--- title: "EU AI Act: compliance guide for deployers (2026) · Volcanic Minds" description: "EU AI Act, Digital Omnibus and Law 132/2025: what applies to deployers from 2 August 2026 and why high-risk duties move to 2027-2028." url: "https://volcanicminds.com/en/eu-ai-act" lang: "en" type: "first_level_page" updated: "2026-10-07" alternate: "https://volcanicminds.com/eu-ai-act" summary: "The EU AI Act is about those who use AI, not only those who build it. Here is what applies from 2 August 2026, what moves to 2027 and 2028, and what it means in practice for a company that already has AI inside a process: an engineering contribution, not legal advice." --- # EU AI Act why compliance is a code problem, not a paperwork problem From 2 August 2026 transparency, governance, penalties and the powers of national authorities apply, while the Digital Omnibus moves the obligations on high-risk systems to 2027-2028. Italy, with Law 132/2025 already in force and the implementing decrees on the way, is building a regime of criminal and corporate liability for those who release AI systems without oversight. ## The AI Act is already partially in effect. EU Regulation 2024/1689, as amended by EU Regulation 2026/1744. *The 2 August 2026 deadline* The prohibitions apply from February 2025. For high-risk systems the deadlines are 2 December 2027 for Annex III and 2 August 2028 for Annex I, under EU Regulation 2026/1744 (Digital Omnibus), in force since 27 July 2026. A common misconception is that the rule only concerns those who *create* the base models (OpenAI, Anthropic). The reality is different: the Regulation directly affects **deployers**, that is, those who *use* an AI system under their own responsibility in business processes (Art. 3(4)). They are the ones who have to ensure human oversight, logging and compliant use (Art. 26). ## In Italy the framework has to be read on two levels. *How it applies to us* ### Already in force. Law 132/2025 (in force since 10 October 2025) has *directly* introduced new criminal offences related to AI, including the crime of unlawful dissemination of content generated or altered with AI (art. 612-quater c.p., deepfake) and a common aggravating factor for crimes committed through Artificial Intelligence systems (art. 61 no. 11-decies c.p.). ### On the way. On 10 June 2026 the Council of Ministers approved *in preliminary review* (Press Release no. 177) two draft implementing decrees, government acts no. 418 and no. 421, to be adopted by October 2026. The drafts assign oversight to two authorities: AgID as the notification authority, ACN as the market surveillance and data security authority. ## What the draft decrees are about to put on the table *Draft decrees 418 and 421* 1. **A new crime (proposed art. 437-bis c.p.)** — Failure to adopt security measures in high-risk AI systems, where the omission of technical barriers or human oversight leads to a concrete danger for people or public safety. Criminal liability is not "automatic for top management": it falls on those who actually failed to put in place the required measures, with intent or gross negligence. 2. **Extension of D.Lgs. 231/2001 (proposed art. 25-vicies)** — The offence could become a predicate crime for the administrative liability of the entity, with financial and prohibitive sanctions: this is where the risk touches the company as a subject. 3. **Automated workplace decisions** — The drafts prohibit entrusting decisions on hiring, dismissal and disciplinary measures solely to an algorithm, reserving the final decision to a human being; for a dismissal made in violation, nullity is expressly provided. ## Current status of the process *Warning* As of 2 September 2026 the two drafts (government acts no. 418 and no. 421) are still under parliamentary review and have not been published in the Official Gazette. The points therefore come from draft decrees **in preliminary review**, **not yet law in force**. The information reflects the regulatory status at the indicated date, does not replace legal advice and we will update it once the final texts are published in the Official Gazette. ## Our position is clear *The "easy" compliance bluff* True AI Act compliance is not resolved by filling in a PDF and buying the license of a compliance dashboard. The list of theoretical obligations has to turn into practical actions that the IT team must translate and implement on the ground in order not to incur penalties. And the AI Act penalties are progressive: up to **3% of global turnover or €15M** for the obligations on providers and deployers, up to **7% or €35M** for those adopting prohibited practices. Every non-architectural shortcut is debt that comes due at an ACN inspection. Compliance with the AI Act is not an *after-the-fact* administrative activity. It is a **non-functional requirement of the architecture**. It has to be anticipated and written into the code, otherwise, without architecture, it is technical and regulatory debt. ## Compliance by Design *How we help* ### Guardrail engineering *(Art. 15 - accuracy, robustness, cybersecurity).* Deterministic validation systems upstream and downstream of LLM calls, to drastically reduce the risk of the agent hallucinating data, deviating from policies or producing non-compliant output. ### LLM observability & immutable tracking *(Art. 12 - record-keeping).* Runtime control planes that record immutably every operation of agentic systems (context, tokens, decision steps, result) so that in the event of an audit (AgID/ACN) the company can produce intact, traceable and explainable logs (explainability). ### Human-in-the-loop architectures *(Art. 14 - human oversight).* UX and logic designed so that high-risk decisions prepared by AI require the formal validation of a qualified operator, recorded in compliance with Art. 26. ### Data sovereignty and client-owned code *(No vendor lock-in).* Solutions owned 100% by the client, built on standard technologies, on private/on-premise infrastructure and controlled open-source models. By design, no data leaves towards the outside or towards third parties. ## Do you want to know where you are really exposed? A free analysis of your AI systems against the obligations of the AI Act. - [Let's talk about your project](/en/contacts) ## Our AI Auditing use case *We have already done it* Not theory. In our portfolio there is the Advanced Auditing Agentic AI Platform: a multi-tenant system designed to conduct complex audits, manage the knowledge base in a controlled way and mitigate hallucinations. In practice, all the knowledge stays federated and the AI cannot leave the boundaries of the designed domain. The harness is not just good engineering practice: it is a fundamental requirement. ## Questions about the EU AI Act *Clarifications* ### Who is a "deployer" under the AI Act? The natural or legal person who *uses* an AI system under their own authority in their professional activity (Art. 3(4)), distinct from the provider who develops it and from the distributor who makes it available. ### What changes on 2 August 2026? The transparency obligations, the governance framework, the penalty regime and the powers of the national authorities apply. The obligations for high-risk systems, instead, have been postponed by EU Regulation 2026/1744 (Digital Omnibus): 2 December 2027 for Annex III systems, 2 August 2028 for Annex I systems. The prohibitions have been active since February 2025; the obligations on GPAI models since August 2025. ### What penalties does a company risk? Three levels: up to €35M/7% of turnover for prohibited practices; €15M/3% for the violation of the other obligations; €7.5M/1% for incorrect information to the authorities. These limits should be checked and confirmed carefully, and we recommend involving a professional. ### Is the Italian regulation already in force? Law 132/2025 is (since 10 October 2025). The implementing decrees that would introduce the crime of failure to secure AI and 231 liability are still drafts under parliamentary review (checked September 2026), not yet law. ### Which official documents and institutional sources do you refer to? Transparency is one of our values: every legal statement in the text has been drawn from a source in the following list. However, **we encourage you to check directly** at the source for the correct interpretation, for any changes and updates, or for incorrect interpretations. The importance and understanding of these topics is vital, so for further details turn to professionals. - [Regulation (EU) 2024/1689, AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) (eur-lex.europa.eu) - [Regulation (EU) 2026/1744, Digital Omnibus](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744) (eur-lex.europa.eu) - [Law 23 September 2025, no. 132](https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg) (gazzettaufficiale.it, in Italian) - [Press release of the Council of Ministers no. 177 of 10 June 2026](https://www.governo.it/it/articolo/comunicato-stampa-del-consiglio-dei-ministri-n-177/32050) (governo.it, in Italian) - [European regulatory framework on AI, European Commission](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) (digital-strategy.ec.europa.eu) - [Digital strategy of the European Commission](https://digital-strategy.ec.europa.eu) (digital-strategy.ec.europa.eu) ## Disclaimer Informational and engineering content. The information reflects the regulatory status at the date of update (check the sources cited in the FAQ on this page for more details) and does not constitute legal advice. The content of this page, however many times it has been verified, may contain incorrect information or incorrect interpretations. For real assessments and/or on a specific case turn to a qualified professional, or call us and we will involve one together. ## AI Act compliance is built in the code. We map your AI systems against guardrails, observability, human oversight and data sovereignty, and hand back the priority gaps with respect to the obligations. No strings attached. - [Let's talk about your project](/en/contacts)