The AI Act and Italy's Law 132/2025, what businesses and professionals must do

Who it covers

The AI Act (Regulation EU 2024/1689) distinguishes several roles. The two that matter for most businesses:

• Provider: whoever develops an AI system and places it on the market under its own name. OpenAI, Anthropic, Google; but also a software house selling accounting software with AI features.
• Deployer: whoever uses an AI system under its own authority in a professional activity. A firm using ChatGPT for drafts, a company with a chatbot on its website, an HR team using software to screen CVs.

Purely personal, non-professional use is excluded.

The risk logic

The regulation doesn’t treat all AI the same: duties grow with risk.

1. Unacceptable risk: practices banned since 2 February 2025. E.g. subliminal manipulation, social scoring, emotion recognition at work and school (except for medical or safety reasons), certain biometric uses.
2. High risk: systems used in sensitive areas listed in Annex III (hiring and staff management, creditworthiness, education, essential services, justice) or embedded in regulated products (Annex I: medical devices, machinery, toys). Heavy duties on documentation, human oversight, data quality.
3. Limited risk: transparency duties (chatbots, synthetic content).
4. Minimal risk: everything else, i.e. the vast majority of office uses. No specific duties beyond AI literacy.

Try placing your uses:

The timeline, updated for 2026

From	What applies
1 August 2024	Regulation enters into force
2 February 2025	Banned practices and AI literacy (Art. 4)
2 August 2025	Rules for general-purpose AI models (GPAI) and governance
27 July 2026	Regulation (EU) 2026/1744 (Digital Omnibus on AI) enters into force
2 August 2026	Transparency duties (Art. 50) and AI Office enforcement powers over GPAI models
2 December 2026	Machine-readable marking of generated content (Art. 50(2))
2 December 2027	High-risk systems in Annex III
2 August 2028	High-risk systems embedded in regulated products (Annex I)

What Regulation 2026/1744 changed

Approved by the European Parliament on 16 June 2026 and by the Council at the end of June, published in the Official Journal on 24 July, in force since 27 July 2026. In short:

• High-risk delay: from 2 August 2026 to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), with fixed dates no longer tied to technical standards.
• Transparency confirmed: Art. 50 applies as planned from 2 August 2026; only content marking (para. 2) gets a grace period until 2 December 2026.
• AI literacy softened: Art. 4 no longer requires “ensuring a sufficient level” of competence but taking measures to support it. The duty still applies to all providers and deployers.
• New ban on explicit sexual deepfakes and further simplifications for SMEs and small mid-caps.

What organisations using AI must do

Transparency (Art. 50), from 2 August 2026

• Chatbots and assistants: people interacting with an AI system must know it, unless obvious. A chatbot on your site must introduce itself as AI. (Lumen’s chatbot does so in its welcome message and the note below the input box.)
• Deepfakes: realistic generated or manipulated images, audio and video must be disclosed. For clearly artistic, satirical or fictional works, a note that doesn’t spoil the work is enough.
• Text published to inform the public on matters of public interest, generated or manipulated with AI, must be disclosed, unless it has undergone human review by someone who takes editorial responsibility.

AI literacy (Art. 4)

Take measures so people using AI in the organisation understand how it works, its limits and risks according to their role. In practice: documented basic training and written rules.

High risk, from 2 December 2027

Users of high-risk systems (e.g. software that screens candidates) will have to: use them per the provider’s instructions, assign oversight to competent people, keep logs, inform affected workers and, in some cases (public bodies, credit scoring, life and health insurance), carry out a fundamental-rights impact assessment.

Penalties

Up to €35 million or 7% of worldwide turnover for banned practices; up to €15 million or 3% for most other duties; up to €7.5 million or 1% for incorrect information to authorities. For SMEs and start-ups the lower of the fixed amount and percentage applies.

Italy’s law: Law no. 132 of 23 September 2025

Italy’s first national AI law, in force since 10 October 2025. It doesn’t duplicate the AI Act but complements it with national principles and rules. The most relevant points for businesses and professionals:

• Authorities: the National Cybersecurity Agency (ACN) for supervision and AgID for notifications and promotion.
• Intellectual professions (Art. 13): AI may be used only for instrumental and support activities, with the professional’s intellectual work prevailing, and the professional must inform the client about the systems used in clear, simple and complete language. For Italian chartered accountants, the code of ethics rules apply too, from 21 November 2025.
• Employment: employers must inform workers about AI systems that affect them.
• Minors: under 14, access to AI technologies requires parental consent.
• Copyright: works resulting from human intellectual effort are protected, even if made with AI assistance.
• Criminal law: a new offence of unlawfully spreading AI-generated or altered content (deepfakes) that causes harm, and aggravating circumstances for crimes committed using AI.

The six-point checklist

1. Take inventory. List every AI tool used in the organisation, including free ones used by individuals and AI features in your software.
2. Classify the risk. For each: banned? high risk? transparency duties? Most office tools are minimal or limited risk.
3. Label things. Chatbots that introduce themselves as AI, synthetic content disclosed, updated notices.
4. Train people. Basic, documented training: how the tools work, what never to upload, how to check answers.
5. Check contracts and data. Business versions with data-processing commitments, the provider appointed as processor, no use of data for training.
6. Write a short policy. Two pages are enough: allowed tools, forbidden uses, who checks results, whom to ask. For professionals, add the client notice.

Sources

• Regulation (EU) 2024/1689 (AI Act) — EUR-Lex
• Addleshaw Goddard — AI Omnibus formally adopted (Regulation EU 2026/1744)
• KI-Campus — AI Omnibus recalibrates Article 4
• Italian Law no. 132 of 23 September 2025 — Normattiva
• EU Made Simple — The EU's AI Act Explained

Informational content, current as of the date shown. Prices, models and rules change often: always check official sources. Written with the support of AI tools and reviewed by the author.