In short: The AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk. The prohibitions and the obligation to support staff AI literacy have applied since 2 February 2025, and the rest of the rules since 2 August 2026. Regulation (EU) 2026/1744 (in force since 27 July 2026) moved the obligations for high-risk systems to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Regulation (EU) 2024/1689, known as the AI Act, has been in force since 1 August 2024 and applies in stages. In July 2026 Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, moved some dates and simplified some obligations. In Italy, Law 132/2025 on artificial intelligence applies on top of it.
This is an explanatory guide, not legal advice. Check the current version on the European Union's official sources.
The underlying idea: rules based on risk
- Unacceptable risk: prohibited practices, for example manipulation that harms people. From 2 December 2026, prohibitions are added on systems that generate non-consensual intimate images and child sexual abuse material.
- High risk: uses in sensitive areas such as recruitment, education or access to essential services (Annex III), and uses where AI is a safety component of regulated products (Annex I). They require risk management, data quality, documentation and human oversight.
- Transparency obligations: anyone interacting with an AI must know it, and synthetic content must be flagged (Article 50).
- Minimal risk: most common business uses, with no specific obligations beyond the general ones.
The roles: provider and deployer
The provider develops the system or places it on the market under its own name. The deployer (‘utilizzatore’ in the Italian text) uses it in the course of its own business. An SME that adopts an AI assistant for customer service is, as a rule, a deployer. If it substantially modifies a system or markets it under its own brand, it can become a provider, and its obligations grow.
The updated timeline
- 2 February 2025: Chapters I and II (general provisions and prohibited practices). This includes Article 4 on AI literacy.
- 2 August 2025: rules for general-purpose AI models, and governance.
- 2 August 2026: general application of the regulation, including the transparency rules in Article 50.
- 2 December 2026: providers of systems that generate synthetic content and were already on the market before 2 August 2026 must comply with the machine-readable marking obligation. The new prohibitions in Article 5 also apply from the same date.
- 2 December 2027: obligations for the high-risk systems in Annex III (for example recruitment).
- 2 August 2028: obligations for the high-risk systems in Annex I (regulated products).
What affects almost every business
Literacy (Article 4)
Since Regulation 2026/1744, providers and deployers take measures to support the development of AI literacy among their staff and others who use the systems on their behalf, taking account of their knowledge, experience and context. The obligation does not impose a specific level for each person. In practice: some short training and written rules of use.
Prohibited practices
An SME is unlikely to come across them, but it is worth knowing they exist, for example emotion recognition in the workplace or subliminal manipulation.
Transparency (Article 50)
- Systems intended to interact with people must inform them that they are interacting with an AI, unless this is obvious from the context.
- Providers of systems that generate synthetic audio, image, video or text content mark it in a machine-readable format.
- Anyone using a system that generates or manipulates images, audio or video constituting a ‘deep fake’ must disclose that the content has been generated or manipulated.
General-purpose models
The rules for providers of large models have applied since 2 August 2025. They concern those who build them more than those who use them.
Where your choice of server comes in
Running a model on a private server, rented in Europe or on your own premises, does not exempt you from the AI Act. What changes is something else: you know where the data is and who can access it. That makes GDPR compliance and customer requests easier to deal with. The options are compared in private AI: rented server or on your premises.
A starting checklist
- Inventory. Which AI tools are used in the business? Those adopted by individual employees count too.
- Classification. For each one: what it is for; who uses it; what data it processes. Does it fall among the high-risk uses?
- Role. Are you a deployer or a provider?
- Internal rules. One page on what is and isn't allowed. See what not to paste into a chatbot.
- Training. A short session and a reminder.
- Transparency. Notices in chatbots and labelling of generated content.
- Register. Keep track of tools, decisions and the people responsible.
Further reading: AI for business · artificial intelligence in business: where to start · an AI assistant for company documents
Frequently asked questions
What is the AI Act?
It is Regulation (EU) 2024/1689 on artificial intelligence, the first European framework to regulate AI according to risk. It has been in force since 1 August 2024 and applies in stages.
When do the obligations for high-risk AI apply?
Following Regulation (EU) 2026/1744, in force since 27 July 2026, the obligations for the high-risk systems in Annex III apply from 2 December 2027 and those for the systems in Annex I from 2 August 2028.
Does a business that uses a chatbot need to do anything?
Anyone who makes available systems intended to interact with people must ensure that they are informed they are talking to an AI, unless this is obvious from the context (Article 50). Anyone using an AI system must also take measures to support AI literacy among their staff (Article 4).
Is the obligation to provide AI training still in force?
Yes. The obligation has, however, been softened: since Regulation (EU) 2026/1744, providers and deployers must take measures to support the development of their staff's literacy, without having to ensure a specific level of literacy for each person.
Does running AI on a private server exempt you from the AI Act?
No. The regulation applies regardless of where the model runs. A private environment does, however, help you control where the data is and who can access it.