By Antonio Giarrusso, founder of Userbot and Head of AI at the smeup group · November 2026. This guide is not legal advice: for specific cases, the official text on EUR-Lex is authoritative.
The AI Act, Regulation (EU) 2024/1689, isn’t only about those who develop AI: it also applies to companies that use it in a professional context. Even companies that use AI chats, assistants and agents developed by others have obligations, starting with the AI literacy of their staff and transparency towards customers.
Providers and deployers.
The AI Act, Regulation (EU) 2024/1689, distinguishes between those who develop an AI system and place it on the market (the provider) and those who use it in a professional context (the deployer). Most Italian companies fall into the second category: they use AI chats, assistants and agents developed by others. Even so, they have obligations.
The deadlines.
- 1 August 2024Regulation (EU) 2024/1689 enters into force.
- 2 February 2025The bans on prohibited practices (Art. 5) and the AI literacy obligation (Art. 4) apply.
- 2 August 2025The obligations for providers of general-purpose AI models apply.
- 2 August 2026The transparency obligations apply (Art. 50), for example disclosing that people are interacting with an AI system.
- 2 December 2027Obligations for the high-risk systems listed in Annex III (for example recruitment and credit scoring), after the postponement agreed in 2026 with the Digital Omnibus package.
- 2 August 2028Obligations for high-risk systems embedded in regulated products (Annex I), such as medical devices and machinery.
On the 2026 postponement: Gibson Dunn, Cooley. For the text in force, EUR-Lex is authoritative.
What to do, in five points.
- 1Take inventoryWhich AI tools are used in the company, who uses them and for what. Including the ones nobody approved.
- 2Train your peopleArt. 4 requires those who use AI to ensure a sufficient level of AI literacy among their staff. You need training suited to each role, and a record that it took place.
- 3Disclose AI to customersIf customers are talking to an AI assistant, they must know. The same goes for generated content that may look real.
- 4Identify high-risk usesRecruitment, credit scoring and other uses listed in the regulation carry extra obligations: human oversight, log keeping, informing workers.
- 5Govern the use, not just the policyPermissions, approved models, allowed data and a log of every step, enforced by the tool, make usage controllable and documentable.
Where governance comes in.
Many obligations become simple if AI use goes through a single governed tool instead of dozens of personal accounts: you know who uses what, with which data, and you can prove it. That’s the problem we tackle with Userbot. The method is in the guides on AI adoption in companies and Shadow AI.
Frequently asked questions.
Does the AI Act also apply to companies that use ChatGPT or similar tools?
Yes. The regulation distinguishes between those who develop systems (providers) and those who use them in a professional context (deployers). Those who use them have obligations too, starting with the AI literacy of their staff.
What does AI literacy mean?
That people who use AI for work must have skills suited to their role: understanding what the tool does, its limits and risks, and how to use it properly.
When do the obligations for high-risk systems apply?
In the original text, from 2 August 2026. With the 2026 Digital Omnibus package they were postponed: to 2 December 2027 for the uses listed in Annex III and to 2 August 2028 for AI embedded in regulated products. It is worth checking the consolidated text on EUR-Lex.