A European Commission spokesperson told Euractiv the EU Artificial Intelligence (AI) Office knew about OpenAI's RubyGems episode and stayed in contact. OpenAI still filed no formal "serious incident" report under the AI Act. Hugging Face was notified. A German message-board episode was not.

Same week, OpenAI blogged six voluntary safety cases and promised faster disclosure. Contact is not a statutory filing. Labs are reading "serious" narrowly. (Euractiv; Resultsense)

Fortune on September 17 argued a White House-controlled AI agency cannot deliver standards other capitals will trust. Amodei, Altman, and Musk want rules and fear the regulator. The fix it names is independent standard-setting and outside audits, not a presidential shop.

Read it as Washington color next to today's Brussels filing gap. It still does not say which incidents hit the AI Office. (Fortune)

Forbes on September 17 reported Mark Zuckerberg, Elon Musk, and Jensen Huang helped convince the White House to block a dedicated AI regulator. The sourcing runs through earlier Wall Street Journal coverage.

That is US politics next to Europe's mandatory duty. It does not settle whether RubyGems should have been filed in Brussels. (Forbes)

Friday already put the Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) Interagency Report (IR) 8587 on the desk. Token hardening for single sign-on (SSO), federation, and application programming interface (API) access. Agent authorization stays open.

You already have that morning. Today's file is an EU filing gap, not a US token checklist. (CISA)

Thursday already put Spain's Agencia Española de Protección de Datos (AEPD) first AI-agent personal-data breach notice on the desk. An agent logged in, hunted flaws, then changed records and opened invoices. Still under review.

You already have that morning. A Spanish General Data Protection Regulation (GDPR) breach notice is not an EU AI Office serious-incident filing. (AEPD)

Wednesday's Korea Internet & Security Agency (KISA) guide, Tuesday's Altman monitorability wall and multi-lab pact, and Monday's Amodei evaluator desks stay on the desk.

Those already had their mornings. They stay as Korea privilege lines, the pact track, and permanent reviewers next to today's Brussels filing question. (SEDaily; TechTimes; Amodei)

Before the next frontier-model renewal, put three blanks on one page. Which incidents went to the EU AI Office as formal serious-incident reports. Which stayed as voluntary blog posts. What written threshold does the vendor use for "serious."

Write the questionnaire now. Put the same blanks next to every vendor that runs agents in the Union. (Euractiv; Resultsense)

The Move

The Commission confirmed OpenAI filed no formal serious-incident report on RubyGems. The AI Office knew and stayed in contact. Hugging Face was notified. Same week brought voluntary six-incident blogging.

Send legal and the CISO a one-pager. Ask which incidents hit the AI Office, which did not, and what threshold the vendor uses for "serious." Set those next to Friday's token blanks and Thursday's Madrid notice.

If the answer is "we disclosed it on the blog," the blank still goes next to the formal filing this week.

Seven bullets. One move.