Von der Leyen tells frontier labs to pace self-improving AI, cites Hugging Face

Once a year the President of the European Commission stands in the Parliament in Strasbourg and reads out what the EU intends to do next. Most of the September 16 address was about Canada, heatwaves, and Ceuta, Euronews reports. One passage was about the summer's AI incidents, and in it Ursula von der Leyen adopted a phrase that until now belonged to the labs.

"Incidents of AI agents escaping their environment or inserting malicious code are a mere glimpse," she said, according to the speech text on the Commission's press corner. "After the HuggingFace incident, developers are ringing the alarm. And CEOs of the most advanced companies tell us that it is time to slow down on the self-recursive models. To pace the frontier. If the people developing the technology are clear, then we should be too." The incident she named is the July episode in which OpenAI agents left an evaluation environment and reached Hugging Face's infrastructure, which we covered in August.

What she announced

Four things, by our count of the text. She will "invite the main frontier labs for a discussion on how we can support ongoing industry efforts to pace the frontier." The Commission will "step up together with our like-minded partners like Canada, the United Kingdom and others" and "team up on model evaluation, verification, early warning, AI security and much more." The AI Act, she said, is the instrument for "putting guardrails in place" and "puts Europe in the position to shape global efforts on how to tackle this." And Europe must "massively boost our computing capacity," paired with "new ways to use public and private funds to invest in the most promising European start-ups and companies."

The framing was security first. "Models being developed will allow hacking on a level we never thought possible," she said. "And they will soon be in the hands of adversaries who see the world very differently from us." The Decoder's Matthias Bastian reads a further line as an admission that the EU currently lacks reliable access to the most advanced cybersecurity models from the major labs; that is his paraphrase, and the text itself is less direct. On applications, she said Europe should aim at industrial AI in health, transport, agriculture, manufacturing, and defence rather than frontier models, and called "AI with human agency" the essence of the European way.

What is not in the speech

No date for the meeting with the labs, no named body for the evaluation work, no budget figure for compute, and no new legal instrument. Help Net Security's Zeljka Zorz and The Next Web both file it as the Commission backing the slowdown argument rather than legislating it. The AI Act's obligations for general-purpose models already exist; what the speech adds is a political sponsor for evaluation results that come from outside the vendors.

Why a build studio cares

For our European clients the practical change is not the speech but the queue it starts. If the Commission and the UK's evaluators begin publishing what they find about specific model versions, procurement teams will cite those findings, and a vendor-built product on a frontier model will be asked which model version it runs and what the evaluators said about it. Our Full Audit already maps every client system to its model, its hosting region, and whose terms it sits under. The evaluation column is new. We would rather fill it before a client's legal team asks.

Next step: read the speech text on the Commission's press corner, Euronews's report on the whole address, and Help Net Security's write-up of the AI passage. If you ship on a frontier model for European users and cannot say which version or who has evaluated it, write to us at hello@gattyworks.com.