AI Act governance: practical policies, not bureaucracy
Compliance with EU Regulation 2024/1689 and Italian Law 132/2025: an audit of what you actually use, classified risks, policies people actually read and an always-current systems register.
The typical situation
In most companies AI has already entered through the back door: someone uses ChatGPT, the back-office software has "smart" features, marketing generates images. Nobody knows exactly where the data goes, which uses are allowed and who answers when something goes wrong. The EU AI Act requires order, with progressive deadlines and proportionate sanctions. It is not a drama: it is methodical work.
What we do
- Audit of AI systems in use: an inventory of tools, actual uses and involved data, including unofficial ones.
- Risk assessment: systems classified into risk tiers under the regulation, with intervention priorities.
- Practical internal policies: short, readable, enforced rules: what can be done, with which tools, with which data.
- AI systems register: the documented inventory the regulation requires you to keep updated.
- DPIA and impact assessments: where required, working with your privacy consultants.
- Staff training: the regulation explicitly requires AI literacy for users (Art. 4). Our Academy covers it.
How we work
We start with a 2 to 6 week audit depending on the number of systems in use. We deliver a realistic compliance plan with priorities, timelines and owners. Then we bring everything to steady state: policies, register, training and periodic checks on a monthly cadence. We coordinate with your legal advisors and DPO: we handle the technical and operational side, we do not replace legal professionals.
Why start now
The regulation's deadlines already apply, and the biggest risk for an SME is not the fine: it is discovering mid-project that a vendor or a use is non-compliant, with the project on hold. One hour of audit today avoids weeks of stoppage tomorrow.
Q.1Does the AI Act apply to our company?
Almost certainly yes if you use AI tools (even just ChatGPT or AI features in back-office software): the regulation applies to anyone deploying or placing AI systems on the EU market, regardless of where the vendor is based.
Q.2What are the risks of non-compliance?
Sanctions are progressive and proportionate: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, much lower thresholds for minor obligations. Most SMEs fall into limited risk tiers with manageable duties.
Q.3How long is a compliance programme?
An audit with a compliance plan typically takes 2 to 6 weeks depending on the number of systems in use. Steady state (policies, register, training) continues on a monthly cadence.
Q.4Do we need to replace our legal counsel or DPO?
No, we work alongside them: we handle the technical and operational side of AI compliance in coordination with your legal advisors and DPO.
Want to know where you really stand?
An initial audit tells you which systems you use, what risk they carry and what to do, in order.