The European AI Act is entering an operational phase. From 2 August 2026, obligations apply to high-risk artificial intelligence systems, with checks and penalties for companies that fail to comply.
The issue concerns many small and medium-sized enterprises. According to Istat data from December 2025, 16.4% of Italian companies with at least 10 employees use AI systems, but most have not yet mapped their tools according to the regulation’s criteria.
What the AI Act is and how it classifies risk
The AI Act, namely EU Regulation 2024/1689, is the first comprehensive European law on artificial intelligence. It applies directly and creates binding obligations for all companies that develop or use AI systems within the Union.
Its core principle is the risk-based approach. There are four levels of risk: prohibited practices, high risk, limited risk and minimal risk.
Annex III lists eight high-risk areas, including biometrics, critical infrastructure, education, personnel selection and access to essential services. For an SME, the most frequent areas are recruitment and customer scoring. Chatbots, image generators and tools such as ChatGPT fall instead into limited risk, with an obligation to declare AI-generated content.
The implementation timeline and penalties
The timeline has already begun. Since 2 February 2025, systems posing unacceptable risk, such as subliminal manipulation and public social scoring, have been banned.
Since 2 August 2025, rules on general-purpose models such as GPT-4, Claude and Gemini apply. From 2 August 2026, full operation begins for high-risk systems, with obligations on documentation, registration and human oversight. Further deadlines are set from 2 August 2027.
The penalties are significant. They reach up to 35 million euro or 7% of worldwide turnover for the use of prohibited systems, up to 15 million or 3% for breaches of high-risk obligations, and up to 7.5 million or 1.5% for false information. Exclusion from public tenders and reputational damage are added to this.
How to comply and what support tools exist
The roadmap starts with mapping the AI systems in use, followed by a documented AI literacy programme and a risk classification of each tool. High-risk systems require effective human oversight and technical documentation.
The Commission provides a free Compliance Checker, along with the option to contact the AI Office. The compliance budget for an SME is estimated between 150,000 and 250,000 euro over 18 months.
Thanks to the Digital Omnibus, simplifications have been extended to small mid-caps with up to 500 employees, with reduced technical documentation and priority access to regulatory sandboxes. On the financial side, support includes the Cloud and Cybersecurity voucher, the 2026 hyper-depreciation scheme and non-repayable grants covering up to 50% of adjustment costs.
Original article: money.it
