With Regulation (EU) 2024/1689 — the so-called AI Act — the European Union has adopted the first comprehensive body of rules on artificial intelligence. It is not a rule for developers alone: it also concerns — indeed above all — the businesses that merely use AI, to select staff, profile customers, automate decisions or generate content. It is therefore worth framing what the AI Act provides, to whom it applies, what obligations it introduces, within what deadlines and with what penalties — without alarmism, but aware that compliance must be built in good time.
What the AI Act is and to whom it applies
The AI Act, published in the Official Journal of the European Union on 12 July 2024 and in force since 1 August 2024, governs the development, the placing on the market and the use of artificial-intelligence systems in the Union. It addresses a range of actors: providers (those who develop or place an AI system on the market), deployers or professional users (those who use it in their activity), as well as importers and distributors. Its reach is extraterritorial: the Regulation also applies to operators established outside the Union where the system’s output is used within the Union.
The risk-based approach
The logic of the AI Act is to scale obligations according to the risk a system poses to people’s rights and safety. Four levels are distinguished:
- Unacceptable risk — the practices prohibited by Article 5: among others, social scoring, manipulative or subliminal techniques, the mass scraping of facial images for facial recognition, emotion recognition in the workplace and in schools.
- High risk — the systems listed in the annexes (including AI for staff recruitment and management, access to credit and essential services, education, justice, critical infrastructure, biometrics): permitted, but subject to strict obligations.
- Limited risk — subject only to transparency obligations (Article 50): the user must be informed that they are interacting with an AI (think of a chatbot), and synthetic content, including deepfakes, must be labelled as such.
- Minimal risk — the great majority of systems, freely usable.
What obligations for businesses
For high-risk systems the Regulation requires, on the provider, an articulated compliance system: a risk-management system, data-governance requirements for the training data, technical documentation and event logging, transparency towards users, human oversight, adequate levels of accuracy, robustness and cybersecurity, as well as the conformity assessment and CE marking.
The deployer — the business that uses the system — has its own obligations: to use it in accordance with the instructions, to ensure human oversight by competent staff, to monitor its operation and, in certain cases, to carry out a fundamental-rights impact assessment. Even those who “merely use” AI, then, have precise responsibilities.
The timeline
Application is gradual. The original timeline has been revised by Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 — the so-called “Digital Omnibus” on AI —, approved by the European Parliament on 16 June 2026 and by the Council of the EU on 29 June 2026, published in the Official Journal of the European Union (L series) of 24 July 2026 and in force since 27 July 2026: the regulation has postponed the deadlines for high-risk systems. The updated timeline:
- 2 February 2025: prohibition of unacceptable-risk practices (Article 5) and AI-literacy obligations (the latter subsequently eased by Regulation (EU) 2026/1744: the business must adopt measures supporting the AI literacy of its staff, without having to guarantee a specific level);
- 2 August 2025: obligations for general-purpose AI models (GPAI), governance, designation of the national authorities and the rules on penalties;
- 2 August 2026: general application of the Regulation and, in particular, transparency obligations (Article 50) — recognisable chatbots and the labelling of synthetic content, with a window until 2 December 2026 for providers of generative systems already placed on the market before 2 August 2026 to comply with the technical marking obligation (Article 50(2)) — and the start of supervisory and enforcement activity (the rules on national authorities and penalties have been applicable since 2 August 2025);
- 2 December 2026: new prohibitions inserted into Article 5 by Regulation (EU) 2026/1744 — AI systems that generate intimate or sexually explicit images, video or audio of identifiable persons without their consent (the so-called “nudification” apps) or child sexual abuse material;
- 2 December 2027: obligations for “standalone” high-risk systems (Annex III), the deadline thus postponed by the Digital Omnibus;
- 2 August 2028: obligations for high-risk systems embedded in regulated products (Annex I).
The postponement therefore concerns high-risk systems only: from 2 August 2026 the transparency obligations apply in any event, and supervisory and enforcement activity begins.
The penalties
Article 99 sets penalties across several bands: up to 35 million euros or 7% of total worldwide annual turnover for prohibited practices (Article 5); up to 15 million or 3% for breaches of the other obligations (providers, deployers, transparency); up to 7.5 million or 1% for false or misleading information supplied to the authorities. For SMEs and start-ups, the lower of the fixed amount and the percentage applies; Regulation (EU) 2026/1744 has extended the same criterion to small mid-cap companies, limited to the second and third bands.
The AI Act and the GDPR: two regimes that add up
The AI Act does not replace the GDPR: it sits alongside it. Any AI system that processes personal data remains fully subject to the data-protection Regulation — from the legal basis to the information notice, to the right not to be subject to automated decisions (Article 22 GDPR). For many businesses the first test of AI will not be the AI Act, whose application is gradual, but the GDPR, already fully operational.
The Italian layer
Alongside the EU Regulation comes Law No 132 of 23 September 2025, in force since 10 October 2025: Italy’s first national law on artificial intelligence. It entrusts governance to AgID and ACN (the national digital and cybersecurity agencies), imposes transparency obligations towards workers on the use of AI systems, lays down rules for the intellectual professions and healthcare, and introduces a new criminal offence for the harmful dissemination of deepfakes. Since 30 September 2026, Legislative Decree No 160 of 9 September 2026 has also been in force, aligning national legislation with the AI Act as regards the use of AI in policing and civil and criminal liability: it inserts Article 437-bis into the Italian Criminal Code (failure to adopt security measures in AI systems and unlawful tampering with such systems), extends the administrative liability of entities (Legislative Decree 231/2001) to this offence and to the offence of unlawful dissemination of deepfakes (new Article 25-vicies) and, on the civil side, provides that, where the damage results from a breach of obligations laid down by the AI Act, the causal link is presumed unless proven otherwise (Article 18). These are rules that Italian businesses must consider together with the AI Act.
What the case law says
The AI Act, in gradual application, does not yet have its own body of enforcement decisions. The framework already in force, however, is the GDPR, on which the Italian Data Protection Authority (Garante) has intervened precisely on the algorithmic systems used to manage workers — an area the AI Act classifies as high-risk.
By injunction order of 10 June 2021 (web doc. no. 9675440) the Garante fined Foodinho, of the Glovo group, 2.6 million euros for the algorithmic management of about nineteen thousand riders: the order-allocation system and the reputational score penalised couriers according to non-transparent criteria, without adequate safeguards as to the accuracy of the data or the right to human intervention. The order had been annulled by the Court of Milan in April 2022, but the Italian Supreme Court of Cassation (First Civil Division, order no. 27189 of 2023) set that judgment aside and, as the company did not resume the proceedings, the decision became final, as the Garante itself records in its 2024 decision. By that later decision, of 13 November 2024 (web doc. no. 10074601), the Authority returned to the same company, imposing a fine of 5 million euros and requiring, among other things, that riders be guaranteed the right to obtain human intervention and to contest automated decisions, through suitably trained operators placed in a position to depart from the algorithm’s outcome. These are, in essence, the same safeguards — transparency, accuracy, human oversight, non-discrimination — that the AI Act imposes, in strengthened form, on high-risk systems.
Getting to grips with the AI Act in good time — mapping the systems used, classifying their risk, putting the required measures in place — is the way to turn an obligation into a competitive advantage. It is a path closely interwoven with GDPR compliance and with the broader picture of corporate compliance: for a review of the AI systems in use and of the obligations that apply, see our AI Act compliance service or request a consultation.
Frequently asked questions
Does the AI Act apply to my company? Yes, if it develops, places on the market or uses AI systems. The intensity of the obligations depends on the system’s risk level; for many everyday uses it is minimal, but not nil.
When does the AI Act become mandatory? It has been in force since 1 August 2024; the prohibitions apply from 2 February 2025, the transparency obligations from 2 August 2026, and the obligations on high-risk systems — following the postponement enacted by the Digital Omnibus (Regulation (EU) 2026/1744) — from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Does using ChatGPT or generative AI in the company fall under the AI Act? Often these are minimal-risk uses, with light obligations (mainly transparency); the GDPR, however, always applies to the personal data processed.
This article is for informational purposes and reflects the rules in force as at the date of publication; it does not replace an assessment of the specific case.
This article is for general information only and is not legal advice on any specific case. Content reviewed by Giuseppe Foti, legal consultant — last checked on October 5, 2026.