Many business owners hear about the AI Act and assume it only concerns those who build artificial intelligence. It doesn't: the European regulation also applies to those who use it in their work, which includes the professional firm that has ChatGPT draft its emails and the company that uses Copilot to summarise meetings. The good news is that, for this kind of use, the obligations are few and within everyone's reach.
What the AI Act is, in short
The AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and applied in stages. It classifies artificial intelligence systems according to risk: some practices are banned, some uses are considered high-risk (for example recruitment or credit scoring) and most everyday tools fall into categories with light obligations. In Italy there is also a national law on artificial intelligence (Law 132/2025), which takes up the European principles and applies them to certain sectors.
Someone who uses an AI system for work is what the regulation calls a "deployer". That is probably you.
The first obligation: knowing what you are using
Since 2 February 2025 the AI literacy obligation (Article 4, which we also discuss in Training first, then the tool) has applied: companies that use these tools must make sure the people operating them are sufficiently prepared. You don't need a master's degree: you need whoever uses ChatGPT to know that it can make things up, that confidential data must not be pasted into it without the right safeguards, and that the output must always be checked. A short, documented training session is the simplest way to show it.
From the same date some practices are banned, such as manipulating people or recognising emotions in the workplace. A small business that writes texts or analyses documents is unlikely to fall into them, but it is worth knowing.
The second obligation: being transparent
Since 2 August 2026 the transparency obligations (Article 50) have applied. In practice: if a customer talks to a chatbot, they must know they are not talking to a person; if you publish images, audio or video generated or altered with AI that look real, you must say so. A line in the website chatbot and a note on generated content are enough in most cases.
For high-risk systems the rules are far more demanding, and the European Union has proposed postponing part of them: if you use AI to select candidates, assess people or make decisions that affect them, a specific and up-to-date analysis is advisable.
What about the GDPR?
The AI Act does not replace the GDPR: it adds to it. Whenever data about customers, employees or suppliers ends up in an AI tool, the usual rules apply. There are three questions to ask: what data am I entering, where does it go, and does the provider use it to train its models. Free versions of the main tools often have less protective terms, while business plans usually exclude the use of data for training. Reading the terms of the plan you use, and updating your privacy notice if needed, takes little time and removes a lot of risk.
Where to start this week
Make a list of the AI tools that are actually used in the company, including those that staff have switched on by themselves. For each one, note what it is used for and what kind of data goes into it. Then organise an hour of training for the people who use them and write two lines of internal rules: what can be entered, what cannot, who checks the results. With these three steps (see also our page on AI Act and GDPR compliance) you have already covered the most important part of what the AI Act asks of those who use artificial intelligence, and you have a solid base for tackling the more delicate cases.
This article is for information only and does not replace legal advice on your specific case. The dates and rules mentioned are up to date at the time of publication: we review them periodically.
