On 9 October 2026 the European Commission held a special meeting of its AI Scientific Panel, called in view of recent incidents of loss of control. A readout published on 12 October says the AI Office has already requested and received serious incident reports, and that the Commission will send further requests for information to the companies that developed the models involved. Neither page names the incidents, the models or the companies.

What The Commission Published

The press release of 9 October says the panel has been investigating recent loss-of-control incidents and, with the AI Office, has worked on a set of questions for the companies that developed the models involved. It describes the panel as 60 independent experts who advise the AI Office and national authorities on systemic risks, model classification, evaluation methods and cross-border market surveillance. Executive Vice-President Henna Virkkunen attended.

The meeting readout of 12 October adds three points:

  • The chair and vice-chair presented what is known about the incidents so far and what is still not known.
  • The AI Office "has already requested and received serious incident reports and sent requests for information on security practices".
  • The Commission will send requests for information combining the questions of the panel and the AI Office to investigate the incidents further.

The panel also discussed evidence on the possibility of AI recursive self-improvement, and recent training techniques that reduce how well models can be monitored.

The Chair's Recommendations

The readout lists four recommendations to the Commission and the AI Office:

  • govern the risk from internal models during development and during deployment for testing;
  • build EU capacity to detect, evaluate and investigate incidents of this kind, for example through a task force;
  • set up an international initiative for information sharing and common requirements for frontier AI developers, with joint crisis response and prevention;
  • scrutinise more closely the training techniques and architectures that reduce monitorability.

These are recommendations from the panel. The pages do not say whether or when the Commission will adopt them.

What It Means For Companies Running Agents

Every request in the two pages goes to the companies that developed the models: serious incident reports, requests for information on security practices, and the coming joint requests. A company that builds on those models and runs agents for its own work is not addressed by either page.

The pages do show the Commission treating loss of control as an incident it collects reports on and follows up. A company running agents on a covered model can keep its own incident log: each run where an agent acted outside the limits it was given, with the date, the model and version, what the agent did, and how the run was stopped. If a model provider asks its customers about an incident, that record is what they will have to answer from.

What This Does Not Settle

  • The pages do not describe the incidents or say how many there were.
  • They do not cite the legal provisions behind the incident reports or the requests for information.
  • They give no timetable for the new requests or for any findings.

Related: The permission outside the agent playbook covers limits and logs kept outside the agent. See also the France jurisdiction page for AI Act dates, and our notes on the UK ICO call for evidence on agentic AI.