AI News · The messy stuff ·
EU Commission says AI Act can cover testing incidents affecting its market
The European Commission says the AI Act can reach companies during testing when a loss-of-control incident affects the EU market. It pointed to powers to demand information and address such incidents, rather than suggesting every testing accident automatically triggers enforcement. Lawmakers and experts have questioned accountability gaps and regulators' capacity to act.
Key points
- The Commission says testing-stage loss-of-control incidents can fall under the AI Act when they affect the EU market.
- The EU has sent more than 30 information requests covering copyright, cybersecurity and safety.
- Lawmakers question accountability gaps after the EU shelved plans for AI liability rules.
- The EU’s AI Office has around 125 staff; critics want more resources and technical expertise.
What happened: The European Commission says the EU’s AI Act can reach providers during testing if a loss-of-control incident affects the bloc’s internal market, according to AFP reporting published by Yahoo News. The position challenges the assumption that pre-release development is necessarily outside regulatory scrutiny. It is also narrower than saying every testing accident automatically triggers enforcement: the Commission linked its authority to a loss of control with an impact on the EU market.
The details: EU spokesman Thomas Regnier said the law can be enforced against providers “starting from the testing phase” in those circumstances, including incidents involving cyberattacks or biological or chemical misuse. The AI Act requires companies to assess and mitigate risks, with potential penalties including fines or bans. The EU has sent more than 30 requests for information covering issues such as copyright, cybersecurity and safety. Those requests are preliminary steps that can lead to investigations, rather than evidence that an infringement has occurred. Regnier declined to disclose details of the requests.
Background: The EU agreed the AI Act in 2024, but questions remain about how its safeguards interact with accountability for harm. Four EU lawmakers, including lead AI Act negotiator Brando Benifei, warned of legislative gaps after the bloc shelved plans for AI liability rules. Those rules would have made it easier to hold providers accountable for harm caused by their tools. The lawmakers argued that current rules leave research, testing and development uncovered. The Commission rejected that claim, pointing to its powers over testing-stage incidents affecting the EU market.
Who it affects: For teams developing or evaluating AI before deployment, the Commission’s position makes incident documentation and assessment of potential EU impact worth attention during testing, not just at launch. The unresolved question is not only whether regulators can intervene, but who ultimately bears responsibility for harm. Harshvardhan Pandit of Trinity College Dublin’s AI Accountability Lab said accountability remains unclear when a model hacks a website after its tools have been sold. He also noted that developers must have addressed safety risks by the time a model reaches the market.
What to watch: Enforcement capacity remains a concern. The EU’s AI Office employs around 125 people, and both Benifei and Pandit called for more resources and technical expertise. Access to models can also complicate oversight: AFP reported that US export controls delayed EU testing of Anthropic’s Mythos for months. The reporting did not identify a specific enforcement action against a testing-stage loss-of-control incident. For business teams, the key distinction is between the Commission asserting legal authority and demonstrating how it will exercise that authority in practice.
Our take
Teams should not assume pre-release testing falls outside regulatory scrutiny. Incident documentation and assessments of potential EU impact deserve attention before deployment.