The GDPR changed the way European organizations handle personal data. Many discovered its impact only when the first penalties arrived. With the AI Act, Europe is building a similar system across a broader perimeter, with potentially higher penalties and a variable the GDPR did not have: artificial intelligence is already embedded in the decision-making processes of virtually every organization that adopted digital tools during the previous three years.
The regulation entered into force on August 1, 2024. Prohibited practices became applicable on February 2, 2025. On August 2, 2026, the main obligations for high-risk systems and transparency take effect. The article states that the most serious infringements can attract penalties of up to €35 million or 7% of annual global turnover, whichever is higher.
Understanding what the regulation contains, what will happen and what consequences it may have for the world of work is therefore essential.
What the AI Act is
The AI Act is the first regulatory framework in the world to treat artificial intelligence as regulated infrastructure rather than simply as a tool.
Its reference paradigm is the GDPR applied to AI systems, using the same risk-based compliance logic and the same ambition to make European governance a global standard.
The regulation classifies AI systems into four risk categories. The first comprises systems presenting unacceptable risk, prohibited because they conflict with fundamental rights: social scoring, subliminal manipulation, emotion recognition in prohibited contexts and abusive biometric profiling. These prohibitions have applied since February 2025.
The second category covers high-risk systems. They are permitted but subject to stringent documentation, auditing, human oversight and traceability obligations. The category includes systems affecting recruitment, credit, education, health, infrastructure and justice. The principal obligations become fully operational in August 2026.
The third category is limited risk. It includes much of digital communication: chatbots, AI-generated text, deepfakes, conversational systems, avatars and voice clones. Disclosure is the central principle. Users must know that they are interacting with artificial intelligence, and in many cases the obligation already applies.
The fourth category, minimal risk, includes internal optimization tools and non-sensitive AI applications. The regulatory impact is limited.
Why it concerns organizations working in communication and governance
The question the AI Act poses to organizations is not “Do you use AI?”
It is: “How do you use it, on whom, with which data, with what impact and with what transparency?”
Organizations working in communication governance, brand positioning, strategic consulting, corporate data and the reputation of major brands occupy a precise area of responsibility. Four scenarios define the concrete risk.
The first concerns sensitive data uploaded into public AI systems. When a team enters confidential documents, strategies, client data or reserved information into ungoverned AI systems, it creates an issue involving privacy, intellectual property, data governance and leakage risk. For professionals working with multinational companies and public bodies, this is not an exception. It is a daily practice that is often poorly regulated.
The second concerns synthetic media. AI-generated faces, voices, avatars and realistic video may fall into the limited-risk category and activate disclosure obligations. Professionals producing these materials for third parties carry a responsibility extending beyond the quality of the output.
The third concerns decisions based on unverified AI output. When a strategic decision about reputation, corporate communication or positioning incorporates AI output without human supervision, accountability becomes central. Who is responsible: the tool, the professional, the organization or management?
The fourth is structural. Large organizations will increasingly ask partners to provide documented AI policies, governance frameworks, control processes and traceability. Partners without them will be perceived as structurally immature, regardless of the quality of their work.
What AI governance really means
Governing AI within an organization means building a system in which every use is regulated, every output is verified and every responsibility is assigned.
It requires an internal AI policy defining who may use which tools, for which purposes and with which categories of data. It requires human supervision, in which AI produces and a person validates. It requires data classification, distinguishing what may be uploaded from what may not. It requires disclosure procedures defining when and how the use of AI must be declared in external communication.
It also requires vendor assessment covering model compliance, server location and data-retention practices.
This system does not exist by default. It must be built deliberately before circumstances make it urgent.
A transformation catalyzed by regulation
The AI Act is doing to knowledge work what the internet did to information, and the GDPR did to data management. It accelerates a separation the market was already creating slowly: the separation between those who use AI as a tool and those who govern it as infrastructure.
The professional who will acquire the greatest value in the coming years is the one capable of governing the relationship between human and artificial intelligence in the production of reliable, legally compliant, and strategically sound decisions. This person can verify outputs before they become decisions and establish the boundaries within which AI can operate without creating ungoverned liabilities.
That capability is worth more because the market finds it less frequently. August 2, 2026, will make clear who has built it and who has not.
New Connections (FAQ)
How can an organization tell whether it already has an AI Act compliance problem?
Through an audit mapping every current use. Each AI system must be classified according to the regulation’s categories. Systems that affect decisions relevant to third parties, process sensitive data, or produce outputs presented as authentic require documented governance that most organizations have not yet built. The audit reveals the gap. Closing it requires structure, rather than awareness alone.
Is AI Act compliance only a legal issue?
Compliance is the minimum threshold. Strategic positioning is built above that threshold. Organizations that govern AI in a documented and verifiable manner are creating a competitive advantage when working with large clients, public bodies and multinational companies. These organizations will increasingly require AI governance as a procurement prerequisite. A supplier without it will not merely lose one tender. It may lose the structural credibility required to take part in future ones.
What should an internal AI policy contain?
At least six fundamental elements: who may use which AI systems; the specific permitted purposes and categories of data; verification procedures before an output is used in a material decision; disclosure rules towards third parties; criteria for assessing AI vendors; protocols for data uploaded into systems; and the chain of responsibility when AI output causes an error. A document of this kind is the structure that separates professional use of artificial intelligence from improvised use.
Where can Italian companies find a complete guide to their specific obligations?
The distinction between provider and deployer, provisions dedicated to SMEs, the national penalty regime and the framework updated by Italian Law 132/2025 can significantly alter risk exposure according to an organization’s size and role. The Corallo AI analysis is a useful starting point before any internal assessment.
BLISS®
© 2026. ALL RIGHTS RESERVED