AI Act, law 132, NIS2 and GDPR: what applies, when and to whom, and what a small company actually has to do. Deadlines and fines with the legal reference.
AI rules arrived before AI did in many Italian small companies: some have to comply with the AI Act without ever having started a project, simply because their staff use tools nobody authorised. The obligation does not come from what the company bought, it comes from what is being used inside it.
Here you will find what applies and when: the AI Act, Italian law 132, NIS2 and GDPR applied to the data that ends up inside a model. With the angle a small company needs, which is not legal commentary but what you have to do, who has to do it, and what documents prove you did.
7 articles in this topic, updated 13 Aug 2026
At a client I asked which tool they used to transcribe meetings: the answer was five different tools, four of them free, two with GDPR and AI Act prob…
August 2, 2026 is the most misunderstood date in the EU AI Act: high-risk obligations were postponed to 2027, but transparency rules do apply. Chatbot…
NIS2 isn't just for large companies: the supply chain pulls SMEs in too. Find out who must comply, the 10 security areas of Article 21, the 2026 deadl…
Most read
ChatGPT can help an SME, but not everything can be pasted into a chat. Here are 7 types of data not to upload without rules, anonymization and control…
In AI projects compliance cannot arrive at the end. You need a legal tech role working with engineers, architects and analysts from the assessment pha…
The European AI Act is already in force and penalties reach up to 35 million euros. Discover what obligations your company must respect, the deliverab…
While AI evolves at an exponential pace, governance moves linearly. The gap between technological capabilities and security widens: how to build AI on…
The two topics closest to this one
The AI Act does not just ask for a policy: it asks that people know what they are using. And in Italy, training is often paid for by someone else.
Open the topicAn agent acting on its own moves the responsibility question: there is what they can do, and where they break.
Open the topicTen reference areas, a guided questionnaire and a PDF report with the gaps to close first.
Take the NIS2 Readiness AssessmentFree, in ten minutes