AI Act: what it requires and which obligations already apply to companies

The AI Act, Regulation (EU) 2024/1689, classifies artificial intelligence systems by risk and also concerns the companies that use them, not just those that develop them. As of October 2026 the prohibitions, the AI literacy measures and the transparency obligations already apply. For high-risk systems, however, the Digital Omnibus has moved the deadlines to 2 December 2027 and 2 August 2028.

The AI Act in brief

The AI Act is a European regulation, so it applies directly in all Member States without needing to be transposed. It does not regulate the technology itself, but its uses: the more a system can affect people’s health, safety and rights, the more obligations it carries. It is the same risk-based approach that companies know from risk management.

There are four levels, plus separate rules for large general-purpose models:

• Unacceptable risk: prohibited practices, such as manipulation that exploits people’s vulnerabilities, social scoring or emotion recognition in the workplace (except for medical or safety reasons).
• High risk: systems used in sensitive areas, for example recruitment, creditworthiness assessment, education and critical infrastructure, or built into regulated products such as machinery and medical devices.
• Transparency risk: chatbots, generated or manipulated content (deepfakes), systems that interact with people.
• Minimal risk: most business uses, such as spam filters, translation and data extraction from documents. No specific obligations beyond literacy.
• General-purpose AI models (the models behind generative assistants): obligations for those who develop them and place them on the market, not for those who use them.

Who it applies to: provider or deployer

The regulation distinguishes between roles. The provider develops an AI system, or has it developed, and places it on the market under its own name. The deployer is anyone using an AI system under its own authority in the course of a professional activity. Then there are importers and distributors.

An SME that uses a generative assistant, HR software with CV screening features or a management system with predictive modules is almost always a deployer. Be careful, though: if you put your own brand on a high-risk system, or modify it substantially, you can become a provider yourself, with much heavier obligations. The AI Act also applies to non-EU providers when the system’s output is used in Europe.

The timeline as of October 2026

The AI Act came into force on 1 August 2024 and applies in stages. These are the dates that matter after the 2026 amendments:

What the Digital Omnibus changed

The simplification package proposed by the Commission in November 2025 became Regulation (EU) 2026/1744, published in the Official Journal of the EU on 24 July 2026 and in force since 27 July, a few days before the original high-risk deadline of 2 August 2026.

The main changes:

• High risk postponed: 2 December 2027 for Annex III systems, 2 August 2028 for those built into products. It is a postponement, not a cancellation: the requirements and obligations remain the same.
• Literacy recalibrated: providers and deployers no longer have to “ensure” a sufficient level of skills, but must take measures to develop them among their staff. The Commission and Member States must support businesses, particularly SMEs.
• New prohibition from 2 December 2026 for systems that generate intimate or sexually explicit images of identifiable people without consent.
• Simplifications to documentation and to the quality management system for SMEs and small mid-caps.

The transparency obligations were not postponed: they apply from 2 August 2026. The exception is machine-readable marking of generated content, which for systems already on the market before that date slips to 2 December 2026.

The obligations that already apply today

Prohibited practices

Check that none of the tools in use falls under the prohibited practices. The case closest to businesses is emotion recognition of employees, for example in call centres or during interviews: it is prohibited except for medical or safety reasons.

AI literacy

Anyone using AI systems must take measures to develop adequate skills in the people who use them, taking into account their role and context. No certificate or minimum number of hours is required: targeted training, clear instructions for use and a record of what you have done are enough.

Transparency

From 2 August 2026, if a chatbot on your website answers customers, people must know they are talking to a machine. If you publish realistic images, audio or video generated or manipulated with AI, you must disclose it. The same applies to generated text published to inform the public on matters of public interest, unless it has undergone human review with editorial responsibility.

The penalties under Article 99 reach up to 35 million euros or 7% of worldwide turnover for prohibited practices, and up to 15 million or 3% for the other obligations. For SMEs, the lower of the two amounts applies.

The Italian AI law (Law 132/2025)

Italy has supplemented the AI Act with a national framework law, Law no. 132 of 23 September 2025, in force since 10 October 2025. It does not duplicate the European regulation, but adds principles and rules in certain areas. For companies, these points matter most:

• Employment (Art. 11): employers must inform workers about the use of AI in the cases and in the manner already required for automated decision-making or monitoring systems.
• Intellectual professions (Art. 13): AI may only carry out instrumental and support activities, and professionals must tell clients which systems they use, clearly and simply.
• Authorities (Art. 20): AgID and ACN are the national AI authorities, while the Bank of Italy, CONSOB and IVASS supervise their respective sectors.
• Minors (Art. 4): under the age of 14, access to AI systems requires the consent of whoever exercises parental responsibility.
• Offences (Art. 26): a new aggravating circumstance for offences committed using AI and a new offence of unlawful dissemination of generated or altered content (deepfakes).

The law empowers the Government to adopt, within twelve months, the decrees aligning Italian law with the AI Act, in particular on supervisory powers and penalties. The Council of Ministers worked on them in 2026: before setting up internal procedures, check the Official Gazette for which decrees have been published and when they apply.

What to do in your company: a practical checklist

1. Take an inventory of the AI tools in use, including those built into software you already use (CRM, HR, accounting, customer service).
2. Classify each use by risk level and clarify your role: deployer or provider.
3. Write an internal policy on which tools may be used, with which data and with what human oversight.
4. Organise training by role and keep a record of the activities carried out.
5. Inform workers when AI affects recruitment, management or monitoring, as Italian law requires.
6. Check the transparency of chatbots and generated content published externally.
7. Ask your suppliers for documentation, instructions for use and contractual commitments, especially if the systems may fall under high risk from 2027.

The same goes for software that uses AI to read documents and prepare sustainability data, such as Envify: these are low-impact uses, but it is worth knowing what data is processed and who checks the results. AI governance is also finding its way into the ESG questionnaires of clients and banks (we cover this in bank ESG questionnaires), and good management of ESG data starts from the same principles: knowing where information comes from and who checks it. For uses of AI in reporting, you can also read AI and sustainability reporting.

Frequently asked questions