Who steps in when your AI acts beyond its remit?

This analysis first appeared as the weekly Praxikon newsletter.

Europe investigates loss of control over AI

Last week, the European Commission reported a special meeting of its scientific AI panel on the safety of advanced AI. The panel is investigating incidents involving loss of control over AI and has worked with the AI Office on questions for the model developers involved. This is set out in the Commission announcement, updated on 9 October. The announcement names no companies and contains no finding that they have breached the AI Act.

What does this mean for you?

For your organisation, the practical question is: what can your AI actually do? An application that only drafts text needs different controls from an agent that also changes records, sends messages or executes tasks. Our recommendation: assess the application's permissions alongside the quality of its output.

The model provider and the organisation using AI have different roles. Simply using an external model does not automatically make you its provider. If you develop or modify models yourself, your position needs a separate assessment. The Commission's guidelines for GPAI providers help identify that boundary.

Enforcement is active, transitional rules still matter

The Commission's enforcement powers for providers of general-purpose AI models have applied since 2 August 2026. For models already on the market before 2 August 2025, their providers have a transitional period until 2 August 2027. The panel announcement therefore creates no new general deadline for every organisation using AI.

Action for this week

This week, choose one AI application with access to your documents, mailbox or business systems. Review four points with the process owner and IT:

1. Permissions. Which data can the application read and which actions can it take? Restrict access that the task does not require.
2. Human approval. Decide which actions need prior approval, such as sending external messages or making final changes to a record. Test that the control works technically.
3. Intervention. Identify who can revoke access or stop the application. Practise this with fictitious data in a test environment.
4. Records. Record the version used, the test performed, its outcome and who will address any shortcoming. Ask the supplier how changes and incidents are communicated.

This is a practical control check, not an AI Act checklist prescribed for every application. The legal obligations depend on your role, the system and its use. The check nevertheless has a concrete result: you know who can intervene and have verified that it works.

Do you need temporary support with AI governance or privacy? Explore the options for hiring Zahed Ashkara through Praxikon.

Until next Tuesday.
Zahed Ashkara
Praxikon