AI Act, law 132, NIS2 and GDPR: what applies, when and to whom, and what a small company actually has to do. Deadlines and fines with the legal reference.
AI rules arrived before AI did in many Italian small companies: some have to comply with the AI Act without ever having started a project, simply because their staff use tools nobody authorised. The obligation does not come from what the company bought, it comes from what is being used inside it.
Here you will find what applies and when: the AI Act, Italian law 132, NIS2 and GDPR applied to the data that ends up inside a model. With the angle a small company needs, which is not legal commentary but what you have to do, who has to do it, and what documents prove you did.
7 articles in this topic, updated 13 Aug 2026
At a client I asked which tool they used to transcribe meetings: the answer was five different tools, four of them free, two with GDPR and AI Act prob…
August 2, 2026 is the most misunderstood date in the EU AI Act: high-risk obligations were postponed to 2027, but transparency rules do apply. Chatbot…
NIS2 isn't just for large companies: the supply chain pulls SMEs in too. Find out who must comply, the 10 security areas of Article 21, the 2026 deadl…
ChatGPT can help an SME, but not everything can be pasted into a chat. Here are 7 types of data not to upload without rules, anonymization and control…
In AI projects compliance cannot arrive at the end. You need a legal tech role working with engineers, architects and analysts from the assessment pha…
The European AI Act is already in force and penalties reach up to 35 million euros. Discover what obligations your company must respect, the deliverab…
While AI evolves at an exponential pace, governance moves linearly. The gap between technological capabilities and security widens: how to build AI on…
Yes, if an AI system is used in the company. The obligations depend on your role, whether you provide the system or use it, and on its risk level. Staff AI literacy is the one that touches almost everyone.
Administrative fines proportionate to the seriousness and to the size of the business, plus a more immediate risk: a client or a tender asking how you govern AI, and you have nothing to show.
With an inventory: which AI tools are actually used in the company, by whom and with what data. That first sweep almost always turns up things nobody authorised, and from there you can see what is really needed.
The two topics closest to this one
Ten reference areas, a guided questionnaire and a PDF report with the gaps to close first.
Take the NIS2 Readiness AssessmentFree, in ten minutes