AI Act: the guide for Italian companies

The AI Act is the European regulation governing the development and use of artificial intelligence systems in the Union: the Regulation (EU) 2024/1689, in force from 1 August 2024 and applied in phases until 2028. It does not prohibit AI: it ranks it by level of risk and assigns obligations proportionate to that risk. The more the system can affect people's lives, the more documentation, control and transparency requirements increase.

For most Italian SMEs the good news is this: almost all daily uses fall into the low or minimal risk bands, where there are no heavy obligations. The problem is therefore not "the AI Act overwhelms me", but to understand in which box the systems you really use fall, and not accidentally find yourself in a more severe box.

This guide explains how classification works, who has what obligations, with what times after the changes of the Digital Omnibus on AI of 2026, and from where it is better to start concretely, without legalism and without alarmism.

What is the AI Act and why does it exist

The AI Act is a European regulation: it applies directly in all Member States, without the need for a national law to transpose it. The logic is the same that Europe has been using for decades for product safety: before putting something on the market that can do harm, you need to show that it meets certain requirements.

Novelty is the object. Here the "product" is a system that makes decisions or produces outputs independently, and the possible damage is not just physical: it is discrimination, surveillance, manipulation, wrong decisions about people who have no way to dispute them.

Hence the implantation: You don't regulate the technology itself, you regulate the use you make of it.. The same language model is irrelevant if it summarizes meeting minutes and becomes highly regulated if it filters curriculum.

In Italy the regulation is flanked by the Law 132/2025, effective October 10, 2025. Designates AgID and ACN as national AI authorities, adds rules for jobs and professions and declares that it does not create new obligations for systems and models compared to the AI Act (Art. 3, paragraph 5).

What are the levels of risk

The classification is four steps. It is the part that matters the most, because it establishes everything else.

The real jump is between "limited" and "high". Below that threshold is about being honest with people; above, you enter a document compliance regime that requires structured work. I talk about it in detail in risk levels of the AI Act.

Who has the obligations: supplier or user?

It's the distinction that companies make most often, and the one that determines how much work touches you.

Heavy obligations (risk management system, technical documentation, data governance, conformity assessment) fall on supplier. The user has more contained obligations: use the system according to instructions, ensure human surveillance where expected, inform the people involved.

When obligations are triggered

The AI Act does not apply all at once. Dates are set by the Rule 113 of the Rules of Procedure, and for the high risk changed her Digital Omnibus on AI, Regulation (EU) 2026/1744 in force from 27 July 2026.

1. February 2, 2025. Prohibitions of unacceptable practices and the obligation of literacy of Article 4 (Article 113(a)). Bans do not allow gradual adaptation.
2. 2 August 2025. Obligations for model providers for general purposes, those behind the assistants we use every day, more governance and sanctions (Article 113(b)). They are about who the models produce them.
3. 2 August 2026. General application and transparency of Article 50 (Art. 113). It is the date that touches those who have a chatbot or publish deep fake.
4. December 2, 2027. Obligations for high-risk systems in Annex III, such as personnel selection and credit (Omnibus). Before the Omnibus the date was August 2, 2026.
5. 2 August 2028. Obligations for AI as a safety component of products regulated in Annex I (Omnibus). Before it was August 2, 2027.

The full schedule, with intermediate dates and rules for systems already on the market, is in when the AI Act comes into force. These are rules with progressive implementation and evolving guidelines, Always check official sources before making decisions with legal impact: this guide serves to guide you, it does not replace an opinion.

What really changes for an Italian SME

Here one thing must be said which is lost in the debate: for the vast majority of SMEs the AI Act does not impose new red tape.

If you use generic assistants to write emails, summarize documents, prepare drafts, organize internal data, you are at minimal risk. No register, no certification, no conformity assessment. The only rule that applies to all is the literacy of Article 4: from 27 July 2026, with the text rewritten by the Omnibus, calls for measures that support the skills of those who use AI, without a specific level to be guaranteed.

True obligations come in three concrete situations:

• Use AI for deciding on people: filter candidates, evaluate employees, assign tasks based on behavior or personal characteristics, evaluate creditworthiness. For these high-risk systems the obligations start from 2 December 2027 (Reg. (EU) 2026/1744).
• The AI talk to your customers: chatbots, agents, voice assistants. Since August 2, 2026 people need to know that they are talking to a system (Art. 50).
• Developments and sales AI systems to others. In that case you are a supplier, and the speech changes completely.

The second point is the one that touches more companies. If you have a AI Chatbots or a AI Agent on the site, the practical rule is simple: state it clearly, at the latest at the first interaction, as requested by the Article 50(5). One line at the beginning of the conversation is enough.

Two Italian rules are added for those who work with people. The professional must tell customers which AI systems he uses, with clear language (law 132/2025, art. 13); the employer informs workers about the use of AI in the cases of Article 1-bis of Legislative Decree 152/1997 (Art. 11). How much you risk if you are wrong is explained in AI Act sanctions.

Four cases, four levels of obligations

Studio accountant with 6 collaborators. Use an AI assistant to summarize circulars and prepare customer response drafts. For the AI Act it is minimal risk: the training of those who use it remains. The Law 132/2025 asks the firm to inform customers about the AI systems employed. The real theme remains the GDPR, because in the documents there are customer data: the right question is where do those data end, deepened in GDPR and AI in the company.

E-commerce with assistant on site. The assistant answers questions about products, shipments, returns. Limited risk: from 2 August 2026 the obligation of transparency of the Art. 50. It is resolved by declaring that it is an automatic system. The switch to a human operator when the request comes out of the sown does not ask for it by the AI Act, but avoids several complaints.

Manufacturing company filtering CVs. Here everything changes. A system that selects candidates affects access to work: it is high risk (Annex III), with obligations applicable from 2 December 2027 after the postponement of the Omnibus. Real human surveillance will be needed (not a final stamp on a list already decided), use according to instructions, preservation of logs, information to people. If the system is from an external supplier, much of the technical obligations are his, but the obligation to use it properly remains with the company.

Agency that sells a chatbot under its own brand. The agency has become a supplier. It cannot just turn the responsibility to the upstream vendor: by answering by its own name, it assumes the corresponding obligations.

AI Act and GDPR: how they fit together

The most common confusion is to think that the two norms overlap or that one absorbs the other. It is not like this: look at different objects of the same project.

The GDPR looks at data: who are the people involved, on what legal basis they treat their information, where they end up, how long they stay. The AI Act looks at the system: what it does, how autonomous it is, what consequences it can produce, how it is documented.

A project can fall into only one of two perimeters. An assistant who summarizes technical manuals without people's names is outside the GDPR but within the AI Act as a minimum risk. A spreadsheet that processes employee data with traditional formulas is within the GDPR and completely outside the AI Act, because there is no artificial intelligence system.

In the practice of Italian SMEs the order of priority is clear: the GDPR applies sooner, more often and with controls already run. The AI Act becomes relevant when the system begins to affect decisions that affect people. The full path on the first front is in GDPR and AI in the company, that on the data entered in the instruments in Business Data and AI.

The most frequent case: AI entering without permission

There is a situation that in Italian SMEs precedes any regulatory reasoning, and that no guidebook mentions: The company already uses AI without knowing it.

Not out of malice. A collaborator found a convenient tool and uses it to prepare responses to customers. The salesperson pastes the contact list to have a segmentation done. Someone in administration uploads invoices to a data extraction service. No one authorized it, no one banned it, and no one surveyed it.

When then the company decides to "take care of AI Act", it starts from the official systems, which often do not yet exist, and completely ignores the real ones. The result is an assessment describing an imaginary company.

• Ask without an investigative tone what tools people really use
• Include browser extensions and AI functions already present in the software you have
• It also marks occasional uses: they matter as much as systematic ones
• Do not punish those who answer honestly, or the next time will not answer

This census is worth more than any regulatory advice done on the table, and is also the starting point for understanding where AI is already producing value. Many companies discover their best use cases here, those described in examples of AI automation in the company and in AI for SMEs: a practical guide.

Mistakes that make you spend poorly on the AI Act

• Treating AI Act compliance as something to buy. Before signing compliance packages, check which band you're really in. Many companies pay for obligations they don't have.
• Planning on the dates before the Omnibus. For Annex III the high risk shall no longer depart on 2 August 2026 but on 2 December 2027 (Reg. (EU) 2026/1744); however, transparency has not been postponed.
• Confusing it with the GDPR. They are two different things and they coexist. In Italian practice the GDPR bites sooner and more often.
• Forgetting rebranding. Reselling a third party solution with its own logo changes the legal role, and with it the obligations.
• Considering human oversight a formality. A human who approves without being able to understand or overturn the decision is not surveillance: it is a signature.
• Waiting for the deadline to make the inventory. Inventory is useful regardless: in most cases it shows that you are quiet, and it costs a few hours.

The six-step route, from inventory to reassessment

The practical path is shorter than it seems.

1. Inventory. It lists the AI systems actually in use: who uses them, for what, on what data. It includes ‘informal’ things, such as the contributor pasting documents into a public assistant.
2. Classification. For each one, in which band it falls. In most cases they all end in "minimum".
3. Role. For each: are you a supplier or user? If you sell something with your brand, report it immediately.
4. Transparency. Where AI talks to customers or employees, state it. It is the most frequent fulfillment, mandatory since August 2, 2026 (Art. 50).
5. Policy and training. Few pages that say what can and cannot be done, and especially what data should never be glued into external tools, plus a basic training for those who use AI. See How to Write a Business Policy on AI.
6. Reassessment. When the use changes, it changes the classification. A system born to summarize that begins to filter candidates has changed band.

Point 1 is what matters. In most cases the inventory closes the issue: it turns out that the company uses few minimum risk tools, and all the work is reduced to training, policy and a line of transparency on the chatbot.

Where to start, with the right dates in hand

The AI Act is less frightening and more concrete than how it is told. It regulates by risk, charges serious obligations on those who supply systems that affect people, and essentially leaves the daily uses of productivity free.

For an Italian company the useful sequence is: taking inventory, classifying, arranging transparency where AI talks to someone, training those who use AI and writing an internal policy. The rest comes only if you are really building or using high-risk systems, and in that case the Omnibus gave you until December 2, 2027, or August 2, 2028 if the AI is inside a regulated product (Regulation (EU) 2026/1744).

If you want to introduce AI into your processes from a clear map of what you use and what band it falls into, let's start from there in a AI consulting for SMEs. You can also see some working systems in The Lab, or start from the overview on AI for businesses.