A regulation that also covers those who use AI, not only those who develop it
The AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence, and it is not aimed only at those who develop models: it also applies to companies that use them in their work. That includes most Italian SMEs, when they add a conversational assistant to customer service, use an AI-based candidate screening tool, or rely on a third-party model to generate content or automate decisions.
The Regulation does not ban artificial intelligence: it classifies it by risk level and imposes obligations proportionate to that risk. The more sensitive the use is for the people affected, the stricter the obligations.
The four risk levels
| Level | Examples | What it means |
|---|---|---|
| Unacceptable | Subliminal manipulation, social scoring, exploiting people's vulnerabilities | Prohibited |
| High | Recruitment, employee evaluation, access to credit or essential services, safety systems | Risk management, human oversight, technical documentation, record-keeping |
| Limited | Chatbots, content generated or modified with AI (deepfakes) | Transparency obligations: disclose that people are interacting with an AI, label synthetic content |
| Minimal | Spam filters, AI in video games | No specific obligations |
Most common business uses, such as a chatbot on the website or an internal assistant, fall under limited risk: the main obligation is transparency, not a certification process. High risk mainly concerns decisions that directly affect people, such as recruitment or access to credit.
A common case: using a third-party model
Many companies do not develop a model of their own but build a third-party general-purpose AI model, such as a large language model, into one of their own tools. In this case the main transparency and technical documentation obligations fall on the provider of the model, not on the company integrating it. However, the company integrating it is still responsible for how the final tool is used, and for classifying its own use case correctly.
The deadlines in brief
| From | What applies |
|---|---|
| February 2025 | Ban on unacceptable-risk practices |
| August 2025 | Obligations for providers of general-purpose AI models |
| August 2026 | Most of the Regulation, including the obligations for high-risk AI systems |
| August 2027 | High-risk AI systems built into products that are already regulated (machinery, medical devices) |
For an SME, in most cases the deadline that really matters is August 2026: from then on, the obligations on high-risk AI systems and on risk management in general start to apply. The dates may yet be postponed or clarified, so it is worth checking them against official sources.
Penalties, and why they are not the main point
The Regulation provides for penalties of up to €35 million or 7% of total worldwide annual turnover for prohibited practices, up to €15 million or 3% for other breaches of obligations, and up to €7.5 million or 1% for supplying incorrect information to the authorities, in each case whichever amount is higher. These figures are designed mainly with large providers of AI systems in mind.
For an SME, the more tangible risk lies elsewhere: using an AI tool in a decision that affects people, for example in recruitment, without knowing that the decision should be overseen, documented and explainable.
Where to start
- Draw up an inventory of where AI is already used in the company, including informally (see the guide on Shadow AI): you cannot classify a risk you do not know about.
- Classify each use by risk level, starting with who is affected and what the tool decides.
- Check the providers of the models you use: what they state about transparency, training data and the system's limitations.
- Apply transparency where required: disclose when people are interacting with an AI, and label generated or modified content.
- Write an internal policy on who can introduce new AI tools in the company, and with what prior checks.
Quick checklist
- I know which artificial intelligence tools are already in use in the company, not just the official ones;
- I have classified each use by risk level under the AI Act;
- uses that affect recruitment, credit or essential services are overseen by a person, not just by the algorithm;
- I disclose when content or an interaction is generated with AI, where required;
- I know who in the company can introduce a new AI tool, and with what checks;
- the providers of the models I use state how data is processed.
In short
The AI Act classifies uses of artificial intelligence by risk level and imposes proportionate obligations: transparency for common uses such as chatbots, oversight and documentation for high-risk uses such as decisions about people. It also applies to those who use third-party AI, not only those who develop it.