The EU Regulation 2024/1689 on Artificial Intelligence — commonly known as EU AI Act — represents the first binding global regulatory framework dedicated to artificial intelligence systems. For the Italian PMIs that employ AI workflows In the publishing, marketing, customer service, or process automation fields, the deadline for August 2, 2026 it is not an abstract date: it is the moment when most of the operational provisions become fully applicable, with sanctions that can reach 15 milioni di euro o il 3% del fatturato globale annuo.
The analysis of the legal text highlights an approach risk-basedNot all AI systems fall under the same obligations. However, incorrect risk classification - often due to a superficial reading of the technical annexes - is one of the main failure points encountered during the initial stages of company self-assessment. This guide provides a structured operational checklist for addressing compliance methodically, with a particular focus on AI workflows typical of Italian SMEs in the digital marketing and content production sector.
Understanding deadlines is the first step. But real compliance requires an accurate inventory of systems in use, documented risk mapping, and the establishment of internal governance procedures. Below is a technical roadmap to be prepared by August 2026—without last-minute improvisation.
The EU AI Act Deadline Calendar: What Changes in August 2026
The Regulation entered into force on August 1, 2024, but its application has been structured in progressive phases. The official timeline includes:
- February 2, 2025Absolute ban on AI systems unacceptable risk (Social scoring, subliminal manipulation, real-time facial recognition in public spaces for general use).
- August 2, 2025Application of regulations on GPAI models (General Purpose AI), including transparency obligations for providers of models like GPT-4, Claude, or Gemini.
- August 2, 2026Full application for AI systems High risk (Annex III) and transparency obligations for AI systems with limited risk. This is the critical deadline for most SMEs.
- August 2, 2027Residual application for specific categories of high-risk AI systems already covered by pre-existing product regulations.
The August 2026 deadline concretely concerns those who use or distribute AI systems that interact with end-users, generate automated content for commercial purposes, or support decisions impacting natural persons. content generation workflow Integrated into a WordPress site, for example, it could fall under transparency obligations if the content produced is not clearly identified as AI-generated.
Risk Classification: Where Typical SME AI Workflows Fit
The EU AI Act adopts four risk levels. For SMEs in the digital marketing sector, correct mapping is crucial for calibrating compliance efforts:
Unacceptable Risk (Forbidden)
Systems that Italian SMEs find it difficult to use directly fall into this category: behavioral manipulation, real-time biometric profiling, social scoring. No company can use them, regardless of size.
High Risk (Annex III)
Systems that affect critical areas such as work, education, justice, and infrastructure. Some AI-powered HR tools (screening CV, performance evaluation) fall under this category. For SMEs that only use AI for content marketing, this category is generally excluded – but it needs to be verified on a case-by-case basis.
Limited Risk (Transparency Obligations)
This is the category most relevant for those who produce AI content. Chatbots, text generation systems, synthetic images, and deepfakes fall under this category. The main obligation is End-user disclosure: the content must be identifiable as AI-generated. From August 2, 2026, failure to disclose this information will constitute a regulatory violation.
Minimal Risk
The majority of AI tools (spam filters, product recommendations, automated SEO optimization without impacting individual decisions) fall into this category. No specific obligations beyond general best practices.
Operational Checklist for Compliance August 2026
Below is the structured checklist for Italian SMEs using AI workflows. It is recommended to complete each phase by May 2026 to ensure sufficient operational buffer.
Phase 1: AI Systems Inventory (By January 2026)
- Inventory all AI tools in use: text generators, AI images, chatbots, recommendation systems, WordPress plugins with AI functionalities.
- For each, document: vendor, version, specific function, input/output data processed.
- Identify if the system is developed internally, purchased from a third party, or accessible via API.
- Annotate whether the systems process personal data under GDPR (dual regulatory obligation).
Phase 2: Risk Classification (By February 2026)
- Apply the risk-based framework of Annex III to each inventoried system.
- Documenting classification reasoning: the conclusion alone is not enough, the argumentative path is needed.
- For GPAI systems (Claude, GPT-4, Gemini) used via API: verify that the provider has fulfilled its obligations. The deployer's responsibility remains distinct from the provider's.
- Consult the guidelines of the’National Agency for Artificial Intelligence (ANIAI) for the Italian interpretation of the regulatory text.
Phase 3: Impact Assessment and Technical Documentation (By March 2026)
- For high-risk systems: draft the Technical Documentation provided for in Annex IV (system description, training data, accuracy and robustness measures, human supervision).
- For limited-risk systems: implement disclosure mechanisms at points of contact with end-users.
- Document the measures of human oversightWho can stop or correct the AI system's output? What is the procedure?
- Record impact assessments in a internal registration with date, responsible person, and review frequency.
Phase 4: Transparency Measures for AI Content (By April 2026)
For SMEs that produce content with tools like WordPress AI Client Connector or Content Generation Plugin, transparency towards the public is the most immediate obligation:
- Implement a explicit disclosure on articles, social posts, and AI-generated materials“Content produced with the support of artificial intelligence systems”).
- For synthetic video or image content: apply visible watermarks or compliant technical metadata (C2PA standard recommended by the EU Commission).
- Update the Privacy Policy and i Terms of Service with explicit reference to the use of AI.
- For chatbots and virtual assistants: ensure that the user is informed they are interacting with an AI system before the conversation begins.
Phase 5: Internal Governance and Training (By May 2026)
- Name a Internal AI Manager (also part-time or job-sharing with the DPO role for smaller SMEs).
- Define company policies on acceptable AI system use: which tools, for what purposes, with what limitations.
- Provide basic training to employees interacting with AI systems: the EU AI Act requires AI literacy suitable for the role.
- Establish incident response procedures: what to do in case of AI system malfunction or harmful output.
Phase 6: Pre-Expiration Verification and Audit (June-July 2026)
- Conduct an internal audit of all documentation produced in the previous phases.
- Verify the consistency between the implemented measures and the declared risk classifications.
- For high-risk systems: assess the need for a Conformity assessment by a notified body.
- Archive all documentation in an accessible manner for at least 10 years (required for high-risk systems).
Specific Obligations for AI Content Workflows: What SMEs Must Do Concretely
Use of AI for editorial content production — blog articles, social posts, newsletters, product descriptions — falls into the category of limited risk but it is not exempt from obligations. An analysis of Recital 132 of the Regulation shows that systems that generates synthetic text, audio, video, or images perceivable by humans they must ensure the detectability of the artificial origin.
In practice, for those who use tools like AI Publisher WP or equivalent systems to automate editorial production, this translates to:
- Mandatory labeling AI content across all publishing channels (blog, social, email).
- No obligation to disclose if AI content has undergone substantial human review that significantly alters the original text — but this exemption must be documented.
- Machine-readable metadata for AI-generated multimedia content, in line with the emerging standards of the Content Authenticity Initiative (CAI).
It's worth noting that correctly identifying AI-generated content is not just a regulatory obligation; it also serves as a quality signal in search engines' editorial evaluation. As analyzed in detail in the article dedicated to Google March 2026 Core Update and the distinction between templated AI and AI-assisted with original data, transparency in the use of AI tends to be rewarded rather than penalized by current algorithms.
Sanctions: A Concrete Framework for SMEs
The EU AI Act's sanctioning system is proportional to the severity of the violation and provides for:
- Up to 35 million euros or 7% of global turnoverThe use of AI systems at unacceptable risk is prohibited.
- Fino a 15 milioni di euro o 3% del fatturato globaleviolation of obligations for high-risk systems or GPAI.
- Fino a 7,5 milioni di euro o 1% del fatturato globaleProviding false information to authorities.
For Italian SMEs, the principle of proportionality applies: percentage thresholds tend to prevail over absolute maximums when the company's turnover is limited. However, even 1% of turnover for an SME with 2 million euros in annual revenue corresponds to 20,000 euros—a far from negligible amount for a documentation omission.
The supervisory authority designated for Italy will be identified within the framework of national implementation. It is expected that the main role will fall to the’National Cybersecurity Agency (ACN) in coordination with the Privacy Guarantor for GDPR intersections.
EU AI Act and GDPR: The Dual Regulatory System
For many AI workflows, the EU AI Act does not operate in isolation: it overlaps with GDPR obligations for systems processing personal data. The most critical intersection points for SMEs concern:
- Lawful basis for AI trainingIf the company has developed proprietary models on customer data, the legal basis under GDPR must be verified.
- Data Protection Impact Assessment + AI Impact Assessment: when a high-risk AI system processes personal data, the two impact assessments must be conducted in a coordinated manner.
- Right to explanationAutomated individual decisions based on AI remain subject to Article 22 GDPR, with additional transparency obligations compared to the EU AI Act.
Those who have already structured an AI-driven content marketing workflow should consider this compliance phase as an opportunity to consolidate their data governance practices. Agentic management of AI processes in small teams requires proportionate but not negligible governance: even a solopreneur using three different AI APIs must document their choices.
Tools and Resources for Self-Assessment
The European Commission has released support tools accessible to SMEs:
- EU AI Act Compliance Checker (available on the digital-strategy.ec.europa.eu portal): guided questionnaire for risk classification.
- AI Pact Signatories NetworkVoluntary initiative for businesses committed to early compliance. Offers access to document templates and communities of practice.
- National Agency for Artificial Intelligence: you are developing specific interpretative guidelines for the Italian context, with a focus on SMEs.
- Standard CEN/CENELEC JTC 21Harmonised European technical standards supporting demonstration of conformity for high-risk systems.
For those managing AI workflows integrated into WordPress environments, it's also useful to map responsibilities with AI model providers (OpenAI, Anthropic, Google): their Terms of Service now include specific clauses on compliant use with the EU AI Act that overlap with - but do not replace - the deployer's obligations. As documented in the analysis on’Evolution of AI agents and skill marketplaces, the chain of responsibility in agentic workflows is more complex than that of simple SaaS tools.
Conclusion: Compliance as a Competitive Advantage
The adjustment to’EU AI Act by August 2026 it should not be interpreted exclusively as a regulatory burden. For Italian SMEs that produce content with AI, structured compliance offers a measurable competitive advantage: increased trust from end-users, a stronger position compared to competitors who will adopt a reactive, last-minute approach, and a documentary basis that also simplifies future regulatory developments.
The operational checklist presented in this article — inventory, classification, documentation, transparency, governance, audit — is designed to be tackled incrementally in the months leading up to the deadline. It is recommended to start with Phase 1 (inventory) by January 2026, assign an internal responsible person, and proceed on a monthly basis. The alternative — waiting until summer 2026 for a rushed adjustment — exposes the company to both sanction risk and inevitable operational inefficiencies.
For those building a long-term AI-driven content marketing strategy, regulatory compliance and content quality are two axes of the same plane: both require methodology, documentation, and continuous review. Those who invest today in transparent and governed AI processes will be better positioned to address the regulatory changes that will follow 2026.
FAQ
Do Italian SMEs that use AI only to generate blog posts need to comply with the EU AI Act?
Yes, but the obligations are limited. Text generation systems fall into the category limited risk, which primarily entails transparency obligations: the public must be informed that the content was produced with AI. External conformity assessments or extensive technical documentation are not required as they are for high-risk systems. The disclosure obligation applies from August 2, 2026.
What is concretely meant by “disclosure” of AI content according to the EU AI Act?
The regulation requires that recipients of the content be clearly informed that the text, image, or video was generated by an artificial intelligence system. There is not yet a standardized mandatory format: a footnote is acceptable.“This content was produced with the support of AI systems”), a visible tag, or technical metadata for multimedia content. The important thing is that the information is accessible before or during the use of the content, not hidden in the legal notes.
What are the penalties for an SME that does not comply with transparency obligations for AI content?
For violation of transparency obligations (limited risk), penalties go up to 7.5 million euros or 1.5%% of annual global turnover, applying the lower of the two values. For Italian SMEs with typical revenues between 500,000 and 5 million euros, the percentage threshold is generally lower than the absolute one. National authorities may apply proportionate measures, but the principle of deterrence remains central to the regulatory design.
Does a WordPress plugin like AI Publisher WP make the user responsible for the EU AI Act obligations?
Yes. Who deploy an AI system — or whoever uses it in a professional context to produce output intended for third parties — takes on the qualification of deployer pursuant to the EU AI Act and inherits its compliance obligations. The plugin provider has distinct obligations, primarily related to the system's technical documentation. The deployer's responsibility is not transferred to the provider: both are independently responsible for their own obligations.
Does the EU AI Act compliance overlap with GDPR, or are they two separate requirements?
They are distinct but related obligations. For AI workflows that process personal data (e.g., content personalization systems based on user profiles), both regulations apply in parallel. The GDPR governs data processing; the EU AI Act governs the system processing it. For high-risk systems processing personal data, a Data Protection Impact Assessment (DPIA) coordinated with the AI impact assessment. The Personal Data Protection Authority retains its own competencies over AI systems that process personal data.
