Picture yourself as a wool merchant in late-thirteenth-century Florence. You have looms, apprentices and customers waiting for your cloth. Then one day someone asks you: “Have you read the guild statute?” The AI Act is a bit like that. Let's look together at what it really means for a small or medium-sized business, without panic and without shortcuts.
A Florentine workshop and its statute
In medieval Florence, nobody worked wool on their own: they belonged to the Arte della Lana, the wool guild, one of the city's great corporations. To practice the trade you had to be enrolled in the matricola, the register of members. The guild had its consuls, who settled disputes, and above all it had a written statute: rules on the quality of cloth, on inspections, on penalties for cheats. These statutes were not carved in stone: they were revised and updated over time as the trade changed.
You may ask: what does a wool merchant have to do with ChatGPT? Quite a lot, because those statutes did something very modern. They didn't ban working wool; they set out the conditions under which customers could trust what they bought. The more delicate the process, the stricter the checks. And the merchant who knew the statute slept soundly, while the one who ignored it lived in fear of the inspectors.
Well, your company today is sitting in that same workshop. The statute is called Regulation (EU) 2024/1689, better known as the AI Act.
The AI Act in two lines
The AI Act is the European regulation on artificial intelligence, published on EUR-Lex, which entered into force on August 1, 2024. As a regulation, it applies directly in every member state, with no need for national transposition.
Its core idea is the same as the guild statutes: rules proportionate to risk. The regulation sets out four levels:
- Prohibited practices: uses of AI considered unacceptable, such as social scoring or manipulative techniques that exploit people's vulnerabilities.
- High-risk systems: for example AI used to select staff, evaluate workers or decide on people's access to credit. Obligations here are demanding.
- Limited risk: systems that mainly require transparency, such as chatbots (people must know they're talking to a machine) and generated or manipulated content.
- Minimal risk: the vast majority of everyday uses, like spam filters, spell checkers and drafting assistants. No specific obligations.
The regulation also distinguishes between those who develop an AI system (the provider) and those who use it in their business (the deployer). Almost every SME falls into the second group: they use tools built by others.
The timeline: what already applies
The AI Act applies in stages. Here are the main ones set out in the text:
- February 2, 2025: the bans on unacceptable practices apply, along with the AI literacy requirement (Article 4): anyone using AI systems must ensure their staff have sufficient skills to use them knowingly.
- August 2, 2025: the rules for general-purpose AI models (those behind the big assistants), the governance structure and the penalty system apply.
- August 2, 2026: most remaining provisions apply, including the transparency obligations.
- August 2, 2027: the rules for high-risk AI built into already regulated products (machinery, medical devices and the like) apply.
An honest note: for the high-risk obligations, the European Union has launched a simplification process that may push some deadlines back, tied to the availability of technical standards. Before planning major investments, always check the up-to-date timeline on the European Commission website. The Professor loves history, but legal dates are checked at the source.
In Italy, Law 132/2025 on artificial intelligence has also been in force since October 10, 2025, complementing the European regulation with national principles and rules, for instance for the professions, healthcare and employment.
What really changes for an SME using AI
Let's take a concrete example. Imagine a 20-person company that uses an AI assistant to write emails and quotes, a chatbot on its website for customer questions and software that summarizes meeting minutes. What does it need to do?
1. Train its people. The literacy requirement already applies. You don't need a master's degree: you need everyone using AI to know what the tool does, where it gets things wrong, which data must not go into it and when a human check is required. Practical, documented training, tailored to each role.
2. Be transparent. If the website chatbot answers customers, people must understand they're dealing with an automated system. If you publish generated or manipulated images or text that could look authentic, in many cases you need to say so.
3. Make sure you don't stray into high risk. This is the point many underestimate. Using AI to write an email is minimal risk. Using it to screen résumés or assess employee performance is a high-risk use case. In that case, the deployer has specific duties: follow the provider's instructions, ensure competent human oversight, keep logs, inform workers.
4. Don't forget the GDPR. The AI Act doesn't replace the General Data Protection Regulation: it sits alongside it. If personal data about customers or employees goes into the tool, all the usual rules apply: legal basis, privacy notice, contracts with providers, security.
What about penalties?
AI Act penalties are significant: for prohibited practices they can reach €35 million or 7% of worldwide annual turnover. For SMEs, however, the regulation provides that the lower amount of the fixed sum and the percentage applies. The message isn't “be careful or go under”: it's “do things in an orderly way”. Just like the guild statute: those who worked well had nothing to fear from the consuls.
The most common mistakes
- Thinking the AI Act only concerns big tech. Providers carry the heaviest duties, but deployers have theirs too.
- Buying tools without taking stock. Many companies don't know how many AI tools their staff actually use, often through personal accounts.
- Using AI for decisions about people without realizing it. An automatic résumé filter “to save time” is exactly the kind of thing you shouldn't improvise.
- Training once and calling it done. Tools change every month: internal rules need updating too, just like medieval statutes.
How Penzai can help
Our work always starts from people and processes, not tools. In an AI strategy engagement we map your current uses, classify them by risk level and write simple internal rules with you. Through AI training we build the literacy the regulation requires, tailored to the roles in your company. If you want to choose tools wisely, read We don't automate everything. We automate what makes sense, or see our page for SMEs.
What to do on Monday morning
- Take stock. Ask each department which AI tools it uses, what for and with which data. A three-column table is enough.
- Look for high risk. Check whether any tool is involved in hiring, employee evaluation or decisions about customers. If so, stop and dig deeper before going further.
- Plan the training. Schedule a hands-on session for those who use AI daily and write down what you did: it's the first step toward the literacy required by Article 4.
Want to do it with someone who has done it before? Book a free intro call: in half an hour we'll work out together where your company stands on the AI Act.
The Professor at Penzai
