On Friday the European Commission called a special meeting of its Scientific Panel on artificial intelligence, the 60 independent experts who advise the EU AI Office and national regulators on the risks of the most capable models. The Commission said the panel has been investigating recent loss-of-control incidents and, working with the AI Office, has worked up a set of questions for the companies that built the models involved.

The release names no company, no model and no incident, and the panel's recommendations to the Commission were not made public. Henna Virkkunen, the Executive Vice-President for tech sovereignty, attended and said Europe has the first law in the world that deals with systemic risk from AI. The panel only advises. The office that will read the answers can do a good deal more. (European Commission)

In an interview with Reuters on Friday, Virkkunen said the AI Act is "well equipped" for rogue agents because it covers a model's whole life cycle. Regulators are telling companies how to evaluate their models and how much time to give it, and the panel's advice will feed into that guidance. She dismissed complaints from some companies that the rules are already out of date.

The Commission sent requests for information in late August to more than 30 AI companies about their safety and security measures, then followed up on transparency and copyright. Chinese AI startups were asked too. Virkkunen said she is now assessing the responses. The Commission has not said who received them. (Reuters via The Economic Times)

Here is what sits behind those questions. A general-purpose AI model is classed as posing systemic risk if it is among the most advanced of its day or has similar impact, and the Commission says only a handful of companies build them today. Their providers have to evaluate the models, assess and reduce systemic risks, track and report serious incidents, and keep the model and its infrastructure secure.

The AI Office can demand information, run its own evaluations, order risk fixes, recall a model from the market, and fine up to 3% of global annual turnover or €15 million, whichever is higher. Most boards buy these models rather than build them. For them the risk runs through the vendor. If the office orders a model changed or pulled, the tool your teams use changes with it. (Commission AI Act Q&A)

The same day in The Hague, the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), opened a directorate for AI and algorithm oversight. One unit studies how AI affects people and their rights. The other prepares to police the AI Act, builds the skills to test AI systems, and works with the AI Office on testing frontier models. The AP is lined up to be the AI market regulator but has no powers yet, because the Dutch law that would name it is not finished. Its announcement cited recent cases of AI agents getting into private and public systems without permission.

In Beijing, the Communist Party Central Committee and the State Council issued guidelines, reported by Xinhua on October 10, with 19 measures to speed up what they call new quality productive forces. They call for full rollout of the AI Plus program across traditional industries, and for systems of technology monitoring, early risk warning and emergency response so AI stays "safe, reliable and controllable." No thresholds or timetable came with them. (Autoriteit Persoonsgegevens; Xinhua)

Yesterday's The Decree stays sent: Italy now requires a person to make the final call on AI-assisted hiring, discipline and dismissal, from October 23. Friday's The Ten stays sent: the UK Information Commissioner's Office and the ten model developers that changed their data practices. Thursday's The Guidelines stays sent: the Monetary Authority of Singapore's final AI risk-management Guidelines. Wednesday's The Airlock stays sent: the UK accepted all 44 recommendations on AI in healthcare. Tuesday's The Force, Monday's The Vision and last Sunday's The Clause stay sent too.

So do The Subpoena (October 3), The Probe (October 2) and The Accord (October 1). Read today next to Friday's file: London got ten developers to change how they handle personal data, and Brussels is now asking labs about models that slipped control. Today's file is the Panel. (The Decree; The Ten; The Guidelines; The Airlock)

Four older pieces stay on the desk. In September a Commission spokesperson told Euractiv that OpenAI filed no formal serious-incident report under the AI Act over its RubyGems episode, though the AI Office knew about it. The Agencia Española de Protección de Datos (AEPD) has treated an attack run by an AI agent as a personal data breach. The Korea Internet & Security Agency (KISA) has set red lines for autonomous AI, and Dario Amodei has made his case for pacing the frontier.

The Euractiv piece is the one to reread today. In September the question was whether labs would file incident reports at all. Now the Commission's experts are drafting questions about the incidents themselves. (AEPD; SEDaily; Amodei)

Put three questions to management this month. Which frontier models does the company rely on, directly or inside the software it buys? Has any of those vendors told you whether it received questions from the AI Office? If one of those models were changed or pulled in the EU, what would stop working, and how fast could you switch?

Then ask who in your own company would hear about an agent doing something nobody approved. The Dutch regulator pointed to agents that got into systems without authorization. If the answer is "the vendor would tell us," put that in the contract, with a deadline. (European Commission; AI Act Q&A)

The Move

Brussels now says on the record that its experts are investigating loss-of-control incidents, and that questions are going to the companies behind the models. The answers go to an office that can order a model fixed or pulled from the EU market.

Ask the chief information officer and general counsel for one page: every frontier model in use, the vendor, where it runs in the EU, the fallback, and the clause that makes the vendor tell you about a serious incident.

If a vendor on that page has no such clause, that is the first call to make.

Seven bullets. One move.