EU AI Act: a practical compliance guide for companies and boards

The EU AI Act is the world's first comprehensive regulation on artificial intelligence. It has been in force since 1 August 2024 and its provisions apply on a staggered timeline between 2025 and 2028. In 2026 that timeline was revised: the Digital Omnibus on AI, given final approval by the Council of the EU on 29 June 2026, pushed back the heaviest obligations, the ones covering high-risk systems. For an Italian CEO or board the question stays operational: what do we have to do, by when, and who is accountable if we don't.

This guide summarises the real obligations for companies that use, integrate or develop AI, the timeline updated after the Omnibus, and a 90-day operational roadmap designed for mid-to-large organisations.

Who is in scope: provider, deployer, importer, distributor

The regulation defines four roles, and the same company can hold more than one across different systems.

Provider: whoever develops or places an AI system on the market under its own name, including when an open-source model is used inside a product. This is the role with the most obligations.

Deployer: whoever uses an AI system in the course of its own activity (a bank adopting a scoring model, an HR function introducing CV screening, a healthcare organisation integrating diagnostic support). This is the most common role.

Importer and distributor: whoever brings third-party non-EU AI systems onto the EU market or resells them.

A common mistake is to think "we buy software, so we are not the provider". If a bank customises a credit-scoring model, integrating it into its own processes with proprietary data, in many scenarios the role shifts and responsibilities grow. The first compliance action is therefore to correctly classify your role for every AI system in use.

The four risk categories

The AI Act does not regulate AI in the abstract: it regulates use cases based on risk.

Unacceptable risk: prohibited. Public social scoring, subliminal manipulation, emotion recognition in the workplace and at school, biometric categorisation used to infer sensitive data such as race, political opinions or sexual orientation. These prohibitions have applied since 2 February 2025. The Digital Omnibus adds a new prohibition, applicable from 2 December 2026, on AI systems that generate non-consensual intimate imagery of real people or child sexual abuse material.

High risk. Systems used in the sensitive areas listed in Annex III: HR (screening, evaluation and employment decisions), credit and insurance for individuals, education, critical infrastructure, justice and migration, safety components of already-regulated products such as medical devices. This is where most of the compliance effort sits.

Limited risk: transparency obligations. Chatbots, synthetic content generation and deepfakes: the user must know they are interacting with an AI or that the content is generated.

Minimal risk. Spam filters, video games and internal optimisations. No formal obligation, though applying a minimum level of governance still makes sense.

Concrete obligations for high-risk systems

For a system classified as high-risk, the provider must have in place, before placing it on the market:

• A risk-management system documented across the entire lifecycle.
• Data governance: quality, representativeness and bias of the training, validation and test datasets.
• Technical documentation compliant with Annex IV and instructions for the deployer.
• Automatic logging of relevant events for traceability.
• Human oversight designed "by design", not bolted on afterwards.
• Accuracy, robustness and cybersecurity proportionate to the risk.
• A conformity assessment (self-assessment in many cases, with a notified body in others) and CE marking.
• Registration in the EU database of high-risk systems.
• A quality system and post-market monitoring.

The deployer has lighter but not zero obligations: use the system according to the instructions, ensure human oversight by competent staff, retain the logs, report serious incidents, inform workers when AI affects the employment relationship and, for the public sector and some private ones such as banks and insurers, carry out the Fundamental Rights Impact Assessment before use.

GPAI models: what changes from 2 August 2025

Providers of General Purpose AI models (frontier LLMs and beyond) must publish technical documentation, information for integrators, an EU copyright-compliance policy and a public summary of the training data. Models with systemic risk (indicative threshold of 10^25 training FLOPs) carry additional obligations for evaluation, systemic-risk mitigation, cybersecurity and reporting of serious incidents to the AI Office.

For anyone building products on top of a third-party LLM, this more structured documentation from providers still has to be integrated into their own, as a downstream deployer or provider.

The Digital Omnibus: what changed in 2026

By the summer of 2026 it had become clear that the technical standards and the competent authorities would not be ready in time for the high-risk obligations to apply. The European Commission proposed the Digital Omnibus on AI on 19 November 2025; the European Parliament approved it on 16 June 2026 and the Council of the EU gave its final green light on 29 June 2026, with publication in the Official Journal expected in July.

The package does not touch the architecture of the Act, the risk-based approach stays. It moves the most demanding deadlines and introduces a few targeted changes.

• High-risk obligations deferred. Stand-alone Annex III systems (HR, credit, education and similar) move from 2 August 2026 to 2 December 2027. Systems embedded in regulated products under Annex I move from 2 August 2027 to 2 August 2028.
• New prohibition. From 2 December 2026, AI systems that generate non-consensual intimate imagery or child sexual abuse material are banned.
• Watermarking deferred. The provider obligation to machine-readably mark generated content (Article 50(2)) applies from 2 December 2026 for systems already on the market at 2 August 2026. The other transparency obligations remain at 2 August 2026.
• Sandboxes deferred. The deadline for Member States to establish at least one national regulatory sandbox slips to 2 August 2027.
• Lighter load for smaller players. The exemptions available to SMEs are extended to small mid-caps, and the legal basis for processing sensitive data solely for bias correction is broadened, subject to a strict necessity requirement.

The months gained should be spent on conformity assessment, technical documentation and human-oversight design, not filed away as free time.

The updated timeline to put on the agenda

• 2 February 2025: prohibitions on banned practices and AI literacy obligations for staff who use or manage AI.
• 2 August 2025: EU governance operational, obligations for GPAI models, penalty regime applicable.
• 2 August 2026: most provisions apply, including the Article 50 transparency obligations and enforcement powers. This is no longer the high-risk date.
• 2 December 2026: watermarking of generated content for systems already on the market, and the new prohibition on non-consensual intimate imagery and child sexual abuse material takes effect.
• 2 August 2027: deadline for Member States to establish national regulatory sandboxes.
• 2 December 2027: full application for stand-alone high-risk systems under Annex III.
• 2 August 2028: application to high-risk systems embedded in products already covered by EU safety legislation, such as medical devices, machinery and toys.

Penalties: why the board must own this

The penalty regime is tougher than the GDPR:

• Prohibited practices: up to €35 million or 7% of worldwide turnover.
• Breaches of obligations for high-risk systems or GPAI: up to €15 million or 3%.
• Incorrect information to authorities: up to €7.5 million or 1%.

On top of this sit reputational risk, contractual risk toward enterprise clients that already ask for AI Act attestations in tenders, and civil-liability risk in case of harm.

90-day roadmap for a mid-to-large company

Days 0-30, snapshot. Inventory of AI systems in use and in the pipeline, with the business owner, the vendor and the data processed, plus the AI Act role (provider or deployer). Preliminary risk classification. Appointment of an AI compliance owner and formal involvement of the board.

Days 30-60, gap analysis. For each high-risk or borderline system: review of the vendor's technical documentation, assessment of data governance, definition of effective human oversight, mapping of logs and incidents. Preparation of the Fundamental Rights Impact Assessment where required.

Days 60-90, operational plan. Corporate AI policy, updates to vendor contracts (compliance SLAs, audit rights, incident notifications), an AI literacy plan for staff, integration with existing management systems such as ISO 27001 and ISO 9001 and, where it makes sense, a roadmap toward ISO/IEC 42001 as a certifiable AI management system.

How it fits with ISO/IEC 42001 and the NIST AI RMF

The AI Act is prescriptive and legally binding in the EU. ISO/IEC 42001 is a voluntary, certifiable management system that provides the organisational structure made of policies, roles and controls with internal audits, to meet the management obligations the Act requires. The NIST AI RMF is the operational framework for mapping, measuring and managing risk at the level of individual systems.

For a European company with international exposure, the most effective combination holds three layers together: the AI Act as the regulatory constraint, ISO 42001 as the governance scaffolding, the NIST AI RMF as the technical method for managing risk at system level. The detailed comparison of the three frameworks is in our AI Governance deep dive.

Where to start

If the board does not yet have a formal view on the AI Act, the first step is not to buy a tool: it is to understand where you stand today and which systems to tackle first. Deferring the high-risk obligations to 2027 opens a useful window, provided it is used to measure your own maturity rather than to postpone.

The AI Risk dimension of our AI Rating already measures much of what the Act requires you to govern: governance, data quality, risk management and security. An AI Rating or a targeted assessment gives the initial snapshot and the intervention priorities, so compliance becomes a manageable path and not an emergency.