Agent incidents become a compliance question

The most important development this week came from the European Commission rather than from a court or a new law. Speaking in Dublin on 14 October, Executive Vice-President Henna Virkkunen said the AI Office has started enforcing the AI Act’s rules for general-purpose AI models. It has sent requests for information on security, external evaluation and how models are used. She tied this directly to incidents over the summer in which AI agents escaped their environments, inserted malicious code and deceived humans.

The requests go to providers. Media reports, via Euronews and Leto, name OpenAI and Anthropic, though the speech itself names no one. My read is that this changes the conversation for deployers too. Once agent incidents are treated as a compliance matter, the questions travel down the supply chain. Expect your suppliers, auditors and procurement teams to ask what agents you run, what they can reach, who approves sensitive actions and whether your logs could reconstruct what happened, including for a GDPR breach assessment.

The stakes for providers are concrete. Under Article 91, incorrect or incomplete answers can be fined up to 3% of global turnover or EUR 15 million. One open question worth following is whether the Act’s exemption for pre-market testing covers incidents that happen during tests.

The same questions, from a different direction

The EU story did not stand alone. According to a Reuters report summarised by Resultsense, bank supervisors in the UK, the US and the euro area are pressing lenders on how AI agents are limited, audited and switched off. The Federal Reserve, OCC and FDIC are asking about limits on agents, approval of agent actions, auditability and human oversight. The ECB gave lenders until the end of October to produce plans against AI-enabled cyber threats and to map AI use, including third-party suppliers, so systems can be stopped and restarted in a controlled way.

None of this is formal rulemaking yet. The UK approach is described as collaborative and the US is still fact-finding. But I think the list is effectively the control framework for agents: inventory, permissions, approval steps, audit trail, human oversight and a tested stop-and-restart. If you hold an AI register, the question is whether it records what each agent can do, not just that it exists.

There is a neat link to Anthropic’s own announcement this week. It has given six METR evaluators employee-like access and the right to publish, and explicitly compares this to resident examiners in large banks. Its criteria for evaluators (expertise, financial independence, sufficient access and freedom to publish) work as a checklist for assessing any AI supplier’s assurance claims. External evaluation is also one of the topics in the AI Office’s requests. One caveat: Anthropic still decides what falls into the redaction categories, and our summary rests on the company’s own account.

Statements versus practice

The second theme of the week is the gap between what organisations say about data and what they do. New Mexico has announced a $25 billion penalty against Meta after a jury found 43,899,725 violations of the state’s Unfair Practices Act, covering Meta’s statements and practices on third-party data access, user privacy and harmful content. This is based on EPIC’s secondary report, and the source does not say whether Meta will appeal.

Two lessons stand out for me. First, a general consumer-protection statute was enough; no dedicated privacy law was needed. Second, per-violation counting turns old, misleading statements into very large exposure, years after the conduct. If your privacy notice describes how partners access data, someone should be able to evidence the controls behind each sentence.

Meta featured again, in a smaller way. It removed language from its commercial terms that critics read as permission to use website content for AI training and to override robots.txt. Meta says its crawling practices have not changed and the terms applied only to ads and business products. Whatever the intent, the episode shows that usage rights increasingly live in platform terms. Tracking terms changes belongs in data governance, not just legal review.

Lock-in as a governance issue

Finally, the CMA has proposed strategic market status for Microsoft’s business software, with a final decision due by the February 2027 statutory deadline. Its roadmap covers whether customers can freely choose AI tools other than Copilot, security bundling and cloud licensing. Microsoft and AWS have already removed data transfer fees for customers switching provider. I think architecture teams planning 2027 platform decisions should read the consultation: exit costs and the freedom to combine third-party governance and security tooling are governance questions as much as commercial ones.

What I’m watching

• Meta will publicly announce an appeal or file a post-trial challenge to the New Mexico penalty by 31 January 2027.
• The Commission or AI Office will publicly confirm a further formal step against a general-purpose AI model provider (another information request, an evaluation or proceedings) by 31 March 2027.
• METR will publish its first analysis under the embedded Anthropic arrangement by 30 April 2027.