Henna Virkkunen is Executive Vice-President of the European Commission for Tech Sovereignty, Security and Democracy for the 2024–2029 term, and holds the Commission's Digital and Frontier Technologies portfolio (Source: commission.europa.eu). She is the senior political figure behind implementation and enforcement of the EU AI Act and the Commission's public voice on it, and is frequently identified in reporting as the EU's technology chief. A Finnish politician of the National Coalition Party, she served in the European Parliament from 2014 to 2024.
Background
Virkkunen chaired the Jyväskylä City Council from 2005 to 2008 and was Vice-Chair of the Central Finland Regional Council from 1999 to 2005. She sat in the Finnish Parliament from 2007 to 2014 and held three ministerial posts in that period: Minister of Education (2008–2011), Minister of Public Administration and Local Government (2011–2014) and Minister of Transport and Local Government (2014). She was Vice-Chair of the National Coalition Party from 2008 to 2014 and a Member of the European Parliament from 2014 to 2024, before taking up the Executive Vice-Presidency in 2024 (Source: commission.europa.eu).
Portfolio
The Commission describes the Tech Sovereignty, Security and Democracy brief as combining internal and external security and border policy with responsibility for freedoms, justice and democracy. The Digital and Frontier Technologies half of the portfolio covers the 2030 Digital Decade targets and the 2026 review of their implementation strategy; work on AI innovation including an Apply AI Strategy and the establishment of a European AI Research Council; an EU Cloud and AI Development Act and a single EU-wide cloud policy; a long-term EU Quantum Chips plan; a Digital Networks Act; enforcement under the Digital Services Act and the Digital Markets Act; digital public infrastructure including the EU wallet; a European Data Union Strategy; and work on e-commerce platforms, unethical online techniques and cyberbullying (Source: commission.europa.eu).
Her declaration of interests was published on 23 January 2026, and President von der Leyen's mission letter to her is dated 1 December 2024 (Source: commission.europa.eu).
AI Act implementation and enforcement
The Commission exercised its AI Act enforcement powers for the first time during the week of 24 August 2026, ordering information from developers of the most advanced models on cybersecurity, safety and copyright compliance. Virkkunen described the step in an interview published 26 August 2026, declining to name recipients but confirming that some developers of the "most advanced" models had received requests, and saying that "all the providers are not covered with this request for information because, with some of them, we have already had very close dialogue during the last months." She characterised the security requests as concerning protections for the models and their physical infrastructure — "it's very much about how they are mitigating the risks, to prevent humans or AI from stealing the model" — along with external-evaluator access, follow-up on outside safety recommendations, and post-release monitoring (Source: euractiv.com). The requests were issued through the AI Office, which sits within her portfolio.
Speaking at Web Summit Rio on 12 June 2026, she said the AI Act does not need updating to cover AI agents, on the reasoning that the technology-neutral law already reaches them through its generative-AI and risk-mitigation provisions. In the same remarks she said "nothing" in the Digital Markets Act blocks Apple from launching Siri AI in Europe, and that the EU is unlikely to take equity stakes in AI labs (Source: axios.com).
On the Act's entry into enforcement she described it as giving "innovators legal certainty while protecting the public interest," and called enforcement "an important step towards AI that people and businesses can understand and trust." She has described AI as "a transformative technology" with benefits for people and businesses while saying that the most advanced models "create risks on an entirely new scale" (Source: helpnetsecurity.com).
Under her portfolio the Commission designated ChatGPT, Reddit and Roblox under the Digital Services Act on 31 August 2026 (Source: ec.europa.eu).
Frontier-model supervision
Virkkunen was among those expected at the European Parliament internal market committee's 6 May 2026 hearing on Anthropic's Mythos model, alongside Sarah Heck of Anthropic, AI Office head Lucilla Sioli and representatives of ENISA. The hearing was the first formal regulatory test of how the AI Act's general-purpose-AI-with-systemic-risk framework applies to a frontier model whose principal public concern is offensive cyber capability (Source: artificialintelligenceact.substack.com).
In a letter disclosed the week of 18 May 2026, 30 Members of the European Parliament from six political groups warned Virkkunen that EU cybersecurity law is "ill-equipped" for tools such as Mythos, and urged that ENISA be given model access (Source: artificialintelligenceact.substack.com).
Transatlantic position
In remarks published 4 September 2026, Virkkunen said the United States and the European Union often end up addressing the same AI safety concerns even where US safeguards emerge through state laws and court cases rather than through statute, adding "I don't see that this is so like black and white." She said the EU is developing a blueprint for pre-deployment testing and trusted partner access (Source: axios.com). The remarks came two days after all G20 members endorsed a US-proposed light-touch framework for AI and other emerging technologies at a US-hosted ministerial in Chapel Hill, North Carolina; her Commission calendar records meetings with the Indian Minister of State for Electronics and Information Technology and with Japan's Minister of Economic Security at Raleigh-Durham on 1 September 2026 (Source: commission.europa.eu). The claim addresses convergence in outcomes rather than in legal instruments; EU vs. US AI Regulation: A Deep Comparison treats the distinction at length.
Open questions
- The content of the pre-deployment testing and trusted-partner-access blueprint she described on 4 September 2026 has not been published.
- Which developers received the August 2026 information requests is not disclosed, and she declined to name them.
Relationships
- regulated-by: — not applicable; she is a regulator.
- depends-on: EU AI Act (Regulation 2024/1689) — the instrument her portfolio implements and enforces
- related: EU AI Office — the Commission body within her portfolio that issues AI Act information requests
- related: Digital Markets Act (EU) — enforcement within her portfolio
- related: Digital Services Act (EU) — enforcement within her portfolio
- related: EU vs. US AI Regulation: A Deep Comparison — the comparison her September 2026 convergence claim bears on
- related: G20 (Group of Twenty) — the September 2026 ministerial her remarks followed
- related: Claude Mythos Preview — the model behind the first frontier-model supervision test in the EU
- related: European Parliament — the institution whose members wrote to her on ENISA model access