AI Act for companies: compliance and training.
The AI Act is the European Union's regulation on artificial intelligence: it sets common rules for companies that develop or use AI systems in the EU.
AIR works alongside companies as they adopt AI and comply with the AI Act, both at once. Inventory of the AI systems in use, classification, staff training, internal rules, support for the legal team.
When a legal opinion is needed, we work with our partner lawyers.
- Regulation (EU) 2024/1689
- Digital Omnibus (EU) 2026/1744
- Law 132/2025
- Legislative Decree 179/2026
AI Act consulting: what we do
Five activities, in the order we carry them out. Each one leaves the company with a document that stays up to date.
AI inventory
A list of every use of AI in the company: tool, department, data involved, who checks the output. It includes the tools people have started using on their own.
Classification
For each use, the company's role (provider or deployer) and the risk level: prohibited, high risk, transparency, minimal. Uncertain uses go to the lawyers.
AI Act training
AI literacy by role, as Article 4 requires: from everyday use of assistants to checking their answers. With a record of who has completed what.
Internal rules
Company AI policy, notices on chatbots and generated content, information for workers, clauses with suppliers on data and training.
Support for the legal team
An orderly dossier for the in-house legal team and for inspections. For opinions, our partner lawyers.
How we work, starting from the inventory
We start with the department that uses AI the most and extend the work to the others from there, using the same method as our processes.
Adoption and compliance, together
We bring AI into companies' processes every day: we know the tools from the inside, where the data ends up and where a person needs to approve.
That is why compliance is built into the systems: a register of use cases, logs, human approval. Legal interpretation stays with the lawyers, who find everything ready.
What the client keeps
- An up-to-date AI inventory.
- People trained by role, with a record.
- Written, shared rules.
- A dossier ready for the legal team and for inspections.
- AI that keeps working in the processes.
AI Act kit: start with the AI inventory
The first step is knowing which AI tools the company uses, who uses them and for what. The guide explains the sheet column by column, with a sample row and the risk levels. For an SME, the first version takes two or three hours.
The sheet opens in Google Sheets as your own copy, to fill in with your department heads (in Italian).
AI inventory in 2 minutes (in Italian) · watch on YouTube
- week 1Fill in the inventory.
- week 2Assign a role and risk level to each row.
- week 3Sort out transparency on chatbots and content.
- week 4Training by role and a review of supplier contracts.
AI Act obligations for companies today
Almost every company uses AI systems built by others: under the AI Act they are deployers, that is, users. Three obligations apply to them today: train their people (Article 4), avoid prohibited practices (Article 5) and meet the transparency rules on deepfakes and generated content (Article 50). The obligations for high-risk systems start on 2 December 2027.
| Date | Status | What applies |
|---|---|---|
| 2 February 2025 | in force | Prohibited practices and staff AI literacy. |
| 2 August 2025 | in force | Obligations for providers of general-purpose AI models. |
| 2 August 2026 | in force | Transparency: chatbots recognisable as AI, deepfakes and generated content disclosed. |
| 2 December 2026 | upcoming | Two new prohibitions on non-consensual intimate images and child sexual abuse material; content marking for generative systems already on the market. |
| 2 December 2027 | upcoming | High-risk systems in Annex III: recruitment and staff management, credit, education, essential services. |
| 2 August 2028 | upcoming | High-risk systems built into machinery, medical devices and other products already covered by EU rules (Annex I). |
Dates as amended by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.
AI Act training: Article 4
Providers and deployers take measures to build AI literacy among their staff and among others using AI on their behalf, in line with their knowledge, experience and context of use. The Digital Omnibus rewrote the text: the company sets the level. The obligation has applied since 2 February 2025.
High risk: what deployers will have to do
From 2 December 2027, anyone using a high-risk system must use it according to the instructions, assign oversight to competent people, check the input data, keep the logs and inform workers and the people affected. What high risk means
Penalties
Up to 35 million euro or 7% of worldwide turnover for prohibited practices; up to 15 million euro or 3% for other obligations, transparency included. For SMEs and small mid-caps, the lower amount applies. In Italy, Legislative Decree 179/2026 adopts these amounts (Article 23).
In Italy: Law 132/2025 and Legislative Decree 179/2026
Law 132/2025 has been in force since 10 October 2025. Legislative Decree 179 of 7 October 2026, which aligns Italian law with the AI Act, has been in force since 23 October 2026.
Employers
They inform workers when they use AI in the employment relationship (Law 132, Article 11). Decisions on hiring, dismissal, disciplinary measures and assessments are taken by a person: purely automated decisions are void (Legislative Decree 179, Article 41). AI that affects the pace and organisation of work must be included in the risk assessment (Article 42).
Professionals
They tell clients, in plain language, which AI systems they use, and use them as support (Law 132, Article 13). Professional bodies must update their continuing education rules, including AI courses, by 23 April 2027 (Legislative Decree 179, Article 47).
Who supervises
AgID and ACN, together with the Italian Data Protection Authority (Garante), the Bank of Italy, Consob and Ivass in their own sectors. For minor breaches, the decree allows non-financial measures, such as an order to end the infringement (Article 22). Law 132 for businesses
AI Act FAQs
What does a company need to do for the AI Act today?
Almost every company uses AI systems built by others, so under the AI Act it is a deployer. Today it must train the people who use AI, make sure it stays clear of prohibited practices and meet the transparency rules on deepfakes and generated content. The first step is an inventory of the AI systems in use.
Is AI Act training mandatory?
Yes. Article 4 requires providers and deployers to take measures to build AI literacy among their staff, and it has applied since 2 February 2025. Since 27 July 2026, under the Digital Omnibus, the company sets the level according to role and context: what matters is being able to show who was trained and on what.
How long should AI training last?
The law leaves length and format open: it asks for training suited to the role and the context of use. We design programmes by department, shorter for people who use an assistant and more in-depth for people working on sensitive processes, with an attendance record.
We use ChatGPT, Copilot or Claude: does the AI Act apply to us?
Yes, as a deployer. For writing, translation and summaries the risk is minimal: what matters is training, rules on data and human oversight. The picture changes if the same tool is used to screen CVs or assess people.
Does the chatbot on our website have to say it is an AI?
Yes. Since 2 August 2026, people talking to a chatbot must know it is an AI. Designing it that way is the provider's job; the company using it must check that the notice is there and stays on.
What did the Digital Omnibus change?
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It rewrote Article 4 and added two prohibitions from 2 December 2026. The prohibitions, AI literacy and transparency rules still apply.
What penalties does the AI Act set?
Up to 35 million euro or 7% of worldwide annual turnover for prohibited practices, and up to 15 million euro or 3% for other obligations. For SMEs and small mid-caps, the lower amount applies. In Italy, Legislative Decree 179/2026 adopts these amounts and allows non-financial measures for minor breaches.
Who enforces the rules in Italy, and what does an SME risk?
In Italy, AgID and ACN supervise, together with the Italian Data Protection Authority (Garante), the Bank of Italy, Consob and Ivass in their own sectors. For SMEs and small mid-caps, the lower of the fixed amount and the turnover percentage applies. For minor breaches, Legislative Decree 179/2026 allows non-financial measures, such as an order to end the infringement (Article 22).
What changes in Italy for employers?
Employers must inform workers when they use AI in the employment relationship (Law 132/2025). Since 23 October 2026, decisions on hiring, dismissal, disciplinary sanctions and assessments must be taken by a person (Legislative Decree 179/2026, Article 41).
Does AIR work with the legal team?
Yes: we prepare the inventory, classification, training and rules, and the in-house legal team validates them. When a legal opinion is needed, we bring in our partner lawyers.
Where do we start?
With the AI Inventory: one row for each use of AI, listing the tool, department, data and who checks the output. The template can be downloaded from the AI Inventory guide.
Sources
- Regulation (EU) 2024/1689, AI Act (EUR-Lex)
- Regulation (EU) 2026/1744, Digital Omnibus on AI, Official Journal of the EU of 24 July 2026 (EUR-Lex)
- Article 4, consolidated text as of 27 July 2026 (AI Act Service Desk, European Commission)
- Law 132 of 23 September 2025 (Gazzetta Ufficiale, Italian Official Gazette)
- Legislative Decree 179 of 7 October 2026, Official Gazette General Series no. 234 of 8 October 2026 (Gazzetta Ufficiale)