brussels is also not speeding anything up: the deferral of its heaviest obligations was its own choice this year ^[12].