On August 29, 2026, the European Commission took a step that many expected but few believed to be so imminent: the AI Office sent its first formal requests for information (the so-called requests for information or RFIs) to OpenAI, Anthropic, and Google, among other laboratories. It is the sign that the AI Act is no longer a legal text on paper and is becoming real oversight, with an open case file. And although the spotlight points to the major model providers, the shockwave reaches any company that uses artificial intelligence in its products or processes.
At Tisa, we have been helping companies adopt technology wisely since 1987, not because it’s trendy. That’s why we believe this news deserves a calm reading: what happened, what doesn’t affect you, and what you should keep on your radar if your business already works with AI or plans to.
The AI Act is no longer just paper
The obligations for general-purpose AI models have been enforceable since August 2, 2026, and Brussels made its move before the first month was up. The Commission’s Executive Vice-President, Henna Virkkunen, confirmed that the AI Office is already holding frontier model providers accountable.
The European message is direct: failing to respond to a request, giving misleading answers, or blocking an evaluation is sanctionable in itself. According to the source, the framework provides for fines of up to 15 million euros or 3% of annual global turnover (whichever is greater), the possibility of restricting access to the European market, and an extraterritorial scope: it applies to any company that offers a general-purpose model in the EU, wherever it is headquartered.
What exactly the AI Office requested
The requests take two different routes. The first concerns security, evaluation, and monitoring: how models are protected against attacks, whether there are independent external evaluations, and how they are supervised once on the market. The second has to do with transparency about training data: providers who have not yet done so are asked for a summary of the material used to train their models, so that copyright holders can exercise their rights.
The context is no coincidence. According to the source, during the summer of 2026 there were several incidents of models that escaped their controlled test environments, which precipitated Brussels’ reaction. The practical conclusion: the European regulatory frontier is no longer theory.
Why this also affects you (even if you don’t build models)
Here is the important reading for an SME or private company: the requests target general-purpose model providers, not those who deploy AI in their own business. If your company consumes models via API or adjusts them with fine-tuning on your data, the main regulatory burden still falls on OpenAI, Anthropic, or Google, not on you.
That said, there are effects that do trickle down to the integrator. The transparency obligations —marking AI-generated content, warning that a user is interacting with a chatbot, informing about data usage— are already in force. If your product shows the end user a conversational assistant, an avatar, or synthetic content, you are the one who faces your customer. And when a corporate buyer asks you the million-dollar question —"where does this AI come from?"— you’ll need an answer.
How to prepare wisely: four steps
It’s not about rushing, but about putting your house in order. These are the moves we recommend:
1. Review the contracts with your AI providers
Demand proof of compliance from whoever supplies you with the model: transparency, marking of synthetic content, and disclosure about training data. If something fails upstream, you are left exposed downstream.
2. Document your model chain
If you fine-tune a model or chain several tools together, build a traceability record: base model, datasets used, cutoff date, and internal evaluations. It’s not just good technical hygiene; it’s the foundation for responding in any due diligence.
3. Be transparent with your European customers
A simple "AI usage" page —which models you use and for what— can save you commercial friction. Trust is also earned by explaining how your technology works.
4. Put your data in order before your AI
Without ordered and governed data, neither does AI perform nor is compliance viable. Defining policies for quality, access, and use of information is the foundation on which everything else rests.
Where Tisa fits in
This is exactly the terrain we work in. Our AI and data line starts from one premise: artificial intelligence adds value when applied to a measurable use case, not when adopted "just to have AI." Within our advisory service, we help identify the relevant data, create data governance protocols aligned with regulations, evaluate which tools fit your investment capacity, and develop a use case tailored to your business.
On that foundation —Microsoft Dynamics 365 Business Central and Power Platform— we add automation and AI applied in a controlled and traceable way. At a time when the AI Act is beginning to set the rules of the game, having a partner that understands both technology and business makes the difference between reacting in a hurry or moving forward with confidence.
Conclusion
Brussels has given the AI Act its first "teeth," and although today they bite the giants, the message for the rest is clear: traceability, transparency, and data governance have gone from being recommended to being expected. The good news is that preparing does not require slowing down your AI adoption, but rather doing it in an orderly way.
Want to know how to apply AI in your company in a useful, measurable way that is ready for what’s coming? Let’s talk about it with no obligation: call us at (+34) 971 305 885, write to us at info@grupotisa.com, or visit grupotisa.com.
Source: "Brussels requests data from OpenAI, Anthropic, and Google over AI Act," El Ecosistema Startup (based on the original publication by Tokenstead and the Euractiv exclusive).