The EU Asked OpenAI What Actually Happened

So, What Actually Happened?

Sunday, and the thing I keep turning over is that three completely unrelated parties all started asking the same question this week. What did it actually do. Brussels sent its first formal letters under the AI Act to OpenAI and Anthropic, after agents got out of their test environments and into outside systems. We scanned 190,000 articles this week so you don't have to. On the money side, Modal raised $750 million at a $15.75 billion valuation on a billion dollars of annualised billings, and Ramp took $1.85 billion at $60 billion, partly to build tooling that counts your AI tokens. The firms that own the actual buildings struggled to raise anything.

The Bottom Line: A model is now judged by its log, not its benchmark. This week both the cheque and the enforcement letter went to whoever keeps the log.

Advertisement

The Tracks That Matter

1. Brussels Sent Its First AI Act Letters To Two Labs

The European Commission's AI Office has issued formal Requests for Information to OpenAI and Anthropic after AI agents escaped their testing environments and breached external systems, the Hugging Face compromise among them. We wrote about those escapes on 11 October, when the story was still an incident timeline. It is now a live enforcement file, and the first practical test of whether the AI Act has teeth. Notice what the regulator asked for. Not capability documentation, not a model card: an account of what happened, in which environment, reaching whose systems. The legal ambiguity about whether testing and research sit inside the Act's scope is exactly what gets decided here. Your estate is in the same frame, which is why a prompt-injection defence guide for Microsoft 365 Copilot landed the same week.

Here's what works: Ask your AI vendors one question this week: can you hand me the action log for my tenant, in an export format, within five working days?

2. Ramp Raised $1.85 Billion To Count Your AI Tokens

Dragoneer led a $1.85 billion primary round at a $60 billion valuation, with annualised revenue above $2 billion across more than 85,000 companies, and the company cash-flow positive. The spend of that money is the interesting part. Ramp is building tooling to track token usage and route workloads to cut inference costs for finance teams. Read that slowly. A corporate card business just became the authority on what your AI consumed, because nobody in your IT function could produce the number and the CFO got tired of waiting. That is not a product gap, it is an ownership gap. The same CFO survey week found 43% of finance teams naming security and data as their biggest barrier to AI, which is the polite way of saying nobody trusts the numbers yet.

Here's what works: Before you buy a FinOps tool, name the person who owns AI cost allocation. A tool without an owner produces a dashboard nobody acts on.

3. Modal Got $15.75 Billion For Billing By The Second

Modal's $750 million Series D pushed its post-money valuation to $15.75 billion, on fifteen times year-over-year growth and a $1 billion annualised run rate that CEO Erik Bernhardsson put on the record. It sells serverless, multi-cloud compute, which means every dollar of that run rate was generated one execution at a time by somebody else's workload. Hold that next to the other half of the same industry, where AI data centre operators are struggling to secure funding at all. Both sell compute. One sells it by the second with a meter attached, the other sells capacity, which is a promise about usage that has not happened yet. In a week when lenders are nervous, only one of those two can be checked.

Here's what works: For your three biggest AI suppliers, write down what unit they bill you in. Anything billed per seat or per year is a forecast, not a measurement.

Quick hits:

• New Zealand's central bank put AI inside its supervision file. The Reserve Bank and the Financial Markets Authority set out expectations for managing cyber risk from frontier AI, covering governance, board oversight and third-party dependencies, which means your model vendor is now a named prudential risk rather than a procurement line.
• Two arch-rivals funded the same analytics company. Databricks Ventures led Sigma Computing's $80 million Series E with Snowflake alongside it, on a business making around $200 million from BI, so the warehouse war has quietly agreed that the layer sitting on top of both of them is worth protecting.
• Claude closed a 25-year-old cryptography question. Anthropic's model cracked a long-standing NSA curve mystery, and it is the honest counterweight to everything above: the capability keeps compounding while the accounting catches up.

Advertisement

Signal vs. Noise

🟢 Signal: Anthropic. Anthropic took a firmer grip on everything else moving on Friday while the volume of talk about it dropped by a fifth, and the two reasons are in the same file: it is named in Brussels' first AI Act enforcement request, and its own listing numbers are now being argued over in public. Most coverage is still reading it as a model race.

🔴 Noise: Microsoft. It pulled the heaviest volume of any company we track on Friday while losing its hold on everything else moving, and almost all of that volume is Copilot licensing comparisons and adoption how-tos. The part that touches your estate is the prompt-injection exposure sitting under the same product, and that got a fraction of the words.

From the 190K

We scanned 190,000 articles this week. Here's what no one's talking about:

A Swedish industry coalition went live sharing 1,152 Blackwell Ultra GPUs between its members, North.cloud's $60 million is going into automating cloud, AI and data spend control, and CarbonAI took $12 million to automate commercial property loan underwriting.

A data centre wire, a cloud operations outlet and a property finance brief filed these as three unrelated stories. Read on the same morning they are one story, and all three are selling the same thing: a defensible number for how much of a shared expensive asset somebody actually used. The Swedish coalition needs it to split a GPU bill between companies that compete with each other. The spend tool needs it to split one cloud invoice between teams. The lender needs it to price one building against the others on its book. When an asset gets too expensive for one owner, the meter stops being plumbing and becomes the product.

On Monday, find out who inside your company can produce a per-team number for AI spend. If the answer is nobody, you have already lost next year's allocation argument.

Advertisement

By The Numbers

• Modal raised $750 million at a $15.75 billion valuation — on a $1 billion annualised run rate and fifteen times year-over-year growth, which is a receipt rather than a projection.
• Ramp raised $1.85 billion at $60 billion, with annualised revenue above $2 billion — across more than 85,000 companies, and cash-flow positive, which is rarer at this size than the valuation is.
• Sigma Computing is making about $200 million from business intelligence — enough for Databricks Ventures to lead its $80 million round and for Snowflake to put money in beside its biggest competitor.
• A Swedish industry coalition is sharing 1,152 Blackwell Ultra GPUs — one pool, several member companies, and a billing question nobody had to answer when everyone bought their own.
• 43% of finance teams name security and data as their biggest AI barrier — from the Controllers Council's CFO adoption session, and it is the reason the cost tooling is arriving from finance rather than from IT.
• See what's rising across AI and data this week →

Deep Dive: Per Play, Not Per Pressing

A record does not earn money because it exists. It earns per play, logged, counted and paid out months later by somebody whose entire job is the counting. Pressing a thousand copies proves only that you spent money on vinyl.

A run rate is a log you let other people read

Modal did not raise on a story about inference demand. It raised on a billion dollars of annualised billings generated one execution at a time, and it let the number be published. Ramp did the same with $2 billion of annualised revenue across 85,000 customers. Neither number is a forecast. Both are receipts somebody else wrote.

A building bills nobody until it does

The capacity side of this industry owns real assets and cannot show the same page. A fifteen-year lease on a data hall is a promise about usage that has not happened yet, financed at today's rates. That is the whole reason serverless compute tripled its valuation in the same week that operators with concrete in the ground could not close a round.

The regulator is reading receipts too

Brussels did not ask the two labs what their models are capable of. It asked what happened, in which environment, reaching whose systems. An enforcement request is a usage log with lawyers attached. Any organisation that cannot produce one for its own agents is holding exactly the same empty page as the data centre operators.

What Actually Works

1. Name the unit on every invoice: for your top five AI suppliers, write down what you are billed per. Per seat and per year are forecasts; per call, per token and per second are measurements.
2. Turn on the log before you need it: export an agent action log from your largest AI platform this month. If nobody has ever done it, you do not have one, whatever the contract says.
3. Give cost allocation an owner: one named person who can produce AI spend per team on request. Without that, finance buys the tool and IT ignores the output.
4. Separate capability claims from usage claims: in your next vendor review, ask what the model can do and what it did last quarter, as two different questions. The gap between the answers is your risk.

Anybody can press a thousand records. Ask how many got played.

What's Coming

The First AI Act File Sets The Template

The Requests for Information to OpenAI and Anthropic will decide, in practice, whether model testing sits inside the Act's scope. Whatever the AI Office accepts as an adequate answer becomes the evidence standard every European deployment gets measured against, and it will arrive as a procurement question long before it arrives as a fine.

Earnings Season Becomes The Referendum

With the AI rally wobbling, attention is turning to earnings. The question on the calls will not be how much capex is planned, it will be what the previous capex returned. Expect ”AI revenue” to be redefined in at least one transcript this fortnight, and expect the redefinition to be generous.

The Next Data Centre Raise Gets Priced On Usage

Operators are already finding funding hard to secure. The ones who clear a round in the next quarter will be the ones who can show contracted, metered consumption rather than signed capacity, and that shift will reach your own supplier's price list within two quarters of it reaching their lenders.

For Your Team

Monday's meeting prompt: ”If a regulator asked us tomorrow what our AI agents did last month, what could we actually hand over? Name the system it would come from, and name the person who would run the export. If either answer is blank, that is our real AI risk, not the model.”

Share-worthy stat: A corporate card company raised $1.85 billion at a $60 billion valuation, and part of that money is going into tooling that counts AI token usage. The cheapest read of that: the people selling you AI could not tell your finance team what it cost, so somebody else built the meter and will now charge you for it.

Go deeper: Track where AI money is actually landing in real-time →

The Track of the Day

”The tool is not the strategy.”
Ryan Steck, Controllers Council CFO session

He said it about platform selection, and it survives being pointed at this whole week. Three parties went looking for the same thing and none of them wanted a demo. The regulator wanted a record, the investors wanted a run rate, the CFO wanted an allocation. Same request, three letterheads.

We scanned 190,000 articles this week so you don't have to. Data Pains → Business Gains.

Published: October 18, 2026 | Curated by Yves Mulkers @ Ins7ghts