The EU warns Microsoft it could be fined up to 1% of its global annual turnover under DSA after failing to provide risk info about its generative AI tools
Context & Ripple Effects
This warning follows the EU's earlier effort to examine whether Microsoft's investment in OpenAI warranted regulatory scrutiny, extending attention from corporate ties to information about generative-AI risks.
It also fits a longer record of EU concerns about Microsoft's compliance posture, including preliminary data-protection concerns over software used by EU institutions. The immediate significance is that the DSA is being used to demand information, not merely to evaluate a completed product decision.
First-order effects
- Microsoft faces a formal DSA compliance exposure, with the EU indicating a potential penalty of up to 1% of global annual turnover if required generative-AI risk information remains unavailable.
- The company must treat documentation and disclosure around its generative-AI tools as an active regulatory obligation rather than a peripheral policy issue.
Second-order effects
- Other companies operating generative-AI services under the DSA will have a clearer incentive to prepare risk-information records that can withstand regulator requests.
- Microsoft's AI governance, legal, and product teams are likely to face tighter coordination pressures, since incomplete risk information can now create a direct enforcement path.
Third-order effects
- If sustained, this approach would make transparency around AI risk management a practical condition of operating large digital services in Europe, alongside product development and distribution.
- The case points toward a broader EU enforcement test of generative-AI risk disclosures; its ultimate reach will depend on how consistently regulators apply DSA information powers across providers.
The trend: Generative-AI oversight is moving from broad policy debate toward disclosure-based enforcement against major platforms.