Skip to content

AI Act

AI Act: obligations turned into controls and evidence

Being compliant is one thing; being able to show it to a customer, an auditor or an authority is another. My method turns every obligation into a concrete control and the evidence behind it: a register, a log, a completed training session.

Request an AI Act assessment proposal 13 questions to see where you stand

Before the engagement, we agree which systems to assess, the documents to deliver and a fixed price. Development and ongoing support are agreed separately.

Some obligations already apply today

The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) pushed back the obligations for high-risk systems. Prohibitions and transparency already apply, and the duty to support the AI literacy of those who use AI remains.

  1. 1 Aug 2024

    Entry into force

  2. 2 Feb 2025

    Prohibitions and AI literacy

  3. 2 Aug 2025

    General-purpose AI models

  4. 2 Aug 2026

    Transparency and general application

  5. 2 Dec 2026

    New prohibitions and content marking

  6. 2 Dec 2027

    High risk, Annex III

  7. 2 Aug 2028

    High-risk Annex I systems; AI requirements for machinery

AI Act deadlines after the Digital Omnibus: 1 August 2024 Entry into force; 2 February 2025 Prohibitions and AI literacy; 2 August 2025 General-purpose AI models; 2 August 2026 Transparency and general application; 2 December 2026 New prohibitions and content marking; 2 December 2027 High risk, Annex III; 2 August 2028 High-risk Annex I systems; AI requirements for machinery
Each deadline in detail

  1. February 2025

    Prohibited practices and AI literacy of staff (art. 4)

  2. August 2025

    General-purpose AI models (GPAI)

  3. August 2026

    Transparency (art. 50): chatbots, generated content, deepfakes

  4. December 2026

    New prohibitions (non-consensual intimate images, child sexual abuse material); marking of AI-generated content becomes mandatory for systems already on the market

  5. December 2027

    Annex III high-risk AI systems: employment, education, critical infrastructure, credit

  6. August 2028

    AI in products regulated under Annex I, such as medical devices; for machinery, delegated acts under the Machinery Regulation

In Italy

Italy's Law 132/2025 on artificial intelligence has been in force since 10 October 2025. Legislative Decree 179/2026, which enters into force on 23 October 2026, aligns Italian law with the AI Act: the National Cybersecurity Agency (ACN) will be the market surveillance authority and AgID the notifying authority.

What getting it wrong costs

  • Prohibited practices up to 35 € million or 7%
  • Other obligations (providers, deployers, transparency) up to 15 € million or 3%
  • Incorrect information to authorities up to 7.5 € million or 1%
Maximum amounts: the higher of the fixed sum and the percentage of worldwide annual turnover; for SMEs, the lower of the two applies. Source: Regolamento (UE) 2024/1689, art. 99

Updated 21 October 2026. For information only, not legal advice. Text of the AI Act on EUR-Lex · Amending Regulation (EU) 2026/1744 · Legislative Decree 179/2026 in the Italian Official Gazette

Risk class

Obligations depend on the risk

Most business uses sit at the bottom. But one system in the wrong place, for example in recruitment, is enough to move up a level.

Prohibited

Social scoring, manipulation, some biometric uses

High risk

Employment, credit, education, safety components of products

Transparency

Chatbots, generated content, deepfakes

Minimal risk

Most business uses: good practice and AI literacy

Indicative overview: obligations depend on your role, the system’s intended purpose and its characteristics. Transparency requirements may also apply to high-risk systems.

Role

First question: deployer or provider?

A business using an AI system in its operations may be a deployer. A business that develops or commissions a system and puts it into service under its own name may be a provider, including for internal use. Roles and obligations need to be assessed for each case: that is where I start.

  1. Yes?Did you develop the AI system, or have it developed and use it under your own name?

    Provider

    Technical documentation, risk management and conformity, if high-risk.

  2. Yes?Do you bring it into the EU from a provider outside the EU?

    Importer

    Check that the provider has done its part before placing it on the market.

  3. Yes?Do you resell it or make it available to others?

    Distributor

    Check the marking and documents before making it available.

  4. Yes?Do you use it in your business?

    Deployer

    Use according to instructions, human oversight, AI literacy, transparency.

You can hold more than one role for the same system. In doubtful cases, your lawyer decides.

Machinery Regulation

If you build machinery

The Digital Omnibus moves the AI Act requirements for AI in machinery into the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027. The Commission must integrate them through delegated acts applicable by 2 August 2028; in the meantime, harmonised standards and AI Act specifications can be used for the presumption of conformity. Where AI is a safety component of machinery, the route involves CE marking.

The method

01

Inventory

Which AI systems you actually use, who uses them, with what data.

02

Role and risk

A preliminary technical assessment of your role as deployer or provider and each system’s risk category. Uncertain classifications are validated with your legal counsel.

03

Obligations and evidence

For each obligation: the control to put in place and the evidence that demonstrates it.

04

Review

Every six months and whenever something changes: new systems, guidelines, standards, evidence to renew.

What an entry in the register looks like

  1. 01

    Obligation

    Art. 4: AI literacy of staff

  2. 02

    Control

    Role-based learning path and usage guidelines

  3. 03

    Evidence

    Certificates of attendance and attendance register

  4. 04

    Status

    Done, with a review date

The “compliance as evidence” method: an illustrative example to adapt to the system and applicable obligations.

Self-assessment

13 questions to see where you stand

Answer here: the result appears below. Your answers stay in your browser; I don't receive them.

Do you know which AI tools your people use, including the ones they picked up on their own?
Do you have an up-to-date list of the AI systems in use?
Do you develop or modify AI systems, even just for internal use?
Are your AI products sold or used in the European Union?
Is AI used in recruitment or staff assessment, credit, education or biometrics?
Is AI a safety component of a CE-marked product, such as a machine or a medical device?
Do you use customer-facing chatbots or publish AI-generated content?
Have you taken documented measures for AI literacy among your staff?
Are there written rules on what data can be entered into AI tools?
Do your AI tools process personal data, and have you assessed whether a DPIA is needed?
Do you log the use of AI tools, and are workers informed?
Do your contracts with AI providers cover data, training and liability?
Is there a person responsible for keeping AI compliance up to date?

Answers: 0 of 13

Answer all 13 questions to see an indicative result. “Not sure” answers flag information to investigate. The questionnaire does not determine a risk category or certify compliance.

An indicative result, not legal advice.

Request an AI Act assessment proposal

Technical

What I do

  • Inventory of systems and a proposed classification, to be validated with your lawyer
  • Technical controls: logs, human oversight, procedures
  • Planning role-specific AI literacy activities; content and availability to be agreed
  • Register of obligations with evidence

Legal

What stays with your lawyer

  • Uncertain legal classifications: role, high risk, exemptions
  • Legal support for DPIAs and FRIAs where required; responsibility remains with the data controller and the deployer respectively
  • Contracts with suppliers and customers
  • Dealings with authorities and disputes

I do not give legal advice: I prepare a complete file for your lawyer, with the evidence attached.

Frequently asked questions

Does the AI Act require a course with a certificate?

No. Article 4, after the Digital Omnibus, requires providers and deployers to take measures to support the AI literacy of their staff, without a guaranteed level and without a mandatory certificate. A documented programme with a certificate of attendance helps demonstrate those measures.

If we build an AI assistant for internal use, are we a provider?

Often, yes. Anyone who develops an AI system and puts it into service under their own name, even just for internal use, is a provider (art. 3). For high-risk systems, you also become the provider if you put your name on one, substantially modify one, or change a system's intended purpose so that it becomes high-risk (art. 25). The role has to be checked case by case.

Does a manufacturing SME have to carry out a fundamental rights impact assessment?

Usually not. The FRIA (art. 27) concerns public bodies, private entities providing public services and certain high-risk uses such as creditworthiness and life and health insurance. A GDPR DPIA, on the other hand, may already be needed today when AI processes personal data.

When do the obligations for high-risk AI systems apply?

Following the Digital Omnibus: from 2 December 2027 for Annex III use cases (such as recruitment, education and critical infrastructure), and from 2 August 2028 for AI embedded in Annex I regulated products, such as medical devices. For machinery, the requirements move into the Machinery Regulation through delegated acts applicable by 2 August 2028.

Does the AI Act also apply to companies outside the European Union?

Yes, when their AI systems are placed on the EU market or when the output they produce is used in the EU (art. 2). I deal with the AI Act and Italian law; I do not advise on US law.

We sell into the EU from outside it: what is our role?

It depends on what you do. Whoever places a non-EU provider's AI system on the EU market is an importer, whoever makes it available is a distributor, and a non-EU provider of a high-risk system must appoint an authorised representative in the Union (art. 22). If the AI sits inside a regulated product, the product manufacturer can be considered its provider (art. 25).

Which obligations already apply to you today?

Tell me which AI tools you use and whether you are building your own: I will reply with the deadlines that may apply to you and what to check first.

Get in touch