AI ACT: Not Just Compliance, but Digital Culture and Corporate Responsibility

The AI Act is already a reality (and yes: some deadlines have already passed)

The AI Act came into force in summer 2024, but in Italian companies it continues to be perceived as a distant, technical, almost abstract topic. The classic regulation “for others.” Meanwhile, however, the timeline has truly started running: from February 2, 2025, some key provisions became applicable, including prohibited practices and the obligation for AI literacy. It’s not “it will come”: it’s already at the stage where you should be able to demonstrate that you’ve taken the matter in hand.

And the point is this: most companies are not behind because they haven’t understood the law. They’re behind because they haven’t understood that AI is not a project, it’s an organizational behavior.

AI Act deadlines: what has already expired and what’s coming

If you want to read the AI Act as a compliance checklist, at least read it properly. The idea that “there’s plenty of time until 2026” is a half-truth that causes damage.

The first date that matters is February 2, 2025: it’s the line of demarcation between “we’ll talk about it” and “you should have already taken action.” At that point, the prohibitions on certain practices considered unacceptable come into play and, above all, the obligation for AI literacy. Translated into business language: it’s not enough to write a policy, you must be able to demonstrate that people understand what they’re using and with what limitations.

Then comes August 2, 2025, which many are underestimating: it’s the year when regulation on more “general purpose” AI models (those that power much generative AI) becomes more concrete on the governance and accountability front. It’s the phase when it becomes difficult to continue pretending that “it’s just a tool for writing better emails.”

The date everyone cites is August 2, 2026, because it marks the full application of many obligations, especially for high-risk systems. But if you arrive there without having first laid the foundations—inventory, training, minimal governance—it’s not a project, it’s a fire.

And finally there’s August 2, 2027, which concerns some AI systems integrated into regulated products. It’s not the priority for all companies, but it’s a reminder: this regulation is not a flash in the pan, it’s a new normal.

“We don’t use AI”: the most widespread organizational lie

The mantra I hear repeated is always the same: “we don’t use artificial intelligence.”
Too bad it’s often said by companies that use ATS that do automatic pre-screening, CRM that suggest commercial priorities, cybersecurity based on predictive models, collaborative platforms with integrated generative AI.

AI today is no longer a separate project: it’s a feature embedded in processes. And the AI Act knows this very well. That’s why it doesn’t only concern those who develop AI, but also those who use it. The deployer. That is, the company.

The elephant in the room: employees are already using AI

This is where many companies tell themselves a fairy tale to sleep soundly. Employees are already using AI, especially tools like ChatGPT. They do it to write, summarize, structure, clarify their ideas. They often do it in silence, because in the company the attitude is still one of judgment: “if you did it with AI then it’s worth less.”

And here we need a phrase that controllers don’t like: even if you ban it, they’ll continue to use it. Not because they’re dishonest, but because the pressure is high and time is short. The implicit request is: do more, better, faster. In this context, thinking that people will voluntarily give up a tool that can lighten the cognitive load is naive.

The risk is not that AI is being used. The risk is that it’s being used poorly, in secret and without criteria. And that’s where the issue truly becomes compliance… and also reputation… and also operational risk.

Banning AI is shortsighted. Governing it is organizational intelligence

Banning ChatGPT is not a strategy: it’s an elegant way to lose control. AI can (and must) be used to save time on low-value activities—drafts, summaries, reformulations, initial structuring—and free up energy for what matters: context, choice, responsibility, critical thinking.

The point is not whether to use AI. The point is how and for what. And this is applied digital culture, not ideology.

ChatGPT is not the cheat sheet under the desk

If we continue to portray AI as the hidden note during a class test, we’ll continue to have two effects: clandestine use and internal stigma. The right narrative is the opposite: working with AI, when you do it well, is a sign of organizational intelligence. It means knowing how to ask questions, evaluate answers, verify, decide what to keep and what to discard.

This is not cheating: it’s co-intelligence. And it’s a skill that increases productivity and work quality without burning people out.

AI literacy: the heart of the regulation (and the point where many companies are already exposed)

The AI Act puts in black and white something we tend to ignore in companies: AI literacy is not “nice to have.” It’s an obligation. And it’s not resolved with just-for-show e-learning. You need to build a minimum common level: what we’re using, where, with what data, with what limitations, and who answers when something goes wrong.

Here compliance meets culture: if people don’t understand, the company doesn’t govern. If it doesn’t govern, it’s at risk.

From the AI Act to ESG: AI governance is a signal of reliability

The connection with ESG is natural: AI governance is corporate governance. Traceability, accountability, risk management, transparency: it’s pure “G.” And when we talk about bias, discrimination and equitable access to work, we’re also touching on the “S.”

Companies that can explain how they use AI, why they use it and with what controls are sending a message to the market: “we know how to govern complexity.” The others are just hoping not to be the first to get into trouble.

Working with AI doesn’t reduce critical thinking. It trains it.

When AI is used well, it doesn’t replace thinking: it shifts it. Less time on repetitive execution, more time on understanding, choice, responsibility. AI becomes a sparring partner, not a substitute. And this is where productivity and critical thinking can grow together.

The AI Act doesn’t ask companies to become algorithm experts.
It asks for something much more uncomfortable: to become adults.

Adults in recognizing that artificial intelligence is already inside processes, inside decisions, inside people’s daily work. Adults in stopping pretending that banning is enough, or that ignoring protects. Adults in understanding that responsibility cannot be delegated to a supplier, to software, to a poorly written policy.

Governing AI doesn’t mean slowing down innovation. It means choosing where to use speed and where thinking is needed. It means freeing up time from low-value activities to invest it in judgment, context, responsibility.

Working with AI is not cheating. It’s knowing how to work in co-intelligence. And it’s a skill that distinguishes organizations that will undergo change from those that will lead it.

The AI Act is only the beginning. The real issue is whether companies are ready to face the way they work today.
Because artificial intelligence is not a technological problem.
It’s a matter of human choices.