An AI governance policy is becoming something providers may need to substantiate with records.
European Commission Executive Vice-President Henna Virkkunen told Reuters that the Commission sent information requests to more than 30 AI companies in late August. The questions concerned safety and security, followed by transparency and copyright obligations. The companies were not identified, and the responses are being assessed.
The requests are not findings of wrongdoing. They show how supervision can move from published commitments to the evidence behind them.
Documentation makes governance assessable
A company may say that its model is tested, monitored and subject to human oversight.
A regulator needs to understand what those statements mean operationally. Which tests were performed? How were concerns recorded? Who could authorize a release? What happened when an evaluation identified a problem?
The answers may exist across technical, legal and management teams.
That makes documentation more than a compliance appendix. It is the record through which the organization can explain its decisions.
Enforcement is now an operational concern
The Commission announced that AI Act enforcement would begin on August 2, 2026, alongside new transparency requirements. Its published materials distinguish obligations across the AI framework.
Counsel should therefore avoid assuming that every provider, model or use faces identical requirements.
The relevant analysis starts with the organization’s role and the activity involved. A developer, distributor, downstream provider and enterprise user may occupy different positions in the compliance chain.
Penalty exposure likewise requires provision-specific analysis. A headline maximum should not be presented as the automatic consequence of failing to answer an information request.
Canadian businesses can face European questions
A Canadian location does not, by itself, resolve whether European obligations apply.
Businesses offering AI products or services into Europe need to assess their actual activities and relationships. Enterprise clients may also need information from vendors to evaluate their own responsibilities.
That makes contractual access to relevant documentation a practical issue.
A customer should understand what evidence the provider can supply, what restrictions apply and how material changes or incidents will be communicated.
Counsel should test the evidence trail
A useful review asks whether the organization can retrieve and explain its governance records.
The work may include mapping responsibilities, checking document retention, identifying approved versions of policies and establishing how technical findings reach decision-makers.
The goal is to avoid a gap between the company’s public assurance and its internal evidence.
Records also need context. A test result without an explanation of methodology may reveal little about the risk it was intended to assess.
An information request is not a verdict
The Commission’s inquiries should be reported as inquiries.
They may lead to further regulatory steps, but the public account does not establish that a named company breached the law or that a particular model is unsafe.
The immediate lesson is about preparedness: organizations must be able to explain how their governance operates.
A compliance promise is easier to make than an evidence trail is to reconstruct.
Sources
- Reuters report via MarketScreener: EU tech chief on AI oversight ↗
- European Commission: AI Act enforcement and transparency requirements ↗
Related coverage: Stripchat Loses EU Platform Challenge: Why User-Counting Methods Matter.
Related coverage: TikTok Gatekeeper Appeal: EU Advocate General Clarifies Evidence Threshold.