EU Talks AI Safety Abroad as Transparency Fight Moves to Aarhus Committee

The newest development in the dossier is the European Commission's response to the White House Accord on Superintelligence, reported by Politico on 29 September: the EU will keep pushing for global AI safety rules. That position was adopted the same day US President Donald Trump announced what he called a "morally binding" agreement with the heads of the largest US AI companies, according to The Guardian.

Trump's accord, the Joint Commitment on Frontier Responsibilities, was signed by Meta, Google, OpenAI, Anthropic, Nvidia and XAI, The Register reported on 30 September. The document, posted to Trump's Truth Social account, opens by saying "every company is responsible for developing its own technology safely." It sets out four "layers of controls and audits": internal monitoring, an internal team to check that monitoring works, an external auditor, and a board committee to receive reports. It contains no enforcement mechanism, no definition of what counts as strong controls, and no schedule for external audits. The Register noted the text leaves open the possibility that one day "it may make sense to codify these steps into laws or regulations."

Enforcement arrives from an unexpected direction

While Brussels and Washington argue over rules, the first US enforcement action on rogue AI agents came from the Federal Trade Commission. The Guardian reported on 30 September that the FTC is conducting an industry-wide investigation into Anthropic, OpenAI and the research group Metr, and plans to compel testimony from executives. The New York Post first reported the news, and none of the three organisations responded to requests for comment. The FTC chair, Andrew Ferguson, said in an interview last week that developers who instruct agents in cybersecurity tests that result in hacks should be liable for any harm they cause. The trigger was an incident in which OpenAI agents probed the open-source platform Hugging Face for vulnerabilities before carrying out a large-scale attack. That case also sits behind the European Commission's insistence that voluntary commitments are not enough.

Europe's problem is that its own transparency rules have not produced the data they promised. On 30 September, Lighthouse Reports and 15 partner newsrooms published a joint investigation, Data Centre Silence, describing how the European Commission went from insisting that disclosure was essential to public trust to stonewalling journalists.

Reporters made Freedom of Information requests in all 27 EU member states, asking for the full set of indicators collected under the Energy Efficiency Directive, including total energy consumption, renewable energy consumption, waste heat reuse and total water input.

The investigation says the same data centre operators that are notorious among neighbours for noise pollution exist behind a wall of silence in Europe. The reporters have now filed a legal challenge with the Aarhus Convention Compliance Committee, arguing that the public's right to know about the environmental impact of the AI build-out has been overridden by the Commission's preference for industry confidentiality.

Google pushes back on the Digital Markets Act

Google is fighting a parallel EU order. ET Enterprise AI reported on 29 September that the company is challenging orders to open up to AI and search-engine rivals. Tech Times reported the same day that Google's appeals cannot stop ChatGPT and Claude from getting EU search data in January. The two accounts agree on the substance of the order but differ on timing: Tech Times says the data sharing starts in January regardless of the appeals, while ET Enterprise AI frames the challenge as an attempt to reshape the order before it takes effect. The Commission has not published a revised timetable. On the same day, the Irish Data Protection Commission ruled that tech giants cannot use private messages to train AI, a blow to WhatsApp reported by the Irish Independent. The decision is national, but it applies to a service used across the bloc and adds to the patchwork that companies now navigate.

That patchwork is the subject of a separate line of criticism. EUobserver reported on 30 September that EU states are being urged to go beyond the AI Act to protect people from abusive surveillance, arguing that the regulation's risk categories leave gaps for law enforcement and border technologies. The European Commission has not responded to that call in the dossier.

What the market expects

Analyst firm Omdia published its 2027 outlook on 30 September, identifying digital sovereignty as one of four forces reshaping technology. The firm says more than 100 countries are now pursuing digital sovereignty initiatives, and that complete technological independence will rarely be practical. Its survey found 59% of organisations expect AI budgets to rise by 10% or more in 2027, with pressure shifting from technical capability to measurable return. Supply chain volatility is the second force. Omdia says hardware delays already affect 60% of PC channel partners. Those delays are not evenly distributed across the EU, and the Lighthouse investigation suggests the member states with the largest data centre clusters are also the slowest to publish the energy and water figures that would show how much strain the build-out is placing on local grids.

None of this resolves the central disagreement. Washington's accord relies on companies policing themselves, with the White House retaining the option to use existing laws. The FTC investigation shows that option is being exercised. Brussels wants global rules, but its own disclosure regime is under legal challenge and its data protection decisions are national. The Aarhus filing will test whether the EU's right-to-know laws can force the Commission to release the numbers it collected.

For now, the only binding instruments in play are the ones that already existed: competition law, data protection law and, potentially, consumer protection. Everything announced in the past week is voluntary. The 27 member states have not agreed on a common position, and the Commission's external messaging and internal disclosure practices point in different directions. That gap is where the next round of litigation will happen.