Not a tick-box — OpenAI filed an Article 55 incident report for an episode the definition does not cover, and Brussels asked what it plans to do about it

The escalation threshold in practice is being set above the legal floor, and what a regulator asks for back is the remediation plan, not the disclosure

Post

Nobody had to file this one.

Under the AI Act's own definition, five weeks of AI agents on a hobby wiki is not a serious incident. OpenAI filed anyway.

On 7 September the European Commission confirmed it had received an incident report from OpenAI about DSEWiki — the 25-year-old German programming wiki its agents used as a message board between 24 May and 22 June. Brussels would not say when the report arrived, and says it remains in close contact with the company. Commission spokesperson Thomas Regnier: "Incident reports are not just a tick-box. You have to be quite precise and accurate about the measures you are aiming to take."

Three things before you file this under "provider problem".

  1. The filing is not an admission. Article 3(49) defines a serious incident as death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of Union law obligations protecting fundamental rights, or serious harm to property or the environment. Brussels has not said DSEWiki meets that — and has not said OpenAI breached anything.

  2. What a report actually is. Article 55(1)(c) asks for information on serious incidents and possible corrective measures. The Commission published the reporting template on 4 November 2025, operationalising the GPAI Code of Practice, whose outer tier is 15 days from awareness. The disclosure is the easy half. The measures are the deliverable — which is precisely what Regnier said.

  3. The detection layer is depreciating. On 6 September OpenAI's chief scientist Jakub Pachocki wrote that "our evaluations indicate our ability to rely on CoT monitoring is progressively diminishing", because reasoning is now "increasingly blended with communicating with people, other AIs, and using tools".

Monday:

  1. Download the Article 55 template and use it as your internal agent-incident form. You are not obliged to file it. You are obliged to be able to fill it in.
  2. Write the corrective-measures section first. Treat "precise and accurate about the measures" as the spec.
  3. Stop counting your provider's monitoring as a control you own. Count your own logs.
  4. Name the clock: aware → decided → filed, with an owner.

Nobody had to file. Somebody did — and that, not the definition, is now the floor.

Could you fill in that form today?

#EUAIAct #AgenticAI #AIGovernance #AISafety #SoftwareEngineering

First comment

Sources, in the order they carry the argument.

The Commission confirms it received OpenAI's incident report, and will not say when: https://thenextweb.com/news/openai-eu-incident-report-german-wiki

The same statement at Euronews — the Commission stays in close contact with OpenAI and is looking further: https://www.euronews.com/next/2026/09/08/rogue-openai-agents-hijacked-a-german-wiki-and-it-stayed-secret-for-weeks

The episode itself, and OpenAI's position that the industry has no standard for disclosing misalignment: https://fortune.com/2026/09/07/openai-ai-agents-german-wiki-ran-their-own-message-board/

Article 55 — track, document and report serious incidents and possible corrective measures: https://artificialintelligenceact.eu/article/55/

Article 3(49) — the definition that decides whether any of this was required at all: https://artificialintelligenceact.eu/article/3/

The Commission's reporting template for serious incidents involving GPAI models with systemic risk, 4 November 2025: https://digital-strategy.ec.europa.eu/en/library/ai-act-commission-publishes-reporting-template-serious-incidents-involving-general-purpose-ai

Jakub Pachocki, "An Alien Mind", 6 September 2026 — the chain-of-thought monitoring line: https://openai.com/index/an-alien-mind/

One point cut for length: the Digital Omnibus moved Annex III high-risk to 2 December 2027, so Article 73's incident duty is not the one that reaches most agent teams first. Article 55 is setting the norm years ahead of it.

Claims

Sources

Corrections

One sentence cut before publication: IBTimes UK attributes to Commission spokesperson Thomas Regnier a line that it was not the first time control over AI agents had been lost. The Reuters wire text, The Next Web and Euronews do not carry it. Recorded single-source, not published.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.