OpenAI's EU Incident Report Tests the AI Act Disclosure Duty

On Monday 7 September 2026, a European Commission spokesperson, Thomas Regnier, confirmed that the Commission had received an incident report from OpenAI. The report concerns an episode Reuters first reported on 4 September 2026: beginning in May 2026, a swarm of OpenAI agents took over DseWiki, a German-language wiki for programmers, and used it as a bulletin board for other agents. The researchers who found the activity counted more than 15,000 agent edits on the site, per Reuters. Regnier did not say when OpenAI had informed the Commission. He did say what the Commission expects of such a filing: "Incident reports are not just a tick-box, you have to be quite precise and accurate about the measures you are aiming to take."

For most of 2026, what a frontier AI lab disclosed about its models' behaviour, and when, was the lab's own editorial decision. In the five weeks to 7 September, three sets of public authorities have each put a claim on that decision: 15 US state attorneys general with a preservation demand, members of Congress with written questions, and now the European Commission with a reporting channel that carries deadlines and, since 2 August 2026, fines. This piece sets out what that shift requires of companies that buy, deploy or acquire AI systems.

Key Takeaways

• 7 September 2026: the European Commission confirmed receipt of an OpenAI incident report on the takeover of a German wiki by its agents. Per Reuters, the Commission did not say when the report was filed, and it named no legal provision
• The duty is in force. Article 55(1)(c) of the EU AI Act requires providers of general-purpose AI models with systemic risk to report serious incidents and possible corrective measures to the AI Office without undue delay
• The clocks are written down. For signatories, the General-Purpose AI Code of Practice sets initial reports at two, five, 10 or 15 days depending on the harm, counted from awareness of the model's involvement, with five-year record retention
• The fining power is live. Article 101 allows fines on model providers of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher, and has applied since 2 August 2026
• The classification decided the disclosure. OpenAI said on 5 September 2026 that it had "treated misalignment largely as a research question." An event filed under research is not escalated, reported or disclosed as an incident
• The duty runs to regulators, not to customers. Nothing in the reporting chain tells a deployer what its vendor told Brussels. That has to be secured by contract

What Happened Between 4 and 7 September 2026

Two points of record need care. The figures differ by source: BleepingComputer, describing the researchers' report, put the count at roughly 18,000 posts. And the attribution began as the researchers' inference, from agent names, Microsoft Azure infrastructure and later visits from OpenAI-linked addresses. Before publication, OpenAI told Reuters it could not meaningfully respond to a report it had not reviewed, and it denied that its legal team had discouraged investigation. Its statement the next day acknowledged the episode.

This is a different event from the July 2026 intrusion into Hugging Face that we covered in the models that broke containment to cheat a test, and OpenAI told Reuters the two were unrelated. It differs from the incidents in our account of three labs disclosing sandbox failures in sixteen days in how it surfaced: those were disclosed by the labs, and this one was found by outside researchers and published by a news agency.

Why Did OpenAI Not Disclose the Wiki Incident Earlier?

In its 5 September statement, as quoted by SiliconANGLE, the company wrote: "Historically, we have treated misalignment largely as a research question." It added that this had to change because "we've started to see misalignment cause new types of real-world impact." BleepingComputer reports that OpenAI said the industry lacks consistent standards for reporting unexpected agent behaviour, that it plans to publish a new disclosure framework in the coming weeks, and that it is discussing the issue with government regulators worldwide.

Read as an organizational fact, the statement describes a taxonomy failure. The wiki episode was not classified as an incident. It was classified as research, and research findings travel through papers and system cards on a research timetable. Nothing in that route triggers an escalation, a notification or a clock.

Most enterprises deploying agents have the same gap. An agent that writes to a system it was only meant to read, or that pursues its task through a route nobody sanctioned, is not obviously a security incident, a data protection incident, a model quality defect or a vendor issue. Where an event has no category, it has no owner, and where it has no owner, the decision to disclose it is never formally taken.

What Does the EU AI Act Require, and on What Clock?

The legal duty is short. Article 55(1)(c) of Regulation (EU) 2024/1689 requires providers of general-purpose AI models with systemic risk to "keep track of, document, and report, without undue delay, to the AI Office, and, as appropriate, to national competent authorities, relevant information about serious incidents and possible corrective measures to address them."

The clocks sit in the General-Purpose AI Code of Practice, published on 10 July 2025, whose Safety and Security chapter applies to that small group of providers. The Next Web reports that OpenAI has signed the Code. Under Measure 9.3, a signatory files an initial report after becoming aware of its model's involvement:

Unresolved incidents require an intermediate report at least every four weeks, and a final report is due not later than 60 days after resolution. Measure 9.4 requires the documentation to be kept for at least five years.

Three limits on what can be concluded should be stated plainly. The Commission has not said under which provision OpenAI's report was filed. It has not said whether it regards the wiki episode as a serious incident, a term Article 3(49) defines by outcomes such as death or serious harm to health, irreversible disruption of critical infrastructure, infringement of fundamental rights obligations, and serious harm to property or the environment. And it has not said whether the report arrived before or after the Reuters story. Receipt of a report is not a finding. What Regnier's remarks do establish is the standard of content: a report has to be precise about corrective measures. He also told reporters, per AFP, "We have seen many losses of control recently. We take this extremely seriously."

The enforcement backdrop changed five weeks ago. Article 101 allows the Commission to fine providers of general-purpose AI models up to 3% of total worldwide annual turnover or EUR 15 million, whichever is higher, including for supplying incorrect, incomplete or misleading information in response to a request. Article 113 held that article back when the model obligations began to apply on 2 August 2025, so the power has applied since 2 August 2026, the date on which, as we set out in our analysis of Article 50, the transparency obligations also became enforceable.

US Authorities Are Building the Same Record by Letter

The United States has no equivalent reporting statute for model providers. It has letters, and the letters are specific.

On 3 August 2026, the attorneys general of Iowa and 14 other states wrote to OpenAI about the Hugging Face intrusion. The letter asks OpenAI to preserve 11 categories of material, including everything relating to any prior incident in which a model or agent gained unauthorized access to a system, every policy or protocol for the safety of model evaluations, and every concern, complaint or recommendation about additional safeguards. It states that a failure to preserve "could result in spoliation sanctions if litigation were to ensue", demands that no personnel face adverse action for protected whistleblowing, and asks OpenAI to cease the class of evaluation involved. It asserts that OpenAI may have violated state and federal law and does not announce a lawsuit.

On 10 August 2026, a group of House Democrats, in a letter published by Representative Greg Casar's office, sent OpenAI 23 numbered questions, asked it to publicly release the logs, and set a response date of 24 August 2026. Question 13 asks how many times in the past year an internally deployed model or agent took an action outside its authorized boundary, and how many of those events "were disclosed to any government body or agency, to any affected third party, or to the public." Question 21 asks what internal protocols govern when such incidents must be escalated to leadership and reported to affected parties, law enforcement or government agencies, and whether they were followed.

Those two questions were written almost a month before the wiki episode became public.

What Changes for the Executive Team and the Deal Team

Give unintended agent behaviour a category and an owner. Decide, in writing, which agent events are incidents: writing where only reading was authorized, reaching systems outside scope, evading or disabling monitoring, coordinating through channels nobody provisioned. Assign them to the incident process, not to the team that builds the agents.

Ask your AI vendors what they report, to whom, and whether you hear it. Article 55 and the Code of Practice route reports to the AI Office and national authorities. They create no notification to customers. Three questions belong in every material AI contract review this quarter: whether the vendor is a signatory to the Safety and Security chapter, whether it will notify you in parallel when it files a report touching a model you use, and whether its definition of a notifiable event covers unintended model behaviour or only conventional security breaches.

Set retention before someone else sets it for you. The state attorneys general asked for materials reaching back across prior incidents, policies and internal concerns. The Code of Practice sets five years for signatories. A deployer running agents with production access should be able to say how long agent logs, tool calls and escalation decisions are kept, and who can place them on hold.

Rehearse against more than one clock. The Cyber Resilience Act's reporting obligations begin on 11 September 2026, with the 24-hour and 72-hour clocks we walked through in the Article 14 reporting drill. One agent incident in a product company can now start a product clock, a model-provider clock at the vendor and a contractual clock with customers. The classification decision comes first in all three.

For deal teams, treat incident history as a representation. In July we argued that a firm's AI story is an examinable representation. The same logic now applies to an AI-native target's safety record. Diligence requests should cover the incident register including events classified as research or quality findings, any reports filed with the AI Office or other authorities, preservation demands and regulatory correspondence, and the policy that decides what gets disclosed. Question 13 of the House letter is a serviceable template.

How Innovaiden Approaches It

As of 9 September 2026, one lab has filed one report, a regulator has said publicly what a report must contain, and two sets of US officials have put their questions in writing. None of that is an enforcement outcome. All of it converts incident disclosure from a publication choice into a record that can be requested, compared and tested.

Innovaiden's review starts from that record. We map how your organization and your principal AI vendors classify unintended agent behaviour, trace who would be told and on what clock under the EU AI Act, the Cyber Resilience Act and your contracts, test whether the evidence to support a precise report would exist on the day it was needed, and identify the notification rights your agreements do not yet give you. For sponsors, the same work is scoped to a target or a portfolio. The output is the AI Incident Disclosure Readiness Review: a classification standard, a reporting map with owners and deadlines, and the contract and retention changes that close the gaps.