What we learn
from every audit.
Technical notes, real cases and reading on the EU AI Act — written by the people who run the audits, not the ones who talk about them.
Company AI use policy: how to write one (an SME guide)
If someone in your company uses ChatGPT or Copilot, you need a written policy. Here's what it must contain, who governs it, and how to align it with the AI Act, GDPR and the Italian Labour Ministry guidelines (DM 180/2025).
Digital Omnibus: what changes (and what doesn't) in the AI Act deadlines
The Digital Omnibus only postponed high-risk obligations. Bans, literacy, GPAI and transparency still stand: here's what an SME must do now.
Prohibited AI practices (Art. 5 AI Act): the 8 banned uses in business
Article 5 of the AI Act bans eight uses of AI — from social scoring to emotion recognition at work. There is no compliance path: they have been unlawful since 2 February 2025.
AI in hiring: it is high-risk, but Italian obligations already apply today
An ATS that screens CVs falls under Annex III of the AI Act. The EU obligations move to 2 December 2027, but Italy's transparency decree, Workers' Statute, GDPR and Law 132/2025 apply right now.
The AI Act from 2 August 2026: penalties, supervision and the new deadlines after the postponement
The Digital Omnibus (Regulation EU 2026/1744) postponed the high-risk obligations, but on 2 August 2026 transparency, supervision and penalties kick in. Here is the new timeline and who enforces in Italy.
AI-generated content: Article 50 transparency obligations apply from 2 August 2026
The Digital Omnibus deferred high-risk obligations, but not Article 50: from 2 August 2026 chatbots, synthetic content and deepfakes must be disclosed and marked. What to do, and who must do it.
AI systems inventory and risk classification: a practical guide
The first concrete step toward AI Act compliance is knowing which AI systems you use and at what risk level. Here's how to build the register and classify them.
AI Act and GDPR: integrating DPIA and FRIA without duplication
Many high-risk AI systems process personal data, so the DPIA (GDPR) and the FRIA (AI Act) overlap. Here is how to run them as a single exercise.
AI Literacy (Art. 4 EU AI Act): how to build a compliant programme
AI literacy is an EU AI Act obligation in force since 2 February 2025. Here is what Article 4 really requires and how to build a compliant, proportionate training programme.
Provider or deployer? Who is responsible for what under the EU AI Act
Under the EU AI Act, obligations depend on your role: provider or deployer. Here's who does what, and when a company that merely uses AI becomes a provider.
EU AI Act 2026: what Italian SMEs must do before enforcement begins
From 2 August 2026, oversight of high-risk AI systems begins. Here is the minimum compliance checklist for an Italian SME.