What we learn from every audit.
Technical notes, real cases and reading on the EU AI Act — written by the people who run the audits, not the ones who talk about them.
2 December 2026: AI content marking and new bans, what changes if you built on an LLM
On 2 December 2026 the transition period for Article 50(2) AI Act marking ends and two new bans apply. If you put a chatbot or generator on someone else's model you are often the provider: here is how to tell and what to do.
· 6 min readRead the article- · 5 min
Italy's Legislative Decree 179/2026 on AI: authorities, fines and workplace rules in force since 23 October
The second implementing decree of Law 132/2025 sets out who enforces the AI Act in Italy, how fines are calculated for SMEs and what changes for employers using AI in staff decisions.
- · 5 min
Clocking in with fingerprints or facial recognition: why the Italian DPA keeps fining employers (and what the AI Act says)
Using fingerprints or faces to clock in is, in Italy today, processing the data protection authority treats as unlawful: consent is not enough and a badge does the job. What the GDPR, the Workers' Statute and the AI Act say, and what to do if the system is already installed.
- · 6 min
Defective software and AI: what changes from 9 December 2026 under the new Product Liability Directive
Under Directive (EU) 2024/2853, software, AI included, becomes a 'product': whoever develops or modifies it is liable without fault for damage caused by a defect, even after an update. Who is liable, for which damage and what to do before 9 December 2026.
- · 5 min
Cyber Resilience Act and AI: what companies building AI software must do now
Since 11 September 2026, anyone selling software or devices with AI in the EU must report actively exploited vulnerabilities within 24 hours. Here is how the Cyber Resilience Act fits with the AI Act, who is in scope and who is not, and the five things to set up now.
- · 5 min
AI-generated content: who owns it and how to avoid infringing copyright
Text, images and code produced with AI are protected only where there is a genuine human creative contribution. What Italian Law 132/2025 says, the risks of publishing an output that copies, and how to protect your own content from training.
- · 5 min
AI agents in the workplace: which rules already apply (AI Act and GDPR)
The AI Act has no 'agents' category, but AI agents are not outside the rules. Here's how to classify them, what transparency requires from 2 August 2026, and which GDPR and operational controls you need before giving them access to email, ERP and payments.
- · 7 min
Personal data in ChatGPT and Copilot: the seven GDPR checks before using them at work
"Can we put customer data into ChatGPT?" Yes, but only if the processing holds up under the GDPR: a business plan with an Art. 28 contract, no training on your data, a legal basis, transfers, privacy notice, DPIA. The seven checks, with the lessons of the OpenAI, DeepSeek and Replika cases.
- · 5 min
The right to an explanation of AI-assisted decisions: Article 86 AI Act and Article 22 GDPR
A customer turned down by a scoring system asks why. What you must answer, by when and in how much detail: the GDPR today, the AI Act for high-risk systems, and the CJEU's Dun & Bradstreet ruling.
- · 7 min
AI civil and criminal liability in Italy: what changes for companies from 30 September 2026 (Legislative Decree 160/2026)
Legislative Decree 160/2026 implements Italy's AI law: from 30 September 2026 it brings a new crime for failing to secure high-risk AI systems (Art. 437-bis of the Criminal Code), corporate liability under Decree 231, evidence disclosure and a presumed causal link. What companies must do.
- · 7 min
Buying AI: supplier due diligence before you sign
"Our software is AI Act compliant" is a claim, not evidence. Here are the documents to demand, the clauses that turn you into a provider, and the questions to ask before signing.
- · 5 min
Fine-tuning and chatbots on an LLM: when your company becomes a "provider" under the AI Act
Training a model on your own data or building an assistant on an LLM via API does not automatically make you a GPAI model provider. But it almost always makes you the provider of an AI system. Here are the three levels to tell apart.
- · 6 min
When AI goes wrong: who reports the incident, to whom and by when
An AI system causes harm: does a reporting duty kick in? Article 73 of the AI Act sets 15-, 10- and 2-day deadlines — and the clock starts when *you* find out, not when the provider does. Here is the notification map and the minimum response plan.
- · 5 min
ISO/IEC 42001 for SMEs: what it really certifies, and what it does not replace in the AI Act
"If we get ISO 42001 certified, are we covered under the AI Act?" No: there is no presumption of conformity. But it is the most mature method for organising AI governance. Here is when it pays off, and when using it without certifying is enough.
- · 6 min
Italy's AI Law 132/2025: what it really requires of companies, one year on
Italy's AI law adds no obligations to the AI Act, yet changes a lot for companies using AI with employees, clients, minors and content: worker information, professional transparency, copyright, new crimes. What already applies and what the decrees bring.
- · 6 min
AI system logs: what to keep, for how long, and why they matter when a dispute comes
At least six months of logs for high-risk systems (Arts. 12, 19 and 26 AI Act), but since 30 September 2026 an Italian court can already order the disclosure of records in a damages claim. What to record, how long to keep it, and how not to breach the GDPR while doing so.
- · 5 min
CE marking for high-risk AI: conformity assessment, EU declaration and registration
Anyone developing a high-risk AI system must, by 2 December 2027, complete a conformity assessment, sign the EU declaration, affix the CE marking and register in the EU database. Here is the path, step by step.
- · 6 min
Human oversight of AI: what the law requires and how to organise it for real
"A person always signs off" is not enough: it cost Uber €825 million. What the GDPR (Art. 22), the AI Act (Arts. 14 and 26) and Italy's Law 132/2025 really require, and how to organise human oversight that survives an inspection.
- · 7 min
Whistleblowing and the AI Act: since 2 August 2026, people who report AI infringements are protected
Article 87 of the AI Act extended the Whistleblowing Directive to artificial intelligence infringements. Who is protected, where reports go (internal channel, ANAC, AI Office) and what an Italian company needs to update in its procedure.
- · 5 min
Company AI use policy: how to write one (an SME guide)
If someone in your company uses ChatGPT or Copilot, you need a written policy. Here's what it must contain, who governs it, and how to align it with the AI Act, GDPR and the Italian Labour Ministry guidelines (DM 180/2025).
- · 4 min
Digital Omnibus: what changes (and what doesn't) in the AI Act deadlines
The Digital Omnibus only postponed high-risk obligations. Bans, literacy, GPAI and transparency still stand: here's what an SME must do now.
- · 5 min
Prohibited AI practices (Art. 5 AI Act): the 8 banned uses in business
Article 5 of the AI Act bans eight uses of AI — from social scoring to emotion recognition at work. There is no compliance path: they have been unlawful since 2 February 2025.
- · 6 min
AI in hiring: it is high-risk, but Italian obligations already apply today
An ATS that screens CVs falls under Annex III of the AI Act. The EU obligations move to 2 December 2027, but Italy's transparency decree, Workers' Statute, GDPR and Law 132/2025 apply right now.
- · 5 min
The AI Act from 2 August 2026: penalties, supervision and the new deadlines after the postponement
The Digital Omnibus (Regulation EU 2026/1744) postponed the high-risk obligations, but on 2 August 2026 transparency, supervision and penalties kick in. Here is the new timeline and who enforces in Italy.
- · 6 min
AI-generated content: Article 50 transparency obligations apply from 2 August 2026
The Digital Omnibus deferred high-risk obligations, but not Article 50: from 2 August 2026 chatbots, synthetic content and deepfakes must be disclosed and marked. What to do, and who must do it.
- · 5 min
AI systems inventory and risk classification: a practical guide
The first concrete step toward AI Act compliance is knowing which AI systems you use and at what risk level. Here's how to build the register and classify them.
- · 4 min
AI Act and GDPR: integrating DPIA and FRIA without duplication
Many high-risk AI systems process personal data, so the DPIA (GDPR) and the FRIA (AI Act) overlap. Here is how to run them as a single exercise.
- · 5 min
AI Literacy (Art. 4 EU AI Act): how to build a compliant programme
AI literacy is an EU AI Act obligation in force since 2 February 2025. Here is what Article 4 really requires and how to build a compliant, proportionate training programme.
- · 3 min
Provider or deployer? Who is responsible for what under the EU AI Act
Under the EU AI Act, obligations depend on your role: provider or deployer. Here's who does what, and when a company that merely uses AI becomes a provider.
- · 1 min
EU AI Act 2026: what Italian SMEs must do before enforcement begins
From 2 August 2026, oversight of high-risk AI systems begins. Here is the minimum compliance checklist for an Italian SME.