You are already an AI deployer

01 What actually started on 2 August, and what didn’t

On 2 August 2026 a block of the AI Act became applicable, and the Italian press covered it thoroughly: the transparency obligations of article 50, which require anyone deploying chatbots, voice assistants or synthetic content to make clear that what the user is dealing with was generated or manipulated by a machine. Breaching them can cost up to 15 million euros or 3% of worldwide annual turnover: the Regulation’s chapter on penalties has applied since 2 August 2025, and in Italy the decree that organizes the authorities’ powers and fines (Legislative Decree 179/2026) enters into force on 23 October 2026.

Less well covered is what did not start. Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, in force since 27 July 2026, pushed the obligations for high-risk systems back: to 2 December 2027 for the stand-alone systems of Annex III, which include recruitment, credit and education, and to 2 August 2028 for systems embedded in regulated products. So the part most companies were bracing for is now more than a year away.

The practical conclusion most Italian SMEs have drawn from this coverage is reasonable and wrong: none of it applies to us, we do not sell chatbots and we do not run high-risk systems. The first half is usually true. The second half skips an article that has been binding since before any of this.

02 The word that applies to you is “deployer”

The Regulation splits the world into roles, and the two that matter here are provider and deployer. A provider develops an AI system, or has one developed, and places it on the market under its own name. That is not you.

Article 3(4) defines a deployer as anyone, a company or a public body included, “using an AI system under its authority”, with one exception: use “in the course of a personal non-professional activity”.

Read the exception carefully, because it is the whole thing. Personal non-professional use is outside. Your sales assistant summarizing a technical datasheet with a chatbot on Tuesday afternoon is not doing anything personal and non-professional. They are doing their job, on your instructions, under your authority. That makes the company a deployer, and it makes it a deployer whether or not anyone ever signed a purchase order, opened a project or told the owner.

The European Commission settles the point in its questions and answers on AI literacy. Asked whether a company whose employees use ChatGPT to write advertising copy or translate texts must comply with article 4, it answers: “Yes, they should be informed about the specific risks, for example hallucination.”

03 The obligation that has been in force since February 2025

Article 4 of the AI Act has applied, under the Regulation’s own timetable, since 2 February 2025. In its first version it asked providers and deployers to ensure, “to their best extent”, a “sufficient level of AI literacy” of their staff. Since 27 July 2026 the Digital Omnibus has replaced it with a softer wording:

In plain terms: if people work with AI systems on your behalf, you have to take measures that help them understand what they are doing with them. Not a certification. Not a guaranteed level, which the new text explicitly rules out. Measures, proportionate to who the people are and to what the systems are used for. The rewrite lightens how much is asked, not whether: the obligation stays, and it has applied since February 2025.

Note who it binds. Not providers only. Providers and deployers. Which, given the definition above, means most Italian companies with more than a handful of office staff, since February 2025.

04 The Italian paradox this collides with

In our piece on personal AI and company memory we used two figures that only make sense together. 47% of Italian workers use AI at work, and of those only 19% do so exclusively with company-provided tools. Meanwhile 83.6% of Italian companies with at least 10 employees use no AI technology at all.

Those are the same offices. The technology arrived through individual curiosity rather than through procurement, which is a perfectly Italian way for a technology to arrive, and it produces a specific legal oddity: a large number of companies now carry an obligation about a practice they have never formally acknowledged exists.

The obligation is not to stop it. Nothing in the Regulation says staff cannot use AI. The obligation is to take measures so that they learn to use it well, which is impossible to satisfy for a practice you are pretending is not happening. You cannot train people on tools you have not admitted are in the building, and you certainly cannot demonstrate that you did.

05 There is no fine for this, and that is the awkward part

Here is where a lot of what has been written is imprecise, and where it is worth being exact. Article 99 lists the provisions whose breach triggers administrative fines: article 5 on prohibited practices at the top of the scale; then, in the 15 million or 3% band, the obligations of providers, authorized representatives, importers, distributors and deployers of high-risk systems, of notified bodies, and the transparency obligations (articles 16, 22, 23, 24, 25, 26, 31, 33, 34 and 50); then incorrect or incomplete information at the bottom. Article 4 is not on the list. There is no dedicated European fine for failing to support AI literacy. Nor is there an Italian one: article 23 of Legislative Decree 179/2026, which sets the national fines from 23 October 2026, does not mention article 4 either.

That should not be read as “so it does not matter”, for three reasons.

1. It is still a binding obligation. Article 99(1) requires Member States to lay down rules on penalties and other enforcement measures for infringements of the Regulation, effective, proportionate and dissuasive, taking into account the interests of SMEs, start-ups and small mid-caps. The absence of a dedicated ceiling is not an exemption.
2. Italy has appointed who checks. Law 132/2025 designates AgID and the National Cybersecurity Agency as the national AI authorities, with market surveillance, inspection and sanctioning functions sitting with ACN, alongside the unchanged competences of the Bank of Italy, Consob, IVASS, the data protection authority and AGCOM in their own fields. Legislative Decree 179/2026 now gives them their tools; what else Italian law asks of companies and professionals is in our guide to Italy’s AI law.
3. It shows up long before an inspection does. Obligations without a headline fine tend to surface in the ordinary places first: in a customer’s supplier questionnaire, in a due diligence, in an insurance policy, in the contractual representations a larger client asks a smaller supplier to sign. That is where “can you demonstrate what you did” gets asked, and demonstrating requires having done something on purpose.

06 What a normal company can actually do about it

The new wording, which explicitly rules out a guaranteed level, and the consideration of SME interests in article 99(1) point at a small and honest set of measures rather than a compliance project. For a company of forty to two hundred people, this is what it looks like:

1. Ask, without consequences, who is using what. The first obstacle is that people will not say, because they assume they are breaking a rule. Say plainly that they are not in trouble. You cannot govern a practice you cannot see, and the map costs one honest conversation per team.
2. Write down what may and may not go into an outside tool. One page. Customer data, drawings, price lists, personal data of employees: the categories, and where the line is. This is the single measure with the highest ratio of protection to effort. Before approving a tool, ask the vendor the right questions.
3. Give people a company route that is better than the personal one. A prohibition that leaves people worse off gets ignored quietly. The only enforcement that works is being more useful than the alternative.
4. Do the training with your own material, not with a generic course. Article 4 asks for literacy in the context the systems are used in. A slide deck about what a large language model is satisfies nobody; twenty examples of real questions from your own work, with what a good answer and a bad answer look like, satisfies both the obligation and the people attending.
5. Keep a trace. Dates, who attended, what the policy said and when it changed. The Commission confirms that no certificate is needed and that you can keep an internal record of training and other initiatives. Unglamorous, and it is the only difference between having complied and being able to say so.

None of this is expensive, and none of it needs a consultant. What it needs is the decision to treat something that is already happening as something the company does on purpose, which is the same decision that turns scattered personal accounts into a shared company memory. The compliance requirement and the operational one point in the same direction here, which does not happen often enough to waste.

07 Note on sources

This article is not legal advice. It reports what the articles say and what has been officially designated in Italy. A concrete assessment needs a professional who has seen how your company actually works.

• Articles quoted are 3(3), 3(4), 4, 50, 99, 111 and 113 of Regulation (EU) 2024/1689, in the consolidated text of 27 July 2026. Article 4 applies from 2 February 2025 under the Regulation’s own timetable; its current wording comes from Regulation (EU) 2026/1744.
• The central claim, that article 4 does not appear among the provisions fined under article 99, was re-verified on 10 October 2026 against article 99 as amended by the Omnibus, and against article 23 of Legislative Decree 179/2026.
• The high-risk postponement and the new article 4 come from Regulation (EU) 2026/1744, read on EUR-Lex: published in the Official Journal on 24 July 2026, in force since 27 July 2026.
• The Italian framework is Law 132/2025 (article 20) and Legislative Decree 179/2026, read on Normattiva.
• The adoption figures come from Istat (December 2025) and the Politecnico di Milano observatory (February 2026), checked again on 10 October 2026.
• Update of 10 October 2026: new wording of article 4, the Omnibus cited by number, Decree 179/2026 added, the national fines placed in time correctly (the penalties chapter has applied since August 2025, the Italian decree from 23 October 2026), the Istat figure qualified (companies with at least 10 employees).

One caution about this piece specifically. This is fast-moving law, and a good part of what circulated in the days around 2 August was imprecise in both directions, describing either obligations that were postponed or fines that do not exist. The text of article 4 itself changed in July. If you are reading this some time after publication, check the dates against the current text before acting on any of it.

Questions and answers

Sources

1. Regulation (EU) 2024/1689 (AI Act), consolidated text of 27 July 2026, articles 3, 4, 50, 99, 111 and 113, EUR-Lex.
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026.
3. AI Literacy, Questions & Answers, European Commission, updated 27 July 2026.
4. Law no. 132 of 23 September 2025 on artificial intelligence, Normattiva (article 20: designation of AgID and ACN).
5. Legislative Decree no. 179 of 7 October 2026, Gazzetta Ufficiale no. 234 of 8 October 2026 (article 23: fines).
6. Imprese e ICT, anno 2025, Istat, 15 December 2025.
7. Il mercato dell’AI in Italia cresce del 50% nel 2025, Osservatorio Artificial Intelligence, Politecnico di Milano, February 2026.
8. ekory, Personal ChatGPT is not your company’s memory, August 2026.