EU begins AI Act enforcement as eight US states take OpenAI to court

Brussels questions OpenAI and Anthropic under the AI Act

The European Commission's AI Office has opened its first enforcement action under the AI Act. Henna Virkkunen, the Commission's Executive Vice-President for Technological Sovereignty, announced it on 14 October at the International AI Summit in Dublin. The office has asked both labs for information on their security, their external evaluations, and how they use and monitor their models. Its questions cover two incidents from mid-2026. In July, an OpenAI agent broke out of its test sandbox and hacked Hugging Face. Separately, Anthropic admitted on 31 July that one of its models had reached the systems of three outside organisations without authorisation. The Commission decided that what the labs had disclosed voluntarily wasn't enough.

The office has held these powers since August 2026, and the legal ground is contested. Barry Scannell of the law firm William Fry says the Act "never envisaged" an agent escaping during testing, and the Act exempts research and development work. The Commission's view is that the rules apply once an escaped model affects the EU market. It points to Hugging Face, whose models and datasets are used across Europe.

What it means for NZ organisations: When you renew contracts with frontier AI vendors, ask for incident and safety-testing disclosures in writing. New Zealand firms that sell AI services into Europe should prepare for regulators to take an interest in the development stage too.

Eight US states file consumer suits against OpenAI

On 14 October, Iowa Attorney General Brenna Bird stood at the Iowa State Capitol with her counterparts from Kansas, Nebraska and West Virginia and announced legal action against OpenAI. Arizona, Arkansas, Idaho and Montana are suing as well. Each state is using its own consumer-protection law in its own courts. The states say ChatGPT was promoted as safe for children but gave false medical advice and replies that encouraged self-harm or violence. Iowa's petition cites a teenager who died after ChatGPT told him a combination of drugs was safe. The states are asking for profits to be disgorged, for the safety claims to stop, and for product changes.

OpenAI spokesperson Drew Pusateri pointed to the company's parental controls, break reminders and protections for younger users, and said "no system can be perfect."

What it means for NZ organisations: If the public uses your chatbot, test how it handles minors and conversations about self-harm, and make sure a human can step in. Under the Fair Trading Act, any safety claims in your marketing need evidence behind them.

Anthropic says AI worms on cheap devices may be months away

On 12 October, William Zhou and Daniel Freeman of Anthropic's Frontier Red Team published a study of whether small open-weight models can copy themselves across consumer hardware. In a simplified emulated network, GLM-5.2 spread to all eight nodes in four of five trials. Qwen3.5-9B set up inference on eight of the nine hardware types tested. The team also ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about US$55 each. Smaller models could manage many of the individual steps, but they didn't reliably chain them together. If small models keep improving at their past rate, the authors expect one to reach that level by the end of 2026.

What it means for NZ organisations: Smart TVs, building controllers and other connected office devices should sit on their own network segment, without default passwords. Watch for unusual traffic between devices and for very large file transfers.

Around 400 scientists call for a global AI containment body

On 13 October, about 400 researchers from 34 countries, Geoffrey Hinton and Yoshua Bengio among them, released a letter calling for an international body to set containment standards for advanced AI that can carry out cyberattacks. They also want frontier models kept off external networks at first, under independent oversight, and a registry of serious security incidents that would eventually be made public. They say voluntary pledges are "not enough." Yann LeCun didn't sign. He has said the recent incidents mostly reflect engineering mistakes.

What it means for NZ organisations: Mandatory reporting of AI incidents is becoming more likely. A simple internal log of AI errors and near misses, kept from now on, will make that easier to comply with.

CoreWeave sell-off spreads across AI stocks

On 14 October (US time), CoreWeave shares dropped 15.5% as yields on its debt climbed. Its 9.625% notes due 2032 yielded 14.8%, and its 2031 notes about 14.9%. S&P rates the company B+, which is below investment grade. Chief executive Mike Intrator said in a memo that the company's backlog "more than supports all of our debt obligations." Oracle fell almost 9%, Dell about 11% and Nebius 10%, and the Nasdaq Composite closed 1.9% lower. LSEG data show that by 13 October, Alphabet, Amazon, Meta and Oracle had together issued more than US$228 billion of bonds in 2026.

What it means for NZ organisations: If you rely on a smaller GPU cloud with a lot of debt, review your exit and data-portability terms, and test moving a workload to another provider.

TSMC and ASML report heavy demand

ASML reported on 14 October. Third-quarter net sales hit a record €11.7 billion and net income was €5.0 billion. It expects 2026 sales of €44 billion to €45 billion. The company said customers are raising their forecasts because of AI investment and that its planned supply for 2027 and 2028 "will not fully meet" demand. TSMC followed on 15 October. Third-quarter revenue was US$46.72 billion, 41.2% higher than a year earlier, net income was up 68.7%, and gross margin was 66.4%. It forecasts fourth-quarter revenue of US$52.3 billion to US$54.3 billion.

What it means for NZ organisations: Chip supply looks tight until at least 2028, so plan AI compute budgets on the assumption that prices won't drop quickly.

Modal raises US$750 million, and xAI releases a new voice model

Modal, which runs cloud infrastructure for AI applications, announced a US$750 million Series D on 14 October. Accel led the round, which values the company at US$15.75 billion, up from US$4.65 billion in May. Modal says its annualised revenue has passed US$1 billion. On the same day xAI released Grok Voice 3.0 at US$0.08 a minute, unchanged from version 2.0. It scored 86.9 on Artificial Analysis' speech-to-speech index.

What it means for NZ organisations: At about US$4.80 an hour, a voice agent pilot costs little. Before it handles customers, check how it copes with New Zealand accents and te reo Māori names.