What the AI Act and Italy’s AI law mean for businesses using chatbots

If your business uses a chatbot on its website, a customer service assistant or AI to write copy and create images, you are almost certainly in the lower-risk tiers of the EU’s AI Act. The obligations that apply to you are few and concrete. Since February 2025, a handful of practices have been banned and businesses must help staff understand the tools they use. From 2 August 2026, people talking to an AI must be told so, and realistic fake content has to be disclosed.

Italy’s national AI law adds rules on professionals, employment and copyright, and the GDPR applies as before. I’m a developer, not a lawyer, so this is a general overview as of October 2026 and not legal advice. For your specific situation, talk to a legal professional.

The AI Act sorts uses by level of risk

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages. It doesn’t treat all AI alike, because what matters is what a system is used for. A short list of uses is considered unacceptable and banned outright.

High-risk systems are those that affect important rights, such as hiring, credit scoring, access to essential services and education. The obligations here are heavy, but the Digital Omnibus on AI (Regulation (EU) 2026/1744, published in July 2026) has pushed them back to 2 December 2027. For AI built into already-regulated products, such as machinery or medical devices, the date is 2 August 2028.

Then come the transparency obligations. For chatbots, assistants and generated content, you have to say an AI is involved. Everything else, such as summarising emails, drafting, translating or writing product descriptions, carries no specific obligations.

The law also distinguishes roles. The provider develops a system and places it on the market under its own name, while the deployer uses it in a professional capacity. A small business using ChatGPT, Gemini or an off-the-shelf chatbot is nearly always a deployer. The obligations on large general-purpose models, in force since August 2025, fall on the companies that build them.

Bans and staff training have applied since 2025

Since 2 February 2025, the AI Act has banned, among other things, systems that manipulate people through subliminal or deceptive techniques and cause significant harm. The same goes for systems that exploit vulnerabilities linked to age, disability or economic situation, and for “social scoring”.

It also bans systems that recognise the emotions of employees at work or students in education, except for medical or safety reasons. Untargeted scraping of faces from the internet for facial recognition is banned too. From 2 December 2026, systems that generate non-consensual intimate images or child sexual abuse material are banned as well.

February 2025 also brought in the AI literacy obligation (Article 4), which the Digital Omnibus softened. Providers and deployers must take measures to support their staff’s AI literacy, but they don’t have to guarantee a specific level for each person. According to the European Commission, no certificate is needed and no “AI officer” has to be appointed.

In practice, the people using these tools should know what they do, where they go wrong (for example, confident answers that are simply made up) and what data must never go in. Short, documented training that fits how your team uses AI is a good place to start.

From 2 August 2026, people must know they’re talking to an AI

The transparency obligations in Article 50 apply from 2 August 2026 and have not been postponed. The only extension concerns the technical marking of generated content, a job for the companies that make the tools. For systems already on the market before that date, the deadline is 2 December 2026.

The chatbot on your website and your customer service

Anyone writing to your chatbot must understand clearly, from the first message, that there’s an AI on the other end. The “it’s obvious” exception only applies when it really is obvious to anyone. The same goes for a voice assistant that answers your phone.

Designing it this way is the provider’s duty, but if you have a chatbot built for you and put it into service under your own name, the provider may well be you. Either way it’s your website, so check that the notice is there and clear.

If you use tools that infer emotions from customers’ voices or faces, you have to tell them. With employees, it’s banned in most cases.

A clear notice at the start of the chat costs little and protects trust, because anyone who finds out afterwards they were talking to a machine feels misled.

Marketing content

Not everything you make with AI needs a label. The obligation covers deepfakes, meaning realistic images, audio or video that resemble real people, places, objects or events and could pass as authentic. They must be visibly disclosed at first exposure. For clearly artistic, satirical or fictional work, a disclosure that doesn’t spoil the piece is enough.

If an image could never be mistaken for the real thing, such as a stylised illustration, it isn’t a deepfake in the legal sense. The EU has published common icons for labelling deepfakes.

For text, a label is only required when you publish it to inform the public on matters of public interest, with no human review and nobody taking editorial responsibility. A blog post or newsletter that you review and sign off normally doesn’t need one. Content created before 2 August 2026 doesn’t have to be labelled retroactively.

Anyone who breaches these obligations faces fines of up to 15 million euros or 3% of worldwide annual turnover, and for SMEs whichever is lower applies.

What Italy’s AI law adds

Law no. 132 of 23 September 2025, in force since 10 October 2025, doesn’t rewrite the AI Act. It adds a few national rules, and these are the ones closest to what a business does.

• Lawyers, accountants, engineers, architects and other intellectual professionals may use AI only for instrumental and support tasks, with their own intellectual work prevailing. They must also tell clients about the AI systems they use, in clear, simple and complete language.
• Employers must inform workers when they use AI in the cases covered by the rules on automated decision-making and monitoring systems. From 23 October 2026, Legislative Decree 179/2026 adds that final decisions on hiring, dismissal, disciplinary measures and performance reviews cannot rest solely on automated processing. A person has to decide.
• Works created with the help of AI are protected only if they result from the author’s own intellectual work, so text or images generated without real human input may not be protected.
• Spreading AI-falsified images, videos or voices of a person without their consent, causing them unjust harm, is a criminal offence (Article 612-quater of the Italian Criminal Code).

Italy’s AI authorities are AgID (the Agency for Digital Italy) and the National Cybersecurity Agency (ACN), which handles market surveillance, while the data protection authority keeps its powers. Implementing decrees 160/2026 and 179/2026, issued in September and October, set out powers and penalties.

The GDPR still applies

The AI Act doesn’t replace data protection rules. If an employee pastes a customer’s email or a document with personal data into an AI tool, that data is processed by an outside supplier. That calls for a contract appointing the supplier as a data processor and clarity on where the data goes and for how long. You also need safeguards if the data leaves the European Economic Area, and an up-to-date privacy notice written in clear, simple language, as Italian law also requires.

Questions to ask whoever supplies your chatbot or AI tool

These are the questions to put to a supplier before you choose.

• Who is the provider and who is the deployer under the AI Act?
• How is the user told they’re talking to an AI, and at what point in the conversation?
• Where is the data processed and stored, for how long, and is it used to train models?
• Is there a data processing agreement, and does the data leave the European Economic Area?
• Are generated images, video and audio marked so they can be recognised as AI-made?
• When the chatbot can’t answer, does it hand over to a person?

Vague answers tell you something too. With AI agents these questions matter even more, because the AI doesn’t just reply, it acts.

How I can help

When I build AI into a website, a management system or an app, we settle these choices at the start. That covers the notice in the chat, the handover to a person, the data that goes into the tool and the supplier. To see how these rules affect your business, get in touch. I handle the technical side, while for contracts and legal assessments you should bring in your lawyer or data protection officer.