The digital revolution has profoundly transformed the way we produce, communicate, and interact with data, introducing new types of risk related to data management, cybersecurity, transparency, and accountability in increasingly advanced technologies.
With the advent of the internet and global connectivity, organizations have gained immediate access to information and accelerated the digitalization of production processes. At the same time, this evolution has given rise to new threats, including cyberattacks, data manipulation, and mass surveillance.
As a result, the legal framework has continued to evolve in response to technological innovation, embracing principles of regulatory flexibility to ensure international compliance with Artificial Intelligence regulations, including the emerging requirements of the EU AI Act.
European regulations on Artificial Intelligence
As in other regulatory domains, the European Union has introduced a comprehensive framework for Artificial Intelligence with the AI Act (EU Regulation 2024/1689), which complements the existing EU regulations already embedded in the European Digital Strategy. These include the GDPR, the Data Governance Act, the Data Act, the Digital Services Act (DSA), the Digital Markets Act (DMA), and the Cybersecurity Act, as well as the NIS and NIS 2 Directives, aimed at strengthening cybersecurity across the European landscape.
These rules also apply to non-European technology companies seeking to operate in the EU market, ensuring that they comply with the same AI governance, security, and transparency standards required under the European regulatory framework.
Trust in Artificial Intelligence: existing European AI regulations
The Artificial Intelligence Regulation (AI Act) adopts a risk-based approach: the higher the risk associated with the use of Artificial Intelligence, the more stringent the regulatory obligations imposed by AI governance principles.
For this reason, the AI Act introduces a classification of Artificial Intelligence systems based on risk level, including:
- Prohibited AI systems: Artificial Intelligence practices that are banned because they are incompatible with fundamental rights and core principles of the legal order
- High-risk AI systems: AI systems applied in strategic sectors such as healthcare, education, employee recruitment, and the administration of justice, as well as AI systems that function as safety components
- Limited-risk AI technologies: systems subject to specific transparency obligations
- Low risk AI systems: systems not subject to strict regulatory requirements, but still governed by a framework inspired by principles of trustworthiness, fairness, and accountability
The AI Act applies in a differentiated manner to the various actors involved in the AI value chain, including providers, distributors, and deployers (users).
Given the complexity of the European Artificial Intelligence Regulation, it is not possible to cover all regulatory details governing AI in Europe within a single article.
In summary, however, it is important to distinguish a few key rules:
- Prohibited AI systems cannot be placed on the European market (the full list is set out in Article 5 of the AI Act)
- Limited-risk AI technologies are permitted, but are subject to specific transparency obligations, including the requirement to inform users when they are interacting with an Artificial Intelligence system
AI Act obligations for deployers: what companies using high-risk AI must do
The report Artificial Intelligence for the Italian System published by Confindustria provides a more detailed overview of the obligations that apply to employers who intend to integrate high-risk Artificial Intelligence systems within their organizations, acting as deployers rather than providers.
The list of cases in which an AI system is classified as “high risk” can be found in Article 6 of the AI Act and in Annex III. Under the regulation, employers are responsible for assessing the risks associated with the use of AI and for any damage that such systems may cause.
This entails significant investments in technology, organizational structures, and training, and requires companies to manage complex issues ranging from data protection and workplace safety to employee monitoring and health protection. These areas are already governed by other European regulations—such as the GDPR for privacy and the Machinery Regulation for occupational safety—as well as by national legislation on data protection, workplace safety, and workers’ rights.
What obligations does the AI Act introduces for companies adopting Artificial Intelligence?
According to the AI Act, the way deployers must comply with their regulatory obligations is structured around four key areas:
- oversight
- transparency
- integrity
- security
The aim of the regulation is to ensure effective monitoring of AI systems during their operation—verifying how systems function, understanding what they are doing in real time, and being able to intervene or suspend their use when necessary. This is achieved through what the AI Act defines as “human oversight.”
Digital literacy and other AI Act obligations for deployers
Among the obligations introduced by the AI Act for deployers is the requirement for digital and AI literacy, set out in Article 4 of the Regulation and already in force since February 2025, aimed at ensuring an adequate level of training and awareness in the use of Artificial Intelligence systems.
Additional obligations for companies deploying high-risk AI systems are outlined in Articles 26 and 27 of the AI Act, which respectively define the measures to be adopted and the content of the fundamental rights impact assessment, where required under the AI regulation.
Deployer obligations and AI Act compliance
Article 26 of the AI Act defines the obligations of deployers of Artificial Intelligence systems, requiring them to adopt technical and organizational measures to ensure that AI is used in accordance with the instructions provided by the provider. Providers, in turn, must ensure the availability of all relevant information needed to properly manage the technology, including through Artificial Intelligence training programmes.
A core element of AI Act compliance is the verification of input data quality. Unless otherwise specified by sector-specific regulation, deployers are required to retain logs generated by the AI system for at least six months, in order to support monitoring and control activities.
The human-centric approach underpinning the AI Act, together with effective risk management, relies on continuous monitoring of AI systems. This is essential to promptly report any anomalies to the provider or, where no provider exists, to the competent authority.
From a procedural perspective, before putting a high-risk AI system into service or using it in a workplace context, deployers must inform employees or their representatives about the use of the system.
The AI Act does not comprehensively regulate civil liability for damage caused by AI systems, which remains governed by national legal frameworks. In Italy, this includes Articles 2050 and 2051 of the Italian Civil Code, which establish a form of strict liability for damage caused by Artificial Intelligence systems.
AI Act and the Digital Omnibus: regulatory evolution and simplification
Finally, the AI Act remains a regulatory framework that is still evolving. In recent weeks, the European Commission has presented the Digital Omnibus, a package of measures aimed at simplifying the application of digital regulations, including the rules governing the AI Act.
If adopted in its current form, the Digital Omnibus would make the AI training requirement for employees mandatory only for high-risk systems, postpone the entry into force of rules on high-risk AI systems, and require the European Commission to issue guidance on the AI Act, thereby facilitating compliance for companies within the broader European digital regulatory framework.
Trustworthy and compliant AI: IT4LIA’s AI Trust services
To develop trustworthy Artificial Intelligence solutions that comply with the AI Act, the IT4LIA AI Factory project—serving both public and private organizations—provides a dedicated portfolio of AI Trust service devivered by National Cybersecurity Agency and University of Bologna.
These services ensure security, transparency, and compliance with both national and European regulations throughout the development of AI solutions with IT4LIA AI Factory, offering specialized support in data protection, cybersecurity, and legal triage.
Discover how to access AI Trust services by scheduling a call with our Artificial Intelligence and HPC experts.
training course: Introduction to the AI Act
Visit the IT4LIA AI Factory training page page to explore IT4LIA’s training offering and, in particular, , the course designed to support professionals and university students interested in the topic in understanding the new European regulatory framework for Artificial Intelligence.
Promoted by IT4LIA, the initiative will take place online between February and March 2026 and will focus on the main regulatory aspects: from general provisions to prohibited AI practices, from high-risk AI systems to transparency obligations, as well as tools to support innovation.
Giovanni Bognetti, Silvio La Torre (CONFINDUSTRIA)
