The AI Act already applies. The part that affects you is smaller than it looks.

On 2 August 2026, Article 50 of the EU regulation on artificial intelligence began to apply. Since that day, a great many Italian businesses have been using tools that fall within its scope without knowing they're inside a scope at all. The useful part lies in a distinction of role that almost nobody explains, and that cuts a small business's obligations down to four things.

This piece sits alongside the AI and automation glossary and the AI transparency page, where Itria discloses which systems it uses and how. It's written for people who run a business, and it stops where a lawyer's work begins.

What kicked in on 2 August

The AI Act didn't come into force all at once. It arrives in stages, and 2 August 2026 was the turn of Article 50, the one on transparency. It's the article that affects the largest number of ordinary businesses, because it isn't about high-risk systems or biometric recognition in the street. It's about one thing: when a person is dealing with an AI, they have a right to know.

It applies to all systems within scope, regardless of the date they were placed on the market.

That line is the part that surprises people. There's no grandfathering for the chatbot installed on your website in 2024. If it's within scope today, it has to be disclosed today. The only extension covers the technical marking of generated content, the machine-readable kind, and only for systems already on the market before 2 August: for those, the deadline is 2 December 2026. All the article's other obligations apply now.

The distinction that changes everything: provider and deployer

This is where most conversations that begin with “so now we have to do AI compliance” go off track. The regulation distinguishes two roles, and treats them very differently.

The provider is the company that develops an AI system and places it on the market under its own name. Most of the regulation's weight falls on them: technical documentation, conformity assessment, risk management, registration.

The deployer, meaning the user, is the business that takes one of those systems and uses it in its own work. A company that puts an assistant on its website, generates text with a model, or has calls transcribed. In almost every case, an Italian SME is here. And under Article 50, a deployer's obligations are essentially about informing people.

It isn't a loophole or a technicality. It's how the regulation is built: the weight falls on the company that builds the tool, the transparency on the business that points it at a person.

There are actually six roles, not two, and one of them can be inherited without signing anything: a business that puts its own brand on a high-risk system becomes its provider. The full map is on the page about who the AI Act applies to and in what role, and the classification of systems on the page about risk levels.

The three cases that really affect a small business

Article 50 covers more ground, but for a service business, a producer or a hospitality business it almost always comes down to three situations.

Situation	What you need	Where people go wrong
Direct interactionchatbot, assistant, answering system	The person has to know they're talking to a system, and know it before they start, not after. One clear line at the start is enough.	The assistant with a human name and a smiling photo. The more human it seems, the stricter the obligation.
Generated contenttext, images, audio	Machine-readable marking when content is generated or manipulated, and a visible disclosure when it's published to inform the public on matters of public interest without human review.	Assuming it covers every product description. A description read and approved by a person isn't content published without editorial control.
Synthetic voice and facedeepfake, cloned voice	It has to be disclosed on the content. That applies even when the cloned voice is your own and you authorised it.	The promotional video with a generated voice and no note. It's the most visible case, and the first one a competitor will report.

The Italian law, which concerns your staff

On top of the EU regulation, Italy has added its own law: Law no. 132 of 23 September 2025, in force since 10 October 2025. The part that affects employers concerns internal processes, not dealings with customers.

It asks for three things, and they're reasonable. Inform staff before introducing an AI system into a process, explaining what it's for and what data it processes. Keep a person able to check and correct every decision made or suggested by the system. Keep documented records, meaning know which systems are running, where, and who is responsible for them.

If you've already built your automations with a human step at the sensitive points, half the work is done. If you've let an agent write to customers on its own, you have a problem that isn't just about the law.

The law also does five other things the EU regulation doesn't, from copyright to a new criminal offence: they're collected on the page about Law 132/2025 on artificial intelligence. On how it fits with data protection, there's the page on the AI Act and the GDPR.

The penalties, without the scaremongering

Breaching the transparency obligations falls in the middle tier of the penalty regime: up to €15 million or 3% of worldwide annual turnover, whichever is higher. The figure gets quoted a lot, mostly to sell training courses.

Here's the part almost nobody mentions: for small and medium-sized businesses, the lower of the two figures applies, not the higher. It's still a figure nobody wants to see, and it's still a long way from the ordinary case of a business that forgot a line under its chatbot. For an SME, the realistic risk isn't the fine. It's the customer finding out on their own that they were talking to a machine. The three tiers, the criteria for arriving at a figure, and who can impose them in Italy are on the page about AI Act penalties.

AI Act obligations, business by business

The European Commission sums up Article 50 in a single line: “Article 50 of the AI Act applies as from 2 August 2026”. Four obligations follow from it, and they don't all fall on the same party: two concern the provider of the system, two the deployer.

Obligation	Who it applies to	From when
Say it's AIdirect interaction	The provider of the system, who has to design it so that people are informed they're interacting with an AI system. An SME using a third-party assistant inherits it already compliant, and just mustn't hide it.	2 August 2026
Mark synthetic contentmachine-readable format	The provider of a system that generates or manipulates text, images, audio or video, who has to make the output marked and detectable as artificial.	2 August 2026, with a window until 2 December 2026 for systems placed on the market before August
Inform people exposedemotions and biometrics	Anyone who uses emotion recognition or biometric categorisation systems, who must inform the people exposed to them of how they work.	2 August 2026
Disclose deepfakesmanipulated content	Anyone who uses the system to produce manipulated content, who must disclose it clearly and distinguishably, at the latest at first exposure.	2 August 2026

For most small Italian businesses, that's where it ends: you use third-party tools, so the third and fourth rows count, and the first only in the sense that you mustn't hide it. The two provider rows concern the company that builds the system, not the business that buys it.

It also applies outside the EU: the same source specifies that providers established or located outside the European Union are subject to the AI Act if their system's output is used in the Union.

The four things to sort out

Strip away the theory, and bringing a small business that uses third-party tools into line comes down to four steps. None of them needs a consultant to get started.

Step	What you do	What it costs
01 · The listhalf a day	Write down which AI systems are running in the business, who switched them on, what data they work on and where that data is stored.	A spreadsheet. It's also the document Law 132/2025 expects you to be able to show.
02 · The disclosuresan afternoon	One line under every automated point of contact, and a note on generated content where needed.	Text. The real cost is deciding how to say it without sounding like a legal notice.
03 · The public pagea day	A page that discloses the systems in use, their purpose and where the data is kept. In this form it isn't mandatory, and it's the cheapest way to show the rest has been done.	See ours, which is written exactly like that.
04 · The human checkpointongoing	On every automated process that touches a customer, money or an outgoing message, a person approves before it goes out.	Nothing, if the system was designed that way. A lot, if it has to be rebuilt afterwards.

There's a fifth point that isn't on this list because it doesn't come from Article 50: Article 4 requires you to look after the skills of the people using the systems, and it has applied since 2 February 2025. The detail is on the page about the obligation to train staff on artificial intelligence.

The dates, in order

2 February 2025: Chapters I and II apply, meaning the obligation to look after the skills of people using the systems, in Article 4, and the prohibitions in Article 5. 10 October 2025: Law 132/2025 comes into force, and with it the obligations towards employees. 2 August 2026: Article 50 applies, to all systems within scope regardless of when they were placed on the market.

2 December 2026: the extension for content marking only, for systems already in place before August, expires, and on the same day two new prohibited practices added to Article 5 start to apply. 10 October 2026 is an Italian date: the deadline of the delegation in Article 24 of Law 132/2025 for the decrees assigning enforcement powers.

The dates for high-risk systems have been moved. Regulation (EU) 2026/1744 of 24 July 2026 rewrote Article 113 and pushed Chapter III, sections 1, 2 and 3, back to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The delay doesn't affect the prohibitions, AI literacy or transparency, so a small business hasn't gained time on anything that concerns it. The full picture is in the updated timetable of AI Act deadlines.

Frequently asked questions

This article is a practical overview, not legal advice. For specific situations, and in particular on organisational models and employment relationships, the answer has to come from a professional who looks at your business.