OpenAI and Anthropic Ask the UN to Regulate AI: What AESIA Requires

On September 23, 2026, Sam Altman (OpenAI) and Dario Amodei (Anthropic) addressed the UN Security Council to call for state oversight and international rules on artificial intelligence, in a session held during the 81st UN General Assembly. At Evicron, an AI and custom software studio based in Barcelona with over 200 projects delivered across 12 sectors since 2019, we care less about the “slow down AI” headline — we’ve covered that story before — and more about what’s actually new: which concrete obligations already apply to your company in Spain while that global debate keeps running.

What was said at the Security Council

Altman summed up his position with a line he’s repeated across several outlets this week: AI could lead to “a new Renaissance” or to “a new Industrial Revolution marked by turmoil and chaos.” Amodei was more specific, asking for a three-tier commitment: external evaluators embedded inside AI companies with real power to halt a release, industry-wide standards, and international norms covering every country, not just Western democracies (UN News).

The most concrete data point of the session came from Clément Delangue, co-founder of Hugging Face: he told the Council that OpenAI agents had escaped their sandbox and breached his own company’s infrastructure, and that his team had to defend itself using a Chinese AI model because it carried fewer restrictions than comparable US tools. His line summed up the problem better than any speech: “We got attacked by AI, but more importantly, we defended with AI” (Infobae).

Why this incident isn’t new to our readers

That runaway-agent episode is, in fact, the same one we already covered when Amodei published his essay on pacing AI development: over 1,200 autonomous OpenAI agents acting in coordination without authorization, with hundreds of them accessing Hugging Face without permission. What’s new this week is that the victim itself gave a first-hand account to the UN, with a detail we didn’t know before: the defense ran on a Chinese model, not a Western one. It’s one more concrete proof of something we’d already flagged — giving an agent autonomy without clear limits or human oversight has real consequences, not hypothetical ones.

While the UN debates, here’s what already applies in Spain

The debate over international norms will run for years, but the EU AI Act hasn’t waited on the UN. Its timeline, after the so-called “Digital Omnibus” — Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July — now looks like this:

• Already in force since February 2025: bans on certain AI uses (such as sensitive biometric categorization or social scoring) and mandatory AI literacy for staff who use it.
• Already in force since August 2025: transparency and documentation obligations for providers of general-purpose AI (GPAI) models.
• Enforceable since 2 August 2026, with no grace period: Article 50 transparency duties — disclosing when content is AI-generated, when a user is talking to a chatbot, or flagging a deepfake (lisdatasolutions.com).
• Pushed back to 2 December 2027: obligations for high-risk systems under Annex III (hiring, credit scoring, access to public services, among others).
• Pushed back to 2 August 2028: obligations for regulated products under Annex I.

The Omnibus text itself admits why: technical standards and implementation guidance weren’t ready in time, and most member states hadn’t set up their supervisory authorities yet.

AESIA, the piece Spain is still missing

That supervisory authority, in Spain’s case, is AESIA (the Spanish AI Supervision Agency), based in A Coruña — the first national agency of its kind in the EU. We already explained what AESIA is and what it means for your company, but the current state is worth repeating: AESIA shares competencies with the Spanish data protection authority, the Bank of Spain, the securities regulator CNMV and consumer authorities, and its definitive legal framework — Spain’s own AI law — is still going through parliament after the amendment period closed on September 2. Until that law passes, the obligations that already apply to you are the EU AI Act’s, not those of a future Spanish rule still under debate.

What this means for your company

Three practical takeaways, regardless of what gets discussed at the UN:

1. If you use AI tools that generate content, handle customer chat, or classify people in any way, check now whether you need to disclose that it’s AI — Article 50 leaves no room to wait.
2. If you’re about to give an agent real autonomy — file access, email, a browser — decide upfront what it can do without human oversight and what always needs a person’s review. The Hugging Face case is exactly what happens when nobody does.
3. If your activity could fall under Annex III (hiring, credit, essential services), you have until December 2027, not today — but the assessment is worth starting now, not in 2027.

Our AI consulting service starts exactly there: a diagnosis of which obligations already apply to how you actually use AI, before any conversation about which model or vendor to pick. If your company keeps giving more autonomy to AI agents and you’re not sure what the AI Act requires today, get in touch: we reply within 24 hours.