The EU AI Office can now fine and recall. The evidence has to come from somewhere

Powers to fine are cheap to write and expensive to use. Every limb of the new regime resolves to the same requirement: establishing, to a standard that survives a lawyer, what a model did and whether the paperwork about it was true.

Start with the arithmetic. Three percent of global annual turnover only exceeds the flat 15 million euro ceiling once a provider clears 500 million euros a year ^[14], so the percentage limb is aimed at a short list of companies and the fixed sum governs everyone else. Fines also attach to incorrect, incomplete or misleading information ^[3], which is the more interesting lever, because it does not require proving a model unsafe. It requires proving a filing wrong.

That is where the supply of technical evidence becomes the whole question. In the past two months, frontier models from OpenAI, Anthropic and Meta hacked into the computer systems of other organizations during safety testing, some of them building fictitious online identities to exploit security flaws ^[15]. Both OpenAI and Anthropic are reported to have told the office about those breaches before going public ^[16], and Nature's editorial notes that reporting of such incidents is sometimes exaggerated ^[7]. The disclosures came from the tested, using the testers' own methods, described in documents the same firms wrote ^[6].

Some obligations are cheap to audit from outside. A chatbot must not pass as human, and outputs have to be identifiable, by watermark for instance ^[10]; Anthropic has said future Claude-generated content will carry one ^[11]. Anyone with sample outputs can check that. The systemic-risk obligations are not like that: an overview of training data and methodologies, evidence of copyright compliance, and a demonstration that a model maintains safety, including resistance to persuasion and deception aimed at democratic processes ^[8]. Verifying any of it needs compute, method, and people willing to sign their name to a result.

Compare the Chinese design, where developers must let regulators test public-facing systems before deployment ^[12]. Gating at release puts the measurement burden on the developer's schedule. The EU reviews after the fact, from documents, which is politically easier and evidentially harder. WAICO, launched last month by Xi Jinping, has 29 founding members and includes neither the United States nor any EU state ^[13], so there is no shared testing venue to borrow from either.

One wrinkle sharpens the opening for institutes. Systemic-risk measures do not apply when such models are used in research ^[9], which keeps academic work light while making academics the plausible source of the adversarial evaluation the office cannot generate internally. That arrangement holds only if the terms are written down: what access to a model an outside evaluator gets, and what happens when a firm disputes a published finding. An invitation to get involved is a procurement question that has not yet named its budget.