The companies building the most powerful AI systems themselves warn of losing control over them. For that case every country needs someone in charge: a body that checks, intervenes and takes complaints. Austria still has no such body, 14 months after the EU deadline. We demand that someone takes responsibility now. Here is what we have filed to get there, and below, two templates you can use to add pressure yourself.
Why this is not a formality
What can happen. In July 2026, AI agents broke out of their test environment during an OpenAI safety evaluation and attacked the systems of Hugging Face: about 17,600 times in four and a half days. In Australia, a model accessed a government health portal on its own, and the government only learned of it three months later, from the developer. The incidents
What is missing. If this happens in Austria, nobody is in charge. No supervision, no complaint route, no sanctions. Whoever reports a danger reaches no one.
What we demand. A responsible body, as fast as possible. The proceedings below are one way there. Others run in parallel: the Call, the letters to parliaments in Austria, Germany, Switzerland and the EU, and the proposal for a crisis team.
Austria · Ombudsman Board
Review of maladministration
Filed
9 September 2026
Status
On 28 September 2026 the Ombudsman Board asked the Federal Chancellery for an explanation. Reference 2026-0.782.410. On 6 October we replied and submitted the new incidents.
What we ask
Clarify why no authority has been designated and who is responsible.
What happens next
The Federal Chancellery answers the Ombudsman Board, which then informs us. The Ombudsman Board can establish maladministration but cannot order anything.
Filed. Case number to follow. On 6 October we supplemented the complaint with the new incidents (addendum on urgency) and asked that Austria designate at least a provisional reporting point until it names an authority. The same day, the Commission's AI Office replied to our inquiry about Austria: the Commission continues to assess national implementation in all Member States, including Austria.
What we ask
The Commission should examine whether Austria is in breach of Articles 28 and 70 of the AI Act, require the designation and, if necessary, open infringement proceedings (Art. 258 TFEU).
What happens next
Acknowledgement with a reference number, usually within 15 working days. The Commission aims to decide within one year whether to open proceedings.
The Commission should treat the complaint as a priority, disclose which countries are still in default and obtain a statement from Austria. The committee should discuss the matter in public.
What happens next
The committee decides whether the petition is admissible. A summary is then published on the petitions portal, and every EU citizen can support it with one click.
Tell me when I can support it
We write to you once, when the petition is online. Nothing else.
EU · AI Office
Complaint under Art. 85 AI Act over the OpenAI breakout
Filed
6 October 2026, case SIP0001484
Status
Filed with the Commission's AI Act Service Desk. Acknowledgement received.
What we ask
To know whether the AI Office received reports on the Hugging Face and Australia incidents and what it did. And who receives an incident report and intervenes in a country without an authority, such as Austria.
What happens next
Written reply and case number.
Germany · Federal Network Agency
Complaint under Art. 85 AI Act over the OpenAI breakout
Filed
6 October 2026
Status
Filed through the AI complaints office of the Bundesnetzagentur. Reference number to follow.
What we ask
An examination of the incident and information on whether and how German bodies learn of such incidents.
What happens next
Reference number, then a reply on the merits.
Switzerland · Federal Council
Two petitions: who stops an AI system in Switzerland?
Filed
6 October 2026
Status
Sent to OFCOM for forwarding to Federal Councillor Rösti (petition under Art. 33 of the Federal Constitution) and to the Federal Chancellery.
What we ask
A duty to report serious AI incidents and a body that is responsible and can stop a system. Switzerland has no AI law.
What happens next
Reply from the Federal Council.
Template 1 · for citizens in the EU
Your country has not designated an authority either?
According to the Commission's list (as of 7 September 2026), the authority is missing not only in Austria but also in Belgium, Bulgaria, Croatia, Hungary and Slovakia. For further countries, the list shows the designation as not yet final. Any citizen can file a complaint with the Commission: free of charge, without a lawyer, in any official EU language.
Check the listIs there a dash next to your country? Commission list
Paste the textCopy the template and replace the parts in square brackets.
Attach evidenceA screenshot of the list is enough. Then drop us a line at contact@ASIresilience.org so we can keep count.
Complaint: [COUNTRY] has not designated the authorities required by Regulation (EU) 2024/1689 (AI Act)
1. Provisions breached
Article 28(1) and Article 70(1) and (2) of Regulation (EU) 2024/1689. Every Member State had to designate at least one market surveillance authority and one notifying authority by 2 August 2025 and notify them to the Commission.
2. Facts
In the Commission's list of single points of contact for market surveillance under the AI Act, [COUNTRY] is shown with a dash (page last updated [DATE], https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act). To my knowledge, no designation has been published in [COUNTRY]. [Optional: a national source, such as a government page or news report.]
3. Consequence
Article 85 gives every natural and legal person the right to lodge a complaint with the market surveillance authority. In [COUNTRY] this right has no addressee. Nobody supervises the obligations that have applied since 2 August 2025.
4. Why this is urgent
The developers of the most powerful AI systems themselves warn of losing control over them. AI agents have already been documented deceiving people, deleting data against instructions and breaking into government systems. Without a competent authority, nobody in [COUNTRY] can receive, examine or stop such incidents. This is not a formality. It is about someone being in charge when it matters.
5. Request
I ask the Commission
- to examine whether [COUNTRY] is in breach of its obligations under Articles 28 and 70 of Regulation (EU) 2024/1689,
- to require the designation and notification of the authorities and, where necessary, to open infringement proceedings under Article 258 TFEU,
- to inform me of the reference number and of the progress of the case.
I make no allegation against any company. This concerns the enforcement of a regulation in force. A similar complaint concerning Austria was filed on 30 September 2026 (form ID 96039).
Attachment: screenshot of the Commission list of [DATE].
[First and last name]
You can file in any official EU language. English works everywhere.
Template 2 · wherever you live
Ask your municipality
When systems that are now digitally controlled fail, municipalities are hit first: power, water, payments, administration. Ask whether yours is prepared. Send the request to your town hall, to the mayor, or to the office responsible for emergency and civil protection where you live.
Fill in the bracketsName of the municipality, your name, your address.
Send itBy email or letter. Asking as a resident is your right.
Share the answerIf you like, send it to us at contact@ASIresilience.org. We publish nothing without your consent.
Subject: Request: How is [MUNICIPALITY] prepared for a failure of digitally controlled services?
Dear Sir or Madam,
I live in [MUNICIPALITY]. More and more of daily life depends on networked and increasingly AI-controlled systems: the power grid, water supply, payments, administration. If they fail for a longer time, through an error or an attack, municipalities are hit first.
I would be grateful for answers to four questions:
1. Does [MUNICIPALITY] have a plan for an outage of power, telephone, internet and payments lasting more than 72 hours? Where can I read it?
2. Who in the municipality is responsible, and how can I reach them when telephone and internet are down?
3. Are there emergency meeting points, and where are they?
4. Does the planning take into account that such outages can now also be caused by faulty or attacked AI systems?
I am asking as a resident who wants to be prepared. A short answer is enough.
Yours faithfully,
[First and last name]
[Address]
We are not lawyers. The templates are drafting aids. You file in your own name.