The European Union is escalating pressure on Microsoft over information it says is still missing about generative AI risks connected to Bing. The warning comes under the Digital Services Act (DSA), the bloc’s online governance regime for major digital services.
At issue is whether Microsoft has supplied the data the Commission asked for after a request for information focused on generative AI tools. The Commission has given Microsoft until May 27 to provide the requested material or risk enforcement action.
Why the EU is pressing Microsoft
Back in March, the EU asked Microsoft and other tech giants for information about systemic risks posed by generative AI tools. On Friday, the Commission said Microsoft had failed to provide some of the documents it requested.
The Commission’s language changed after an update to its press release. An earlier version said the EU had not received an answer from Microsoft. The revised version instead said the Commission was stepping up enforcement action “following an initial request for information.”
The missing information concerns Bing’s generative AI features. The Commission specifically pointed to the AI assistant “Copilot in Bing” and the image generation tool “Image Creator by Designer.”
The EU said its concerns center on risks these tools may pose to civic discourse and electoral processes. That makes the request more than a paperwork dispute: it sits inside the DSA’s broader system for forcing large platforms to assess and reduce systemic risks.
The financial stakes under the DSA
The immediate fine Microsoft faces could reach up to 1% of its global annual turnover. Under the DSA, that standalone penalty can apply when a company gives incorrect, incomplete or misleading information in response to a formal request for information.
For Microsoft, that could amount to up to a couple of billion dollars. The company reported revenue of $211.92 billion in the fiscal year ended June 30, 2023.
The DSA also allows larger fines in other circumstances. Fines under the law can scale up to 6% of global annual revenue. If Microsoft does not provide the missing information by May 27, the Commission may also impose “periodic penalties” of up to 5% of its average daily income or worldwide annual turnover.
Those figures show why the warning matters. For a company of Microsoft’s size, a regulatory demand for data can quickly become a major financial exposure if the Commission decides the response is incomplete.
Why Bing faces extra obligations
Bing was designated as a “very large online search engine” (VLOSE) under the DSA back in April 2023. That status brings an additional layer of duties around systemic risk, including risks linked to disinformation.
The Commission itself oversees the systemic risk obligations for larger platforms and search engines. That gives it a direct enforcement role when it believes a designated service may not be meeting the DSA’s requirements.
The EU’s concern is not only that generative AI tools exist inside a major search engine. It is that those tools can shape what users see, create and share at scale. In the Commission’s view, that makes risk assessment and risk mitigation especially important for services covered by the DSA.
The Commission wrote that the request is based on suspicion that Bing may have breached the DSA over risks linked to generative AI. It listed examples including so-called “hallucinations,” the viral dissemination of deepfakes and automated manipulation of services that can mislead voters.
“Under the DSA, designated services, including Bing, must carry out adequate risk assessment and adopt respective risk mitigation measures (Art 34 and 35 of the DSA). Generative AI is one of the risks identified by the Commission in its guidelines on the integrity of electoral processes, in particular for the upcoming elections to the European Parliament in June.”
Generative AI and election risk
The Commission’s focus on elections is central to the warning. The EU has an election coming up next month, and Brussels is paying close attention to the possibility of AI-fueled political disinformation.
The source article notes several concerns that have already put generative AI in the regulatory frame. Large language models can fabricate information while presenting it as fact. AI-powered image generation tools have also been shown to produce racially biased or potentially harmful output, including misleading deepfakes.
Under the DSA, large platforms must not only identify risks. They must also adopt measures to mitigate them. That is why the Commission’s demand for information matters: without the requested data, the regulator may not be able to assess whether Bing’s generative AI features are being handled in line with the law’s expectations.
For readers following AI regulation, the case illustrates a larger shift. The EU is not only debating abstract AI harms. It is using an existing online governance law to demand concrete information from major technology companies about the systems they have embedded into mainstream services.
Microsoft’s response
Microsoft said it is “deeply committed to creating safe experiences online and working with regulators on this important topic.”
The company also said it has been fully cooperating with the European Commission as part of the voluntary request for information. Microsoft said it remains committed to responding to the Commission’s questions and sharing more about its approach to digital safety and compliance with the DSA.
Microsoft added that across its online services, it takes steps to measure and mitigate potential risks. It also pointed to actions to prepare its tools for the 2024 elections and to help safeguard voters, candidates, campaigns and election authorities.
The company further said it will continue to collaborate with industry peers as part of the Tech Accord to Combat Deceptive Use of AI in 2024 Elections.
The next practical deadline is May 27. By then, Microsoft must provide the missing information or face the possibility of a 1% annual revenue fine and additional periodic penalties.