AI Act: The Timeline of Obligations for Italian Businesses

The European Union's AI Act doesn't come into force all at once: it rolls out in stages between 2025 and 2027. For an Italian business, large or small, understanding these dates is the first step to knowing what needs doing now and what can wait, without being caught off guard or freezing up out of alarm.

The main deadlines, in order

The AI Act's timeline unfolds in successive phases, each with different obligations:

• February 2025 – Bans on AI practices considered an unacceptable risk (e.g. social scoring, subliminal manipulation) are already in force, along with the obligation to provide AI literacy training to staff using these systems.
• August 2025 – Governance obligations kick in, along with specific obligations for providers of general-purpose AI (GPAI) models, such as transparency about training data.
• August 2026 – The most important deadline for most businesses: obligations for "high-risk" AI systems come into force (e.g. staff selection, credit scoring, certain uses in healthcare and education), along with general transparency rules towards users.
• August 2027 – The transitional period ends even for high-risk systems already embedded in products regulated by earlier sector-specific legislation (e.g. medical devices, industrial machinery).

Does your business use "high-risk" AI?

Most day-to-day uses of AI in Italian SMEs — writing emails, summarising documents, generating marketing content — don't fall into the "high-risk" category and don't trigger the Regulation's heaviest obligations. The picture changes when AI is used for decisions that directly affect people: candidate selection, creditworthiness assessment, access control to essential services. In those specific cases, the August 2026 obligations need to be taken seriously, even by a small business. We covered this in detail, with a focus on manufacturing, in our article on high risk and manufacturing.

What to do concretely, today

You don't need to wait until 2026 to act. Three useful steps starting now: first, do a simple mapping of where and how AI is already being used in your business, even informally by employees. Second, train the people using these tools on the basics — privacy, sensitive data, checking outputs — which is already a binding obligation, not an optional best practice. Third, if any uses that might fall under "high-risk" come up, get an assessment from a consultant before proceeding, rather than finding out once the rules are already in full force.

A guide built for people who aren't lawyers

Understanding which obligations really apply to your business, without getting lost in the Regulation's text, is why we built a practical AI Act guide for Italian SMEs: plain language, concrete deadlines, no unnecessary jargon. You'll find it in the TomStore shop. If you need a prompt tailored to your specific situation instead, you can create one for free with our prompt generator.

Frequently asked questions

Does my small business need to worry about the AI Act?

In most cases the heavy obligations only apply to specific uses (high-risk). If you use AI for everyday tasks like writing text or analysing documents, the main obligation already in force is basic staff training on how to use it.

What happens if I miss the AI Act deadlines?

The penalties set out in the Regulation are significant and scaled to revenue, similar to the GDPR. That's why it's worth doing a preventive check, especially if your business operates in sensitive areas like staff selection or credit.

Where do I start if I've never looked into this?

Start by mapping how AI is actually being used in your business today, even informally. That's the starting point suggested by EU guidance too, before any other compliance assessment.