Does the AI Act apply to us if we only use tools like ChatGPT?

Yes, as a “deployer”: the obligations are lighter than for providers, but they exist. You must take measures supporting the AI literacy of the staff who use the tools (Article 4), comply with the transparency rules of Article 50 where they apply to you — for example when you publish deepfakes, or AI-generated texts on matters of public interest — and keep respecting the GDPR whenever personal data go into the tool.

Has the Digital Omnibus postponed the AI Act?

Only in part. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk deadlines to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I products). The prohibitions have applied since 2 February 2025, the transparency obligations since 2 August 2026, and new prohibitions on non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.

We are not based in the EU. Does the AI Act still apply?

It can. The Regulation applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU when the output of the system is used in the Union (Article 2). If you sell or use AI-based services for customers or staff in Italy, it is worth checking.

Under Article 99: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of the other obligations, up to €7.5 million or 1% for misleading information to the authorities. For SMEs and start-ups the lower of the two amounts applies.

Do you certify AI systems?

No. The conformity assessment of high-risk systems is carried out by the provider and, where required, by notified bodies. Our work is legal and out-of-court: mapping, classification, policies, contract clauses and documentation. GF Lex Consulting is the legal consultancy of Dr. Giuseppe Foti, legal consultant — not a law firm.

Area · AI compliance

AI Act compliance

Out-of-court legal support for businesses that build, sell or simply use artificial intelligence in Italy: which AI systems you have, which obligations apply to each, and the documents that prove you comply. In English, remotely.

Who it’s for

Who turns to the practice

Companies using AI tools

Chatbots for customers, AI in recruiting, generative tools used by staff every day: you are a “deployer”, with obligations of your own — often without knowing it.

Companies building or reselling AI

Software houses, start-ups and integrators that develop AI features or put them on the market under their own name: the provider’s obligations are the heaviest.

Foreign companies operating in Italy

Groups with staff or customers in Italy, where the AI Act is joined by a national AI law and by new rules on corporate liability.

The timeline

What applies and when

Since 2 February 2025 — prohibited practices (Article 5) and AI-literacy measures for staff (Article 4).
Since 2 August 2026 — general application and transparency obligations (Article 50): recognisable chatbots, labelling of synthetic content.
From 2 December 2026 — new prohibitions added by the Digital Omnibus: AI that generates non-consensual intimate imagery or child sexual abuse material.
From 2 December 2027 — high-risk systems listed in Annex III (for example recruiting, credit scoring, education).
From 2 August 2028 — high-risk AI embedded in regulated products (Annex I).

The Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — postponed the high-risk deadlines only. Everything else is already running.

The services

From the inventory to the paperwork

AI inventory & risk classification

A map of the AI systems you build or use, your role for each (provider, deployer, distributor) and its risk class: prohibited, high-risk, transparency-only or minimal.

AI use policy & staff literacy

Internal rules on which tools may be used, with which data and under which checks, plus the AI-literacy measures Article 4 requires — tailored to the way your teams actually work.

Transparency (Article 50)

Disclosures for chatbots and AI-generated content, wording for your website and terms, and the documentation showing that people are told when AI is involved.

High-risk readiness

Deployer duties for high-risk systems — use according to instructions, human oversight, monitoring, logs — and the fundamental-rights impact assessment where Article 27 requires it.

AI and the GDPR

Legal basis, information notices, data protection impact assessments and safeguards on automated decisions (Article 22 GDPR): the regime that already applies in full to any AI handling personal data.

AI vendor contracts

Clauses for buying or selling AI-based services: roles and responsibilities under the AI Act, data use, confidentiality and liability — so the contract matches the obligations.

The Italian layer

In Italy the AI Act is joined by Law No 132 of 23 September 2025, the national AI law in force since 10 October 2025 — with transparency duties towards workers on the use of AI systems — and by Legislative Decree No 160 of 9 September 2026, which added AI offences to the corporate liability regime of Legislative Decree 231/2001. Companies with a Decree 231 model should check whether it needs updating; see also our Decree 231 compliance service.

Legal references

Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (Digital Omnibus on AI); Regulation (EU) 2016/679 (GDPR); Italian Law 132/2025; Legislative Decree 160/2026; Legislative Decree 231/2001.

How it works

Three steps, remotely

Request

Tell us what your company does and which AI tools it builds or uses: a short list is enough to start.
Analysis

We review the systems, your role and the applicable deadlines, then agree scope, timing and fee in writing.
Delivery

You receive the inventory with its risk classification and the documents ready to use: policy, disclosures, clauses, action plan.

Want the background first? Read our guide AI Act: what changes for businesses. Based in Rome (CET), working in English.

Starting prices

Video consultation from €40/hour Request a quote

Final prices, no VAT added. The exact fee is in the free written quote you receive before we start. All prices

FAQ

Frequently asked questions

Does the AI Act apply to us if we only use tools like ChatGPT?: Yes, as a “deployer”: the obligations are lighter than for providers, but they exist. You must take measures supporting the AI literacy of the staff who use the tools (Article 4), comply with the transparency rules of Article 50 where they apply to you — for example when you publish deepfakes, or AI-generated texts on matters of public interest — and keep respecting the GDPR whenever personal data go into the tool.
Has the Digital Omnibus postponed the AI Act?: Only in part. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk deadlines to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I products). The prohibitions have applied since 2 February 2025, the transparency obligations since 2 August 2026, and new prohibitions on non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.
We are not based in the EU. Does the AI Act still apply?: It can. The Regulation applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU when the output of the system is used in the Union (Article 2). If you sell or use AI-based services for customers or staff in Italy, it is worth checking.
What are the fines?: Under Article 99: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of the other obligations, up to €7.5 million or 1% for misleading information to the authorities. For SMEs and start-ups the lower of the two amounts applies.
Do you certify AI systems?: No. The conformity assessment of high-risk systems is carried out by the provider and, where required, by notified bodies. Our work is legal and out-of-court: mapping, classification, policies, contract clauses and documentation. GF Lex Consulting is the legal consultancy of Dr. Giuseppe Foti, legal consultant — not a law firm.

Insights

Related insights

All insights →

Contact

Using AI and not sure what applies?

Send us the list of tools you build or use: we tell you which obligations apply and what it costs to put them in order.

Get in touch

First reply within one business day. The first contact is free and carries no obligation.