What we learn
from every audit.
Technical notes, real cases and reading on the EU AI Act — written by the people who run the audits, not the ones who talk about them.
AI agents in the workplace: which rules already apply (AI Act and GDPR)
The AI Act has no 'agents' category, but AI agents are not outside the rules. Here's how to classify them, what transparency requires from 2 August 2026, and which GDPR and operational controls you need before giving them access to email, ERP and payments.
Personal data in ChatGPT and Copilot: the seven GDPR checks before using them at work
"Can we put customer data into ChatGPT?" Yes, but only if the processing holds up under the GDPR: a business plan with an Art. 28 contract, no training on your data, a legal basis, transfers, privacy notice, DPIA. The seven checks, with the lessons of the OpenAI, DeepSeek and Replika cases.
The right to an explanation of AI-assisted decisions: Article 86 AI Act and Article 22 GDPR
A customer turned down by a scoring system asks why. What you must answer, by when and in how much detail: the GDPR today, the AI Act for high-risk systems, and the CJEU's Dun & Bradstreet ruling.
AI civil and criminal liability in Italy: what changes for companies from 30 September 2026 (Legislative Decree 160/2026)
Legislative Decree 160/2026 implements Italy's AI law: from 30 September 2026 it brings a new crime for failing to secure high-risk AI systems (Art. 437-bis of the Criminal Code), corporate liability under Decree 231, evidence disclosure and a presumed causal link. What companies must do.
Buying AI: supplier due diligence before you sign
"Our software is AI Act compliant" is a claim, not evidence. Here are the documents to demand, the clauses that turn you into a provider, and the questions to ask before signing.
Fine-tuning and chatbots on an LLM: when your company becomes a "provider" under the AI Act
Training a model on your own data or building an assistant on an LLM via API does not automatically make you a GPAI model provider. But it almost always makes you the provider of an AI system. Here are the three levels to tell apart.
When AI goes wrong: who reports the incident, to whom and by when
An AI system causes harm: does a reporting duty kick in? Article 73 of the AI Act sets 15-, 10- and 2-day deadlines — and the clock starts when *you* find out, not when the provider does. Here is the notification map and the minimum response plan.
ISO/IEC 42001 for SMEs: what it really certifies, and what it does not replace in the AI Act
"If we get ISO 42001 certified, are we covered under the AI Act?" No: there is no presumption of conformity. But it is the most mature method for organising AI governance. Here is when it pays off, and when using it without certifying is enough.
Italy's AI Law 132/2025: what it really requires of companies, one year on
Italy's AI law adds no obligations to the AI Act, yet changes a lot for companies using AI with employees, clients, minors and content: worker information, professional transparency, copyright, new crimes. What already applies and what the decrees bring.
AI system logs: what to keep, for how long, and why they matter when a dispute comes
At least six months of logs for high-risk systems (Arts. 12, 19 and 26 AI Act), but since 30 September 2026 an Italian court can already order the disclosure of records in a damages claim. What to record, how long to keep it, and how not to breach the GDPR while doing so.
CE marking for high-risk AI: conformity assessment, EU declaration and registration
Anyone developing a high-risk AI system must, by 2 December 2027, complete a conformity assessment, sign the EU declaration, affix the CE marking and register in the EU database. Here is the path, step by step.
Human oversight of AI: what the law requires and how to organise it for real
"A person always signs off" is not enough: it cost Uber €825 million. What the GDPR (Art. 22), the AI Act (Arts. 14 and 26) and Italy's Law 132/2025 really require, and how to organise human oversight that survives an inspection.
Whistleblowing and the AI Act: since 2 August 2026, people who report AI infringements are protected
Article 87 of the AI Act extended the Whistleblowing Directive to artificial intelligence infringements. Who is protected, where reports go (internal channel, ANAC, AI Office) and what an Italian company needs to update in its procedure.
Company AI use policy: how to write one (an SME guide)
If someone in your company uses ChatGPT or Copilot, you need a written policy. Here's what it must contain, who governs it, and how to align it with the AI Act, GDPR and the Italian Labour Ministry guidelines (DM 180/2025).
Digital Omnibus: what changes (and what doesn't) in the AI Act deadlines
The Digital Omnibus only postponed high-risk obligations. Bans, literacy, GPAI and transparency still stand: here's what an SME must do now.
Prohibited AI practices (Art. 5 AI Act): the 8 banned uses in business
Article 5 of the AI Act bans eight uses of AI — from social scoring to emotion recognition at work. There is no compliance path: they have been unlawful since 2 February 2025.
AI in hiring: it is high-risk, but Italian obligations already apply today
An ATS that screens CVs falls under Annex III of the AI Act. The EU obligations move to 2 December 2027, but Italy's transparency decree, Workers' Statute, GDPR and Law 132/2025 apply right now.
The AI Act from 2 August 2026: penalties, supervision and the new deadlines after the postponement
The Digital Omnibus (Regulation EU 2026/1744) postponed the high-risk obligations, but on 2 August 2026 transparency, supervision and penalties kick in. Here is the new timeline and who enforces in Italy.
AI-generated content: Article 50 transparency obligations apply from 2 August 2026
The Digital Omnibus deferred high-risk obligations, but not Article 50: from 2 August 2026 chatbots, synthetic content and deepfakes must be disclosed and marked. What to do, and who must do it.
AI systems inventory and risk classification: a practical guide
The first concrete step toward AI Act compliance is knowing which AI systems you use and at what risk level. Here's how to build the register and classify them.
AI Act and GDPR: integrating DPIA and FRIA without duplication
Many high-risk AI systems process personal data, so the DPIA (GDPR) and the FRIA (AI Act) overlap. Here is how to run them as a single exercise.
AI Literacy (Art. 4 EU AI Act): how to build a compliant programme
AI literacy is an EU AI Act obligation in force since 2 February 2025. Here is what Article 4 really requires and how to build a compliant, proportionate training programme.
Provider or deployer? Who is responsible for what under the EU AI Act
Under the EU AI Act, obligations depend on your role: provider or deployer. Here's who does what, and when a company that merely uses AI becomes a provider.
EU AI Act 2026: what Italian SMEs must do before enforcement begins
From 2 August 2026, oversight of high-risk AI systems begins. Here is the minimum compliance checklist for an Italian SME.