AI Governance · EU AI Act & Italian Law 132/2025

Is your company ready for 2 August 2026?

On that date the transparency duties of Article 50 of the EU AI Act start to apply — and Italy's own AI law, Law 132/2025, has already been in force since October 2025. Sixteen questions, ten minutes, no email required: see where you stand before a client, a regulator or a court asks.

2 Feb 2025

AI literacy — already in force

Art. 4 AI Act: anyone operating AI systems on your behalf must have adequate AI training.

10 Oct 2025

Italian Law 132/2025 — already in force

Italy's national AI law: duties for employers and professionals, new deepfake crime, copyright rules.

2 Aug 2026

AI Act Art. 50 — transparency

Chatbots must be disclosed, synthetic content must be recognisable, deepfakes must be labelled.

Note: following the EU "Digital Omnibus" agreed in June 2026, the high-risk obligations of the AI Act were postponed (Annex III systems to 2 December 2027, Annex I to 2 August 2028). The 2 August 2026 deadline concerns transparency — and it was not postponed. Neither was Italian Law 132/2025.

Section A · AI Act Art. 50 — from 2 Aug 2026

Transparency towards clients and the market

Check what your company already does today.

Every customer-facing chatbot or virtual assistant tells people it is an AI system.

Unless it is obvious from context, people interacting with an AI system must be informed they are talking to a machine.

AI Act Art. 50(1)

AI-generated images, audio and video you publish are recognisable as artificial.

Generative tools must mark synthetic output in machine-readable form — verify that the tools you use actually do, and keep your usage documented.

AI Act Art. 50(2)

Any deepfake — content showing real people, places or events that did not happen — is clearly labelled as artificially generated.

The duty falls on the deployer: your company, if it publishes the content.

AI Act Art. 50(4)

AI-generated text published to inform the public on matters of public interest is disclosed as such.

The exemption: content that underwent human editorial review with someone holding editorial responsibility.

AI Act Art. 50(4)

Section B · People — duties already in force

Your organisation: employees, clients, oversight

These are not future deadlines. They apply now.

Everyone who uses AI systems in your company has received adequate, documented AI training.

The AI literacy duty applies since 2 February 2025 — and documentation is what proves compliance.

AI Act Art. 4

Your employees are informed about the AI systems used in the workplace that affect them.

Italian law requires transparency towards workers on the use of AI in the employment relationship.

L. 132/2025 · transparency towards workers

If you provide professional services, your clients are informed — clearly and in writing — that AI is used in your work.

Law 132/2025 requires professionals to inform clients about the AI systems they use. A line in your engagement letter is the minimum.

L. 132/2025 · intellectual professions

Every AI-assisted decision that affects a person has an identified human owner.

Human oversight is the founding principle of both the AI Act and the Italian law: "the machine suggested it" is not a defence.

AI Act & L. 132/2025 · human oversight

Section C · Governance and data

Do you actually govern the AI you already use?

Most SMEs fail here first — usually without knowing it.

You have an inventory of every AI system and tool used in the company — including what individual employees use on their own initiative.

"Shadow AI" is the most common gap: you cannot govern what you have not mapped.

Governance baseline

An approved internal AI policy defines permitted uses, prohibited uses, and how new tools get approved.

One page beats zero pages. No policy means every employee is writing their own.

Governance baseline

Where AI processes personal data, your GDPR records are updated — and a DPIA exists where required.

The AI Act does not replace the GDPR; they apply together. AI processing belongs in your record of processing activities.

GDPR Art. 30 · 35

There are clear rules on which data must never enter external AI tools: trade secrets, client data, price-sensitive information.

The cheapest incident to prevent is the one where confidential data walks into a public model.

Confidentiality baseline

Contracts with AI vendors cover data use, regulatory compliance and liability.

If a vendor's model misbehaves on your data, the contract decides whose problem it is. Check before, not after.

Vendor management

Section D · Content and liability

What your company publishes and creates

Italy added criminal law to the picture. Your marketing team should know.

Whoever creates content in your company knows that harmful distribution of AI-generated or altered content depicting real people without consent is now a crime in Italy.

Law 132/2025 introduced a specific deepfake offence into the criminal code, with imprisonment among the penalties.

L. 132/2025 · new criminal offence

For content created with AI assistance, the human creative contribution is documented.

Under Italian law, copyright protects AI-assisted works only where a genuine human intellectual contribution exists — being able to show it is what makes the work defensible.

AI use in your key processes leaves a verifiable trail: who used it, on what, when.

An audit trail is what turns "we think we comply" into "here is the evidence" — for clients, auditors and regulators alike.

Audit trail

This checklist is an educational self-assessment, not legal advice. It summarises selected duties under Regulation (EU) 2024/1689 (AI Act) and Italian Law no. 132 of 23 September 2025 as generally applicable to SMEs and professional firms; it is not exhaustive and does not account for sector-specific rules. For decisions with legal effect, consult a qualified adviser. Your answers stay in your browser — nothing is sent or stored on our servers. Last reviewed: July 2026.