A Commission spokesperson confirmed to Euractiv that OpenAI never filed a report on the May RubyGems incident, in which a swarm of its agents published thousands of packages to the Ruby software registry and, security researchers said, probed a freshly disclosed vulnerability.
The AI Act obliges providers of frontier models to notify the AI Office of serious incidents without delay. The AI Office learned about this one from the researchers who found it.
OpenAI did file on the separate German wiki case, on 7 September, three months after it started and days after the press picked it up. The pattern points at a reading of the law in which only unambiguous mass harm counts.
The AI Office spent August acquiring enforcement powers. This is the week it found out what they are worth when a lab decides an incident is not serious enough to mention. (heise online)
Research & Labs
Cohere and Aleph Alpha sign, with two headquarters and no acquirer
The definitive agreement landed on 16 September, five months after the April announcement we covered in May. The combined company keeps the Cohere name, runs from Berlin and Toronto, and employs more than a thousand people.
Heidelberg stays open as a research centre. Aleph Alpha co-CEO Ilhan Scheer becomes chief operating officer, and co-founder Samuel Weinbach becomes chief research officer.
Germany's largest model lab is now a division of a Canadian company, with German public-sector contracts and Schwarz Group's STACKIT cloud as the commercial base. Closing still needs regulatory clearance, expected before year end. (TNW)
Germany puts EUR 100 million into Bengio's safety lab, and a Berlin site
Canada is committing CAD 150 million and Germany around EUR 100 million to LawZero, the nonprofit Yoshua Bengio founded in 2025. The organisation puts the combined package at up to CAD 300 million.
Canada gets 360 full-time posts and dedicated compute. The German money funds a new LawZero site in Berlin, where the stated point is to build European rules into the architecture rather than test for them afterwards.
LawZero's Scientist AI approach aims at a system that models the world and evaluates hypotheses without pursuing goals of its own. The July paper covers one part of that concept and proves nothing about the whole.
The German money still needs state aid clearance from the Commission. (heise online)
Deployment & Applications
Mistral buys a Paris marketing startup, its third acquisition this year
Pimento generates and adapts advertising creative against brand rules, and plugs into ad accounts on Meta, TikTok, Google, and Pinterest. Terms were not disclosed; Pimento had raised EUR 3 million in 2023.
This follows Koyeb for infrastructure and Emmi AI for industrial physics, which we covered in May. Mistral AI is buying its way up the stack toward the application layer, where customers pay for outcomes rather than tokens.
The company now says it operates in twenty countries and serves more than 125 large accounts, Airbus, ASML, and HSBC among them. (FrenchWeb)
Inference bills are pushing application companies onto open weights
Harvey's gross margin went from roughly 50% at the start of the year to minus 50% by June as token use rose twentyfold, and recovered only after the company trained its own model on open weights.
Stockholm's Legora, which reached $100 million of revenue in 18 months across more than 1,200 firms, is the European entrant in that market and faces the same arithmetic.
Mistral has spent the year arguing that renting a frontier model is a lock-in decision. The Data Act gives customers switching rights when they leave a supplier, not when the supplier leaves them. (TNW)
Poland shows what adoption looks like without money behind it
Only 8.4% of Polish firms with ten or more staff had adopted AI by the end of 2025, against an EU average of 20%. That is second to last in the union, and of the firms that do buy, 57% will spend under 100,000 zloty.
The failures are specific rather than mysterious. Workers spend 6.4 hours a week checking and correcting model output, and a third of them route around company restrictions to reach an unrestricted model.
The Polish regulatory sandbox opened in July and the new AI commission is standing up, which answers the compliance question. Neither answers a market where most firms cannot fund the last mile. (Spider's Web)
Governance & Safety
The AI Board meets for the ninth time and starts on conformity assessment
The Board met on 17 September under the Irish presidency, with Moldova attending as an observer for the first time. The agenda covered enforcement priorities, recent incidents, and Europe's own model capabilities.
The item worth tracking is cooperation on governance structures for pre-market conformity assessment. That is the machinery deciding who certifies a model before it reaches the market, the question we flagged last week.
The tenth meeting is on 18 November, alongside the Apply AI Summit in Brussels. (European Commission)
Spain gives itself twelve months and calls the plan IA360
Pedro Sanchez presented IA360 at Moncloa on 20 September, before leaving for the UN General Assembly. It is a twelve-month action list rather than a strategy document: subsidies for small firms and the self-employed, data centres held to energy and environmental standards, and a social pact spanning unions, employers, and regional government.
The target is more than half of Spanish companies using AI by 2030. Sanchez framed the alternative as deregulated AI in few hands, which is a political position as much as an industrial one.
Spain already adopts faster than most of Europe, so the plan is aimed at the firms the first wave missed. (La Moncloa)
Compute & Infrastructure
Nineteen states put industrial AI into the state aid machinery
The Commission endorsed the design of the first Important Project of Common European Interest in AI on 16 September, with 19 member states signed up and Germany coordinating. Eleven have started pre-notifying their projects.
An IPCEI lets governments fund industrial capacity without falling foul of state aid rules. The target is decentralised AI services across the stack, from compute management to industrial applications, and more than 150 projects have been selected so far.
Unlike the AI Gigafactories tender, whose bids close on 12 November, this money goes to applications rather than machines. (European Commission)
The Netherlands puts EUR 120 million behind its share
The Dutch economy ministry committed EUR 120 million from next year for Dutch companies joining IPCEI-AI, targeting healthcare, transport, agrifood, advanced manufacturing, and aerospace.
The stated aim is cutting development costs for smaller firms that cannot build AI capability alone. On a project the Commission sizes above EUR 10 billion, a national contribution of this size shows what a mid-sized member state thinks its seat is worth. (Computable)
AI & Society
France makes AI at work a labour ministry problem
Labour minister Jean-Pierre Farandou and economy minister Roland Lescure launched Impulsion IA 2027 this morning. Four priorities: training workers and adapting the training system, reaching small and micro firms, strengthening social dialogue about the changes, and anticipating effects on working conditions.
Farandou has talked about training fifteen million professionals, a number large enough that the delivery mechanism matters more than the target.
Most national AI plans sit with digital or industry ministries and treat labour as a consequence. Putting this one in the labour ministry, with unions in the room, is a different bet about where the friction will be. (Ministere du Travail)
One to watch
What counts as a serious incident
The AI Office has had enforcement powers since 2 August and sent its first formal requests for information on 29 August. Fines reach 3% of global turnover or EUR 15 million.
What it does not have is a threshold. The AI Act requires notification of serious incidents without saying how serious, and labs are self-classifying in the gap.
One survey of security leaders found 53% had withheld an AI incident report at some point. The Commission's implementing guidance on the causal-link language is the piece that closes the gap, and the thing to watch between now and the Board's 18 November meeting.
If it lands narrow, the RubyGems answer becomes the default answer. (150sec)