Imagine receiving a request for inspection from the national AI supervisory authority tomorrow morning. Do you have a list of the AI tools you use in your practice? Do you know what decisions they make, on what data, with what human oversight? If the answer is no, you are not merely behind on compliance — you are exposed to concrete operational risks that exist right now, before any inspection takes place.
The AI Act is not another EU directive to be handed off to your privacy consultant. For a professional firm or an Italian SME that uses ChatGPT to draft documents, AI agents to sort emails, or automated systems to manage clients, the regulation touches processes that are already running. The 2 August 2026 deadline for the full application of rules on high-risk AI systems is drawing closer, but the real issue is not meeting a deadline: it is understanding what changes in the way you make decisions, keep records, and oversee what your AI does every day.
This article addresses the practical questions every firm owner or SME manager should already be asking: what specific obligations the AI Act introduces, where it overlaps with the GDPR and NIS2, how to tell the difference between purely formal compliance and real AI governance, and what operational steps you can take right now — even with limited resources.
- The AI Act applies in full from 2 August 2026: transparency and documentation obligations also apply to professional firms and SMEs that use third-party AI systems.
- Using ChatGPT or other AI tools with client data is not neutral: it triggers GDPR obligations as data controller and may fall within the scope of the AI Act if the tool influences material decisions.
- Formal compliance (a signed policy, an updated DPA) does not replace real governance: you need to know what AI agents decide, how they are controlled, and how incidents are documented.
- GDPR, NIS2 and the AI Act share the same core: accountability, risk minimisation, and documentation. Tackling them together costs less and produces a more robust structure.
- The greatest risk for a firm without AI governance is not the fine: it is the silent error made by an agent that nobody has verified, causing harm to a client.
- Starting with a mapping of AI tools currently in use is the mandatory first step: you cannot govern what you do not know.
In this article
- What concretely changes for your firm from 2 August 2026
- Using ChatGPT with client data: what you are required to do
- How to tell whether your AI agents are making the wrong decisions
- GDPR, NIS2 and the AI Act together: where to start without getting lost
- AI governance in a small firm: it is achievable, if you are strategic
- The Ovia view
- Frequently asked questions
What concretely changes for your firm from 2 August 2026
EU Regulation 2024/1689, known as the AI Act, entered into force on 1 August 2024 with a phased rollout by category. From 2 August 2026, the rules on high-risk AI systems become fully applicable — that is, systems that influence decisions material to individuals: access to credit, employee appraisal, handling of legal or tax matters with effects on rights and obligations. For an accountancy practice, a law firm, or an employment consultant, this definition is not abstract: if you use an AI system to analyse a client's financial position, classify applications, or suggest regulatory pathways, you may already fall within its scope.
Even outside the high-risk category, the AI Act introduces horizontal transparency obligations: when an AI system interacts with natural persons (for example, a chatbot on your firm's website), it must declare that it is an automated system. If your firm uses generative AI models to produce documents, responses, or analyses, you will need to be able to demonstrate that human oversight exists over the content produced. These are not formalities: they are requirements that translate into internal processes that must be built or adapted.
As the ongoing debate among digital regulation experts highlights, the primary risk is not the AI Act moving faster than corporate governance: it is corporate governance failing to keep pace. For firms and SMEs that have no in-house legal team and no dedicated AI officer, the question becomes: where do I start, and what is truly a priority?
How it is done today
Formal complianceRecommended approach
Real governanceUsing ChatGPT with client data: what you are required to do
The question we receive most often is this: am I required to do anything if I use ChatGPT or other AI tools with my clients' data? The short answer is yes, on several levels. The first is the GDPR: when you feed personal data about clients into an AI tool (name, tax identification number, income position, legal information), you are the data controller and must verify that the provider offers adequate safeguards — in practice, a valid Data Processing Agreement and a documented legal basis for that processing.
The second level is professional secrecy. A solicitor or accountant who uploads confidential documents to a third-party cloud system must be certain that those data are not used to train models or made accessible to others. The terms of use of many general-purpose AI tools do not offer this guarantee by default: you need to check the settings, and in some cases choose dedicated solutions.
The third level is the AI Act itself: if the AI tool materially influences a decision affecting a client (for example, by suggesting a tax strategy or assessing the merits of an appeal), it falls within the logic of the regulation. As the analysis on AI governance in customer service makes clear, what matters is not the label the provider puts on its product but the function that system performs within your process. If it automates decisions with effects on rights and obligations, the transparency and oversight obligations apply to you, not only to the model developer. You may also find our article on Italian Law 132/2025 and client disclosure on AI use useful.
Minimum checklist for lawful use of AI tools with client data
- ✓DPA signed with the AI providerVerify that the data processing agreement is up to date and covers the specific use you make of the tool.
- ✓Documented legal basisIdentify which GDPR basis (contract, consent, legitimate interest) underpins your processing of data via AI.
- ✓Exclusion from model trainingConfirm that your inputs are not used to improve the provider's model.
- ✓Updated client privacy noticeClients must be informed whether and how AI is involved in the handling of their matters.
- ✕Register of AI tools in useMaintain an up-to-date list of all AI systems used in the firm, including the type of data processed and the internal owner.
- ✕Output supervision procedureDefine who reviews AI-generated content before it is used or sent to the client.
How to tell whether your AI agents are making the wrong decisions
AI agents — systems that do not merely answer a question but carry out sequences of actions autonomously (sorting emails, updating client records, generating document drafts, setting deadlines) — introduce a specific problem: they can fail silently. Unlike a human error, which often generates a flag or a reaction, an AI agent that misclassifies a case or enters incorrect data into a CRM can do so many times before anyone notices.
This issue is at the heart of specialist debate: as analyses focused on reducing AI agent errors in business explain, the critical point is not the quality of the model but the control structure built around it. An AI agent without oversight is like a new employee with no work-review process: even a capable one produces unmanaged risks.
In practice, for a professional firm or SME, controlling AI agents comes down to three operational questions: What did the agent do? (action log), What did it produce? (output verifiable before use), and Who approved it? (record of human oversight). Without documented answers to these three questions, you do not have governance: you have automation. You can explore the risks of silent errors further in our article on AI output control in professional firms.
Map the agent's actionsStep 1
List every action the agent carries out autonomously: what data it reads, what it modifies, what it sends. Without this list you cannot know what to monitor.
Define alert thresholdsStep 2
Establish which outputs require mandatory review before use (e.g. any draft sent to a client, any change to tax or legal data).
Assign a human supervisorStep 3
Every automated process must have a named person responsible for periodically reviewing outputs and reporting errors.
Keep an incident logStep 4
Every detected error must be documented: what happened, how it was discovered, what correction was applied. This log is the foundation of your governance and your defence in the event of an inspection.
GDPR, NIS2 and the AI Act together: where to start without getting lost
The overlap between the GDPR, NIS2 and the AI Act unsettles many firm owners. The good news is that these frameworks share a common core: accountability — the ability to demonstrate that you have made informed, documented decisions about how you manage data and digital systems. Those who already have a sound GDPR setup (an up-to-date processing register, DPAs with suppliers, documented security measures) already have most of the foundations in place.
As the comparative analysis of the three frameworks highlights, digital maturity is worth more than formal conformity: an organisation that has genuinely understood its data flows, knows who accesses what, and has incident-response processes adapts to new regulatory requirements with far less effort than one that starts from scratch each time. For professional firms and SMEs, this means the investment need not be made three times (once per law), but once — properly — building a structure that holds across multiple regulatory frameworks.
The practical starting point is always the same: the inventory. Before even working out which obligations apply, you need to know which AI tools you use, on which processes, with which data, and with what level of autonomy. Only from there can you assess risk, set priorities, and build the documentation you need — both for compliance and for day-to-day operational management.
Important note: For solicitors, accountants, and employment consultants, the risk is not only regulatory. If an AI agent produces an incorrect analysis that leads to a wrong decision for a client, and you cannot demonstrate that you oversaw the output, professional liability falls entirely on you. The AI Act does not create an exemption: it creates supervisory obligations that, if not met, worsen your position. AI governance is not a bureaucratic expense: it is a form of professional protection.
AI governance in a small firm: it is achievable, if you are strategic
AI governance does not require a dedicated team or an enterprise budget. It requires method: deciding what to automate with explicit criteria, defining who controls what, and documenting choices and outcomes. In a firm with a small number of staff, this translates into simple tools — an AI tools register in a shared spreadsheet, a review checklist for critical outputs, and an internal point of contact (even the owner) for incident management.
The distinction that matters is not between large and small organisations: it is between those who have made a conscious decision about how to use AI and those who use it out of habit or convenience without having considered the risks. A well-governed AI system in a three-person firm is safer — and more competitive — than a larger organisation running many unmapped AI tools with no verification process.
On the competitive front, well-documented AI governance becomes a tangible argument with clients: it demonstrates that their firm handles confidential data with rigour, that AI-assisted decisions are always overseen by a professional, and that a procedure exists in the event of an error. In a market where many firms are adopting AI in an improvised way, being the one that does it methodically is already a measurable differentiating advantage. Tools such as Ovia Second Brain and Ovia CRM are designed precisely to make this control structure practicable even in resource-constrained settings.
Minimum AI governance for a professional firm: are you ready?
- ✓AI tools inventoryYou have an up-to-date list of all AI systems in use, including data type and level of autonomy.
- ✓Risk classificationFor each tool you have assessed whether it falls within the AI Act high-risk category or a lower-risk category.
- ✓Named human supervisorEvery automated process has a person responsible for reviewing outputs.
- ✕Updated client noticeClients know whether and how AI is used in the handling of their matters.
- ✕AI incident logA documented procedure exists for recording and managing AI agent errors.
- ✕DPAs updated with all AI providersYou have reviewed and signed data processing agreements with every AI tool provider.
Ovia's perspective
When we work with a professional firm or SME on AI, the first thing we do is not install tools: it is map what already exists, what it produces, and who controls it. In most cases we find AI tools running on critical processes — email management, document drafting, archiving — with no named owner, no output logs, and no escalation procedure in the event of an error.
Our approach is what we call governance before automation: before adding an AI agent to any process, we define together with the client what problem it solves, how the result is measured, who verifies that it works, and how it is documented. This does not slow down AI adoption: it makes it sustainable. A governed system scales; an ungoverned one will sooner or later produce an incident.
The AI Act, the GDPR, and Italian Law 132/2025 are not obstacles: they are the framework within which to build automations that the firm's clients can see, understand, and trust. Ovia builds bespoke systems for Italian professional firms and SMEs that are simultaneously efficient, controllable, and documented — because strategy and security drive growth, and AI is the tool to achieve it.
Frequently asked questions
What concretely changes for my firm under the AI Act from 2 August 2026?
From 2 August 2026, the rules on high-risk AI systems apply in full. For a professional firm, this covers AI systems that influence decisions material to clients (tax analyses, legal assessments, handling of matters with effects on rights and obligations). Even outside the high-risk category, transparency obligations come into force: automated systems that interact with natural persons must declare this, and documented human oversight of outputs must exist.
Am I required to do anything if I use ChatGPT or other AI tools with clients?
Yes, on several levels. The GDPR requires you to verify that the provider offers adequate safeguards through a valid Data Processing Agreement. Professional secrecy requires you to ensure that data are not used to train the model. The AI Act adds transparency and oversight obligations if the tool influences material decisions. Using a well-known tool is not sufficient: you must document how you use it and what controls are in place.
What is the difference between formal compliance and real AI governance?
Formal compliance consists of signing documents (DPA, internal policy, privacy notice). Real governance means knowing which AI tools are in use, what they produce, who controls them, and how errors are managed. Formal compliance reduces paper-based legal risk; real governance reduces day-to-day operational risk. Ideally you do both, but the latter is what genuinely protects your firm.
How do I know whether my AI agents are making the wrong decisions?
AI agents can fail silently, repeating the same error many times before anyone notices. Detecting errors requires three things: a log of actions carried out by the agent, mandatory review thresholds for critical outputs, and a named human responsible for periodically checking results. Without these elements, you do not have governance: you have uncontrolled automation.
GDPR, NIS2 and the AI Act overlap — where do I start?
Start with the inventory: list all digital and AI tools in use, the data they process, and the level of autonomy they have. This document is useful for all three regulatory frameworks. Those who already have an up-to-date GDPR processing register have a solid foundation: it is a matter of extending it with AI-specific information. The operational priority is to map first, then classify risk, then build controls.
What risks does my firm face if I have no documented AI governance?
There are three risks. The first is operational: an AI agent that fails silently can cause harm to clients before you become aware of it. The second is professional liability: if you cannot demonstrate that you oversaw the AI output, responsibility for the error falls entirely on you. The third is regulatory: in the event of an inspection or complaint, the absence of documentation worsens your position under both the GDPR and the AI Act.
How do you build a reliable and controllable AI system in a small firm?
You do not need a dedicated team. You need three things: an inventory of AI tools in use and the data they process, a review checklist for critical outputs (who checks what before it reaches the client), and a simple log of errors detected and corrections applied. The starting point is always the mapping: you cannot govern what you do not know.
Conclusion
The AI Act is not a threat to Italian professional firms and SMEs: it is a mirror that reveals who has built sustainable AI systems and who has not. The date of 2 August 2026 is not far off, but the work to be done is not about paperwork: it is about real processes, daily decisions, and the ability to demonstrate — to an inspector, a client, or yourself — that the AI in your firm operates under control.
The path is clear: map the tools, classify the risk, assign oversight, document incidents. It is not complex, but it requires method. And method is precisely what distinguishes those who turn compliance into a competitive advantage from those who experience it as a burden.
If you want to understand where to start in your firm or SME, the first step is an analysis of the AI processes already in use. Ovia works with Italian professional firms and SMEs to build this structure — starting from strategy, not from tools.
Ovia systems for this topic
Tailor-made solutions that solve exactly the problem discussed in this article.
Ovia Second Brain
Ovia Second Brain captures decisions, notes, and procedures linked to each client and makes them retrievable with a single question: it is the foundation for documenting AI-supervised choices and demonstrating that real governance exists, not just automation.
Discover Second BrainControlOvia CRM
Ovia CRM tracks deadlines, activities, and workflows for every client with verifiable logs: precisely the control structure the AI Act requires for automated processes that affect cases and decisions.
Discover CRMDocumentsOvia Documents
Ovia Documents manages document collection and control with a full history of every submission and reminder: a tool designed for firms that must demonstrate human oversight at every stage of the process, even where it is partially automated.
Discover DocumentsSources
- AI Act: dalla compliance alla governance dell’AI nel Customer service — Agenda Digitale
- Agenti AI in azienda: come ridurre gli errori nelle decisioni — Agenda Digitale
- GDPR, NIS2, AI Act: la maturità digitale vale più della conformità formale — Agenda Digitale
- GenAI Security Gap: l’AI Act corre più veloce della governance aziendale — Cybersecurity360
An article by the Ovia editorial team, written with the support of artificial intelligence tools from the sources cited, which remain the property of their respective authors. Translated from the Italian original. This information is for general guidance and does not constitute legal or tax advice. Corrections: oviaitalia@gmail.com.