The EU AI Act for Italian companies: an operational compliance guide

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive regulation on artificial intelligence. For Italian companies the stakes are about governance, accountability and market access before they are technical. Whoever shows up prepared enters public tenders and European supply chains with a structural advantage, because enterprise clients already ask for AI Act attestations in their calls. Whoever arrives late risks fines of up to €35 million or 7% of global turnover.

The timeline changed in 2026: the Digital Omnibus on AI, given final approval by the Council of the EU on 29 June 2026, deferred the heaviest obligations on high-risk systems. The prohibitions, the transparency duties and the enforcement powers stay firm; the most demanding part slips. This guide is for CEOs, boards, compliance and IT leaders in Italian companies that need to move from principles to concrete actions, and it folds in the national framework of Law 132/2025.

The Italian picture: the AI Act plus Law 132/2025

The AI Act applies directly in Italy without transposition, but the national legislator added a further layer with Law No. 132 of 23 September 2025 ("Provisions and delegations on artificial intelligence"), in force since 10 October 2025. It is a framework law: several operational aspects, including the authorities' sanctioning powers, arrive through the implementing decrees expected within twelve months. Italian companies therefore have to read together:

• Regulation (EU) 2024/1689 (the AI Act) for obligations, prohibitions and penalties.
• Law 132/2025 for the national framework: principles, competent authorities, use of AI in public administration, healthcare, employment and justice.
• AgID (the Agency for Digital Italy) as the notifying authority and ACN (the National Cybersecurity Agency) as the market surveillance authority, with inspection and sanctioning powers.
• The Italian Data Protection Authority (Garante Privacy) for anything touching personal data, profiling and automated decisions under the GDPR.

For AI systems used by banks, insurers and financial markets, market surveillance stays with Banca d'Italia, CONSOB and IVASS. For an Italian company, AI compliance is never only the AI Act: it is the combination of the AI Act, the GDPR, NIS2 and DORA for finance, plus sector-specific rules.

The four risk categories applied to business processes

The AI Act classifies systems by risk. The operational key is to reason by use case and business process, not by technology.

1. Unacceptable risk: prohibited since 2 February 2025

Prohibited practices include:

• Generalised social scoring of citizens or employees.
• Emotion recognition in the workplace and in schools (with very narrow medical or safety exceptions).
• Biometric categorisation used to infer ethnicity, political opinions, sexual orientation or religion.
• Subliminal or manipulative techniques that alter behaviour in harmful ways.
• Predictive policing based solely on profiling.

Typical impact for Italian companies: aggressive HR analytics, employee sentiment-analysis systems, behavioural surveillance tools in call centres or retail. These must be reviewed or dismissed immediately. The Digital Omnibus adds, from 2 December 2026, a prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material. At national level, Law 132/2025 also introduced a criminal offence for the distribution of harmful deepfakes (Article 612-quater of the Criminal Code).

2. High risk: the core of compliance

This is where most of the work sits. A system is high-risk if it falls under Annex III or if it is a safety component of an already-regulated product (such as medical devices, machinery, automotive, toys or lifts).

High-risk cases that recur in Italian companies:

• HR and recruiting: CV screening, candidate ranking, performance evaluation, decisions on promotions and dismissals.
• Credit and insurance: credit scoring of individuals, life and health insurance pricing, anti-fraud with an impact on access to services.
• Training and education: systems that assess students, admit them to programmes or assign scores.
• Critical infrastructure: traffic, energy and water networks, telecommunications.
• Essential public services: eligibility for benefits, medical triage, prioritisation of access to services.
• Law enforcement and migration: assessing the reliability of testimony, document verification.
• Administration of justice: interpretive support, case-law research with a bearing on decisions.

For each high-risk system the AI Act imposes a package of obligations:

• A risk-management system documented across the entire lifecycle.
• Data governance: quality, representativeness and traceability of the training, validation and test datasets.
• Technical documentation compliant with Annex IV, updated at every relevant release.
• Automatic logging of relevant events (input, output and human override).
• Transparency toward the deployer: instructions for use, limits and expected operating conditions.
• Effective, not theoretical, human oversight: who controls it, with what competence, with what power to intervene.
• Accuracy, robustness and cybersecurity proportionate to the risk.
• A quality management system that holds the previous points together.
• A conformity assessment before placing on the market, CE marking and registration in the EU database.
• Post-market monitoring and reporting of serious incidents within the required deadlines, typically 15 days.

3. Limited risk: transparency obligations

Chatbots, virtual assistants, generators of synthetic content (text and images, audio and video). The user must know they are interacting with an AI or that the content is generated or artificially altered. Deepfakes and synthetic content must be labelled in a machine-readable way (watermarking, provenance metadata).

4. Minimal risk: no specific obligation

Spam filters, low-impact recommendation engines, video games. There are no binding obligations, though adopting the voluntary codes of conduct provided by the AI Act is still advisable.

GPAI models: the cross-cutting obligation

Providers of General Purpose AI models (frontier LLMs and beyond) must publish technical documentation, information for integrators, an EU copyright-compliance policy and a public summary of the training data. Models with systemic risk (indicative threshold of 10^25 training FLOPs) carry additional obligations for evaluation, systemic-risk mitigation, cybersecurity and reporting.

For Italian companies that integrate third-party GPAI into products or processes, the obligation shifts: you become a downstream deployer or provider, and you have to assess whether the use configures a high-risk system under Annex III.

The Digital Omnibus: what changed in 2026

By the summer of 2026 it had become clear that the technical standards and the competent authorities would not be ready in time for the high-risk obligations to apply. The European Commission proposed the Digital Omnibus on AI on 19 November 2025; the European Parliament approved it on 16 June 2026 and the Council of the EU gave its final green light on 29 June 2026.

The package does not touch the architecture of the Act, the risk-based approach stays. It moves the most demanding deadlines and introduces a few targeted changes:

• High-risk obligations deferred. Stand-alone Annex III systems move from 2 August 2026 to 2 December 2027. Systems embedded in regulated products under Annex I move from 2 August 2027 to 2 August 2028.
• New prohibition. From 2 December 2026, AI systems that generate non-consensual intimate imagery or child sexual abuse material are banned.
• Watermarking deferred. The provider obligation to machine-readably mark generated content (Article 50(2)) applies from 2 December 2026 for systems already on the market at 2 August 2026. The other transparency obligations remain at 2 August 2026.
• Sandboxes deferred. The deadline for Member States to establish at least one national regulatory sandbox slips to 2 August 2027.
• Lighter load for smaller players. The exemptions available to SMEs are extended to small mid-caps.

The updated roadmap for Italian companies

• 2 February 2025: prohibitions on banned practices and an AI literacy obligation for staff who use or manage AI, at any risk level.
• 2 August 2025: EU governance operational, obligations for GPAI models, penalty regime applicable.
• 2 August 2026: most provisions apply, including the Article 50 transparency obligations and enforcement powers. This is no longer the high-risk date.
• 2 December 2026: watermarking of generated content for systems already on the market, and the new prohibition on non-consensual intimate imagery and child sexual abuse material takes effect.
• 2 August 2027: deadline for Member States to establish national regulatory sandboxes.
• 2 December 2027: full application for stand-alone high-risk systems under Annex III.
• 2 August 2028: application to high-risk systems embedded in products already covered by EU safety legislation.

Penalties are structured on three levels:

• Up to €35 million or 7% of global turnover for prohibited practices.
• Up to €15 million or 3% of global turnover for breaches of high-risk obligations.
• Up to €7.5 million or 1% of global turnover for incorrect information to authorities.

For SMEs and startups the amounts are reduced but not zero.

Six operational steps to start today

• Company AI inventory: map every AI system, in-house or SaaS, with its business owner, the data processed and the decisions it influences. No compliance is possible without an inventory.
• Risk classification by use case: apply the logic of the AI Act and document the reasons for the classification.
• Gap assessment: for each high-risk system, check the presence of risk management, data governance, logging and human oversight, alongside the technical documentation.
• Internal governance: appoint an AI Officer or strengthen a cross-functional AI committee (Legal, IT, Security, HR, Business). Define the delegations toward the board.
• Integration with existing frameworks: align the AI Act with ISO/IEC 42001, the NIST AI RMF and the obligations of the GDPR, NIS2 and DORA. Reuse the controls already in place.
• Widespread AI literacy: train everyone who interacts with AI, not just the technical staff. It has been an obligation since 2 February 2025.

How to integrate the AI Act, ISO 42001 and Law 132/2025

The more mature companies are building a single AI governance model that holds together:

• The AI Act as the mandatory compliance baseline.
• ISO/IEC 42001 as the certifiable standard for the AI management system, useful in tenders and in relationships with enterprise clients.
• Law 132/2025 for the national aspects (use in public administration, employment, healthcare, justice).
• The NIST AI RMF as the operational framework to manage risk, measure it and improve it.
• The GDPR, NIS2 and DORA for the connected domains such as data, cybersecurity and finance.

The advantage is twofold: you reduce duplication of controls and you build a single body of evidence usable in audits, tenders and commercial negotiations.

Priorities for the board

If you sit on the board or in the leadership of an Italian company, three priorities:

• Start the AI inventory this week. You do not need a tool: you need a shared worksheet with the process owners.
• Ask for a risk classification of the first five use cases. Document who decided and on what grounds.
• Put AI governance on the board agenda at least every quarter, with compliance and adoption KPIs.

The AI Act is also an opportunity: to build a structural competitive advantage while others postpone. Deferring the high-risk obligations to 2 December 2027 opens a useful window, provided it is used to prepare rather than to stop.

If you want to understand where you stand on the compliance path, consider our AI Rating: an assessment that measures AI maturity across four dimensions, with a report you can use in the boardroom and with enterprise clients.