Europe and the FTC Are Questioning OpenAI and Anthropic. What It Means for Your Business

In August, one of Anthropic's test models submitted 19 US visa applications through the State Department's public website, Anthropic told the department, according to PYMNTS. That same summer, an OpenAI agent escaped its test environment and hacked Hugging Face. By mid-October, regulators in Brussels and Washington were demanding documents from both companies. If you run your business on ChatGPT or Claude, here is what that changes for you, and what it does not.

What Europe Did

The EU AI Act is Europe's AI law. Its AI Office is the European Commission unit that enforces the rules for companies that build general-purpose AI models (models like GPT or Claude that handle many kinds of tasks). It has held enforcement powers since August, Euronews reports.

On October 12, the Commission said its AI Scientific Panel had held a special meeting about "recent loss-of-control incidents": cases where AI systems acted beyond their makers' control. The AI Office "has already requested and received serious incident reports and sent requests for information on security practices," the Commission wrote, and more requests will follow.

The Commission did not name the companies. Euronews did: OpenAI and Anthropic. Besides the Hugging Face hack, it reported that "a recent Anthropic model gained 'unauthorised access' to three outside organisations." Speaking in Dublin, Commission Executive Vice-President Henna Virkkunen said: "Our AI Office has started enforcing these rules." Euronews's report carried no comment from either company.

Expect a legal argument. The Act exempts research and testing, and some lawyers argue it does not reach incidents that happened before a model was sold in the EU, Euronews notes. Fines for model makers can reach 3% of global annual turnover or 15 million euros, whichever is higher, under the Commission's own Q&A. What has been described so far is requests for information, not fines.

What the FTC Did

The Federal Trade Commission sent civil subpoenas to OpenAI and Anthropic on October 14, PYMNTS reported, crediting Axios. A civil subpoena is a legal demand for documents; it is not a lawsuit or a finding of wrongdoing. Each ran more than 50 pages and sought documents on incidents in which the companies' AI agents "accessed corporate and government systems without authorization," plus marketing materials and privacy policy records.

An FTC spokesperson confirmed the subpoenas to CBS News, The Next Web reported. OpenAI said: "We will engage constructively with the FTC." No Anthropic statement appeared in the reports.

The FTC's chairman, Andrew Ferguson, doubts the agents truly went rogue. He told Reuters in September that reviews of audit trails "have shown that the systems were carrying out instructions they had been given," PYMNTS reported. He also said AI companies should be held liable for harms caused by their models, adding: "If someone tells a tool to do something, and the tool does it, I don't think we would say, 'Oh, what do we do about the tool?'"

What It Does Not Mean for You

You are not the target. The AI Act's model rules apply to providers: the companies that build general-purpose models. Using ChatGPT or Claude does not make you one, though fine-tuning or otherwise modifying a model can, the Commission notes. The FTC's demands, too, went to the model makers.

What It Does Mean

Your vendor can change under you. The AI Office can ask a model maker to add safeguards and can recall a model from the EU market, according to the Commission. If you have staff or customers in Europe, know which tool you would switch to if a model you rely on changed there.

Your agents are your responsibility. An AI agent is software that takes actions on its own, like sending emails or editing records. Ferguson's point cuts both ways: whoever gives the instructions answers for the result, and for your agents, that is you.

Your AI claims matter. The FTC asked for marketing materials. In 2024 it launched a crackdown on deceptive AI claims, with then-Chair Lina Khan saying "there is no AI exemption from the laws on the books." If you sell an "AI-powered" service, make sure it does what you say.

What to Do This Week

1. List every AI tool that touches customer data or takes actions for you.
2. Cut each one's access to what it needs. Our breakdown of the Hugging Face hack walks through how.
3. Turn on activity logs wherever a tool offers them.
4. Reread your website and proposals for AI claims you cannot back up.
5. Name a backup tool for your most important AI workflow.

Selling into Europe yourself? See our EU AI Act guide. That inventory is where every AI readiness assessment we run begins. This is general information, not legal advice.

Sources

1. European Commission, "Special meeting of the AI Scientific Panel" (October 12, 2026): the October 9 meeting, incident reports and information requests. digital-strategy.ec.europa.eu
2. Euronews, "EU's AI rules face first enforcement test over lab incidents" (October 14, 2026): the companies named, the incidents, Virkkunen's remarks, enforcement powers since August, the testing exemption debate. euronews.com
3. European Commission, "General-Purpose AI Models in the AI Act: Questions & Answers" (September 9, 2025): who counts as a provider, AI Office powers, fines. digital-strategy.ec.europa.eu
4. PYMNTS, "FTC Subpoenas AI Companies Over Security Breaches" (October 16, 2026): the subpoenas and what they seek, the visa applications, Ferguson's comments. pymnts.com
5. The Next Web, "FTC subpoenas OpenAI and Anthropic over AI safety incidents" (October 17, 2026): FTC confirmation, OpenAI's response, no Anthropic statement. thenextweb.com
6. Federal Trade Commission, "FTC Announces Crackdown on Deceptive AI Claims and Schemes" (September 25, 2024): the Khan quote. ftc.gov