A guide to using AI tools: avoid fines of up to 7% of your turnover.

Are you using artificial intelligence correctly? Tools such as Claude, ChatGPT and Gemini are already in your teams' hands, often without a company policy and without the governing body being fully aware of the legal implications. With the European AI Act and Italian Law no. 132/2025, ungoverned use of AI has become a concrete risk: fines reach 35 million euros or 7% of annual worldwide turnover.

This guide offers companies and professionals an operational framework: how to classify the AI systems in use, which obligations apply, and how to turn compliance into a competitive and tax advantage.

1. AI in the company: already present, often ungoverned

Most companies already use artificial intelligence, even without knowing it. It is not just ChatGPT for drafting texts: AI systems include CV-screening software, credit or commercial scoring algorithms, predictive analytics, customer-service chatbots and employee-monitoring systems.

The problem is not use in itself: it is the absence of governance. When an employee uses Claude or Gemini to produce company documents, or when a management system automatically scores clients, legal responsibilities arise that the governing body must know and oversee.

Warning: informal use is not risk-free use. Unstructured use of AI tools by staff — without policy, training or traceability — does not exclude the company's liability. Without documented governance, the company's position in the event of an inspection is structurally weaker.

2. The regulatory framework: the AI Act and Law 132/2025

Regulation (EU) 2024/1689, known as the AI Act, entered into force on 1 August 2024 with progressive application. The rules on unacceptable-risk systems have applied since February 2025; those on high-risk systems come fully into force between 2026 and 2027.

In Italy, Law 132/2025 implemented and supplemented the European framework, designating AGID as the national authority competent for supervision and sanctions. The law establishes a national register of high-risk AI systems and introduces specific obligations for companies that develop or use AI in sensitive contexts.

3. Risk classification: four levels

The AI Act takes a risk-based approach: obligations depend on the system's risk level, not on the technology used.

• Unacceptable risk (prohibited): generalised social scoring, subliminal behavioural manipulation, exploitation of vulnerable people, real-time remote biometric identification. These systems cannot be used.
• High risk: systems affecting fundamental rights or significant decisions (CV screening, credit scoring, AI in medical or judicial contexts). Strict obligations of transparency, documentation and human oversight.
• Limited risk: transparency obligations towards users (e.g. chatbot disclosure).
• Minimal risk: no specific obligations, but recommended good practices.

⚠️ The system you think is harmless. A tool that filters CVs or scores clients is not a technical detail: if it affects rights or significant decisions, it is a high-risk system. Misclassification is the mistake that, on its own, opens the door to the highest sanctions.

4. The sanctions regime: three levels

The sanctions regime is built on three levels, with proportionality and deterrence criteria similar to the GDPR:

• Prohibited practices: up to 35 million euros or 7% of worldwide turnover (whichever is higher).
• High-risk systems — breaches of the main obligations: up to 15 million euros or 3% of worldwide turnover.
• Inaccurate information to the authorities: up to 7.5 million euros or 1.5% of worldwide turnover.

Proportional reductions apply to SMEs and start-ups, but the percentage threshold on turnover remains: for a company with 10 million euros in revenues, 3% means 300,000 euros.

5. The indirect tax risk of non-compliant AI

Non-compliance with the AI Act generates not only sanction risks but also tax risks. Administrative fines are not deductible under Article 99 of the Italian Income Tax Code (TUIR). Late compliance costs are less plannable and higher than preventive ones. Sanction proceedings can also damage commercial reputation and reduce the future tax base.

Companies that address AI compliance in a structured way can classify costs correctly (deductible as general expenses or capitalised as intangible assets) and access the tax credits for technological innovation provided by current legislation.

6. Compliance as a strategic lever

An advanced approach turns regulatory adaptation into a planning lever. Correct classification of compliance costs, access to tax incentives for technological innovation, reduction of indirect tax risks and integration with internal control systems all make AI compliance an investment, not a burden.

A company that properly documents its AI governance model is also stronger in due diligence, bank financing or extraordinary transactions.

7. How to structure effective AI compliance: the five phases

• 1. AI Audit. Mapping of the systems in use (including informal ones), analysis of purposes and data processed, identification of technology vendors.
• 2. Legal classification. Risk-level qualification of each system, verification of applicable obligations, analysis of contractual chains with AI vendors.
• 3. Internal policy. Drafting of a company AI policy, staff training, designation of an AI officer.
• 4. Technical documentation. For high-risk systems: data documentation, activity logs, human-oversight protocols.
• 5. Continuous monitoring. The system must be monitored over time: the AI Act provides for update and notification obligations in case of substantial changes.

Frequently asked questions

We are an SME: does the AI Act apply to us too?

Yes. The AI Act applies to any operator using AI systems in a professional context in the EU, regardless of size. SMEs benefit from some sanction reductions, but are not exempt from the obligations.

We only use ChatGPT to write emails: are we at risk?

For internal texts or generic communications, the risk is minimal. But if the system is used to generate opinions, analyses or third-party communications presented as your own, transparency obligations apply.

Our HR software screens CVs automatically: what should we do?

Check whether the system falls into the high-risk category (almost certainly yes, if it determines or influences hiring decisions). If so: map the vendor, verify the technical documentation, implement human oversight of final decisions and update internal policies.

When do the obligations for high-risk systems come into force?

High-risk systems in HR, credit and education must be compliant by August 2026. Systems already on the market have a transitional period ending in 2027.

Article by Dario Carta (Lawyer and Chartered Accountant), originally published in Italian on cartaepartners.it. Reproduced and translated with the author's consent.

← All news