Italian AI Decree 179/2026 did not come as a surprise: it was entirely predictable that the operational layer of the European AI Act would be transposed into a national instrument with real teeth — inspection powers and concrete sanctions. What many did not anticipate is how deeply the decree touches the way a professional firm or SME already uses AI today, often informally and without any documentation.
At the same time, a parallel problem is making itself felt on the economic side: AI costs are among the most difficult line items to forecast in a business budget, and many organisations find themselves managing significant variances against plan, discovered only after the fact. Cutting those costs through optimisation techniques, however, can open new security vulnerabilities — a trade-off the legislator has not overlooked. In this article we examine what the decree actually requires, what risks professional firms and SMEs face, and the right sequence of actions to take immediately.
- Italian AI Decree 179/2026 introduces active supervision, inspection powers, and sanctions for anyone using AI systems without documenting roles and controls.
- Compliance is not merely formal: it requires reconstructing who decides what, who supervises, and how changes to systems are tracked.
- AI costs are structurally unpredictable: a significant share of companies cannot estimate them accurately, and cost-reduction techniques can open new attack surfaces.
- Human oversight is not a signature after the fact: it must be an active, documented check on the outputs produced by AI systems.
- Responsibility for decisions made with AI support remains with the professional or business owner — not with the software vendor.
- Preparing for an inspection means having an up-to-date register of systems in use, assigned roles, and audit logs — not just a written policy.
In this article
- What Italian AI Decree 179/2026 requires of professional firms and SMEs
- What sanctions do I face for using AI without documenting roles and controls?
- How to implement the human oversight of AI systems required by law
- The hidden costs of AI: why the cheapest model can end up costing more
- Who is liable for decisions made with AI in your firm?
- What to do right now to prepare for an AI inspection
- The Ovia view
- Frequently asked questions
What Italian AI Decree 179/2026 requires of professional firms and SMEs
Italian AI Decree 179/2026 transposes and integrates at national level the operational provisions of the European AI Act, with one substantial novelty compared to the previous framework: the introduction of effective inspection powers and a tiered sanctions system scaled to the severity of the breach. These are no longer theoretical obligations — they are rules an inspector can verify on the ground, requesting documentation, system logs, and evidence of human oversight.
For a professional firm — whether accountants, lawyers, or labour consultants — or for an SME that has already adopted AI tools, this means one concrete thing: every AI system in use must be identified, classified by risk level, and governed with clear roles. Anyone who introduced an AI assistant for email management, a document-analysis system, or a client chatbot without formalising anything now finds themselves in an exposed position.
As highlighted by Agenda Digitale in its analysis of the decree, preparing for inspections does not mean producing paperwork: it means reconstructing the chain of decisions and responsibilities around AI systems already in operation. That distinction is not semantic — it is the difference between passing an inspection and receiving a fine.
How to prepare badly
Formal approach onlyHow to prepare well
Substantive approachWhat sanctions do I face for using AI without documenting roles and controls?
The sanctions framework of Italian AI Decree 179/2026 is proportionate to the severity of the breach and the size of the organisation — but even for smaller entities the amounts at stake are not negligible. The heaviest fines target those who use high-risk AI systems without the required control measures, but failure to document roles or the absence of verifiable human oversight also constitute violations.
For a professional firm, the risk profile is compounded by the nature of the data handled: clients' tax, legal, and social-security data frequently fall within categories protected under the GDPR and now also under the AI Act. A violation that simultaneously touches both regulatory frameworks can stack sanctions on multiple fronts. The question of professional liability — who signs off on AI-assisted decisions — is examined in detail in our article on AI hallucinations and professional liability.
The practical rule is straightforward: if an AI system contributes to a decision that affects a client or a third party, there must be a documented record of human control over that decision. Without that record, in the event of an inspection or a challenge, liability falls entirely on the professional or the business owner.
- Using generic AI tools (ChatGPT, Copilot, etc.) for activities involving client data without a risk assessment and without a disclosure notice: this breaches both the GDPR and the provisions of Italian AI Decree 179/2026.
- Appointing an AI officer on paper only, without that person having a real operational role and the tools to exercise it: in the event of an inspection, a formal appointment alone is not sufficient to demonstrate effective oversight.
- Failing to track the versions of AI systems in use: if a vendor updates the model and the system's behaviour changes, without a version log it is impossible to demonstrate that controls were adequate at the time of use.
How to implement the human oversight of AI systems required by law
Human oversight is not a signature at the bottom of a document produced by AI. The decree — in line with the AI Act — requires active, informed, and documented control: whoever supervises must be able to understand what the system produced, why it produced it, and must be able to intervene or correct before the output takes effect.
In practice, this means at least three operational things. First: the supervisor must have access to raw outputs, not only to the final processed version. Second: the check must take place before use, not retrospectively. Third: the oversight must be recorded — even in a simple form, such as a log with the date, the name of the reviewer, and the outcome of the check.
For a small firm, this can seem burdensome. In reality, the greater difficulty is not the time it takes, but the lack of infrastructure: if the AI systems used in the firm do not produce readable logs, if decisions are not linked to the right clients, and if tool versions are not tracked, oversight becomes impossible to document — even if it does happen in practice. This is precisely the problem that a structured knowledge management system resolves at the root, linking every AI output to the right person, client, and date.
Take stock of AI systems in useStep 1
Draw up an inventory of all AI tools used in the firm or business, including 'informal' ones such as Word plug-ins or email assistants. For each one, record who uses it, for which activities, and on which categories of data.
Assign a responsible person for each systemStep 2
Not a single AI officer for everything, but a named individual for each critical system, with the explicit task of verifying outputs before use and flagging anomalies.
Define the review processStep 3
For each system, establish what must be checked, how often, and against what criteria. The check must be proportionate to the risk: the greater the consequences of an error, the more structured the process must be.
Record and retain the checksStep 4
Even a simple log sheet — date, responsible person, system, outcome — is better than nothing. The goal is to be able to demonstrate, in the event of an inspection, that oversight genuinely took place and was not merely on paper.
The hidden costs of AI: why the cheapest model can end up costing more
Alongside compliance, there is an economic problem that many firms and SMEs have yet to get to grips with: AI costs are structurally difficult to forecast. As reported by AI4Business, many organisations find themselves managing significant variances against their initial AI budget, often discovered only after the fact — a widespread problem affecting organisations of every size.
The main drivers of this gap are three: token and API costs that vary with request volume; the 'hidden' costs of integration, maintenance, and system updates; and the costs of correcting errors — which do not appear on vendor invoices but weigh on staff time. The temptation to solve the problem by choosing cheaper AI models or applying prompt-optimisation techniques is understandable, but it conceals a risk that Cybersecurity360 has examined in detail: certain LLM cost-reduction techniques increase the attack surface, making systems more vulnerable to manipulation and prompt injection.
For a professional firm handling confidential client data, this trade-off is unacceptable. The answer is not to spend more, but to decide upfront what to automate and why, define a budget with alert thresholds, and choose tools with predictable costs — not necessarily the cheapest or the most powerful.
Who is liable for decisions made with AI in your firm?
The question of liability is the one that firm owners and SME managers fear most — and Italian AI Decree 179/2026 answers it unambiguously: liability for AI-assisted decisions rests with whoever takes them — the professional or business owner — not with the software vendor or the model developer. This applies to a tax return processed with the support of an AI system, a legal opinion drafted with the aid of an assistant, or a credit-risk assessment.
What the decree changes is that this liability must be demonstrable. It is not enough to say 'the system got it wrong': you must prove that human oversight was structured, that the person supervising had the skills to evaluate the output, and that the process was documented. On this point, the question of AI literacy in businesses becomes central: the Italian decree, as Agenda Digitale notes, still leaves many businesses exposed on the mandatory training front — but this does not exempt them from the obligation to demonstrate competence in controlling the systems they use.
In practical terms: if nobody in your firm can explain how the AI system that supports client decisions works, how its outputs are generated, and what the model's limitations are, the sanctions risk is not only regulatory — it is professional. You can explore the topic of AI agent governance further in our article on AI agent control in businesses.
Is your firm ready to face an inspection?
- ✓You have a register of AI systems in useIncluding name, vendor, version, type of data processed, and assigned risk level.
- ✓Every system has a named responsible personWith written operational duties, not just a formal appointment.
- ✓A documented oversight process existsWith audit logs — even in simple form — demonstrating that checks took place before use.
- ✓AI costs are monitored with a dedicated budgetWith alert thresholds and periodic review, not just end-of-period reconciliation.
- ✕Staff who use AI have received specific trainingOn the nature of the tools, their limitations, and how to recognise incorrect outputs.
- ✕AI system versions are tracked over timeSo you can demonstrate which version was in use at the time of a specific decision.
What to do right now to prepare for an AI inspection
The practical question every firm owner or SME manager should be asking today is not 'are we compliant?' but 'if an inspector walked in tomorrow, what would we show them?'. Answering it requires concrete work on three levels: inventory, governance, and monitoring.
The inventory is the starting point: catalogue all AI systems in use, including those adopted informally by individual staff members, classify them by risk level, and check whether contracts with vendors include the clauses required by the decree (transparency, traceability, security updates). It is often the tools adopted autonomously by staff to save time — not the ones formally procured — that turn out to be the most exposed.
Governance concerns roles: who oversees what, by what process, and with what documentation. It is not necessary to build a complex system — but the system must exist and be operational, not merely written into a policy. Monitoring, finally, covers both costs and security: a budget with alert thresholds, periodic review of the versions of systems in use, and vigilance about optimisations that promise savings but introduce vulnerabilities. A structured document management system can be the starting point for tracking both AI output checks and system versions — two key requirements for any inspection.
Strategy comes before the tool — and before the inspection
Italian AI Decree 179/2026 makes visible a problem Ovia encounters every day with its clients: professional firms and SMEs that have adopted AI tools one at a time, often in response to an urgent need or commercial pressure, without ever pausing to ask what they are automating, how they are governing it, or how they are measuring it. The result is an approach to AI that works — until something goes wrong, whether normatively, economically, or from a security standpoint.
Ovia's approach starts from the opposite direction: first we define which process it makes sense to automate and what measurable success looks like, then we choose the tool. This is not methodological luxury: it is precisely what allows you to document oversight, control costs, and respond to an inspection without having to rebuild everything from scratch.
The systems Ovia designs for professional firms and SMEs are built with traceability and control integrated from the outset: every action is linked to the right client, every output is verifiable, every version is recorded. Not because it looks better that way — but because it is the only way to use AI safely, sustainably, and defensibly.
Frequently asked questions
What does Italian AI Decree 179/2026 require of businesses and professional firms?
Italian AI Decree 179/2026 introduces at national level the inspection powers and sanctions framework set out in the European AI Act. For professional firms and SMEs it means that every AI system in use must be classified by risk level, governed with clear roles, and documented with evidence of human oversight. These are not merely formal obligations: inspectors can request logs, registers, and operational proof.
What sanctions do I face for using AI without documenting roles and controls?
Sanctions are graded by severity and organisational size, but even for smaller entities they are not negligible. The greatest risk for professional firms is the overlap with the GDPR: an AI system that processes client data without adequate documentation can simultaneously breach both regulatory frameworks, stacking penalties on multiple fronts. Liability always falls on the professional or business owner, never on the software vendor.
How do I implement the human oversight of AI systems required by law?
The human oversight required by the decree is not a retrospective signature: it must be an active, informed, and documented check of AI outputs before they are used. In practice this means having access to raw outputs, carrying out the check before use, and recording it — even in a simple form, with the date, the responsible person, and the outcome. Without this documentation, in the event of an inspection it is impossible to demonstrate that oversight genuinely took place.
Who is liable for decisions made with AI in my firm?
Italian AI Decree 179/2026 is unambiguous on this point: liability for AI-assisted decisions rests with whoever takes them — the professional or business owner — not with the software vendor or the model developer. This liability must be demonstrable: you must prove that human oversight was structured, that the person supervising had the necessary skills, and that the process was documented.
Are AI costs really that unpredictable? How do I keep them under control?
Yes: many organisations find themselves managing significant variances against their planned AI budget, often discovered only after the fact. The hardest items to forecast are API volume fluctuations, maintenance and update costs, and the staff time spent correcting errors. The solution is not to choose the cheapest model — which can introduce security vulnerabilities — but to define a budget with alert thresholds, monitor it periodically, and choose tools with structurally predictable costs.
How do I keep track of the versions and changes of AI systems in use?
Every AI system in use should have a register recording the active version, the date of the last update, and the person responsible for the review. This is necessary because vendors update models frequently, and a change in a system's behaviour — even one not explicitly announced — can alter its risk profile. In the event of an inspection or a challenge, the version log is the proof that controls were adequate for the system in use at that specific moment.
What should I do right now to prepare for an AI inspection?
The three priority steps are: first, catalogue all AI systems in use in the firm or business, including those adopted informally by staff members; second, assign each system a named responsible person with written operational duties and a documented oversight process; third, verify that contracts with vendors include the transparency, traceability, and security-update clauses required by the decree. All of this must be operational — not just written into a policy.
Conclusion
Italian AI Decree 179/2026 does not change the rules of the game for those who had already built a structured approach to AI: it changes the situation for those who were using it informally, hoping nobody would ask any questions. For professional firms and SMEs, the era of ungoverned experimentation is over.
The good news is that preparing does not require large technology investments: it requires method. Catalogue the systems, assign roles, document the checks, monitor costs with alert thresholds. When done properly, these activities also improve day-to-day operations — not just your standing in front of an inspector.
The starting point, as always, is deciding what you want to automate and why — before choosing the tool. Whoever begins with that question has already done the hardest work.
Ovia systems for this topic
Tailor-made solutions that solve exactly the problem discussed in this article.
Ovia Second Brain
Links every AI output to the right client, date, and reviewer — automatically creating the decision traceability that Italian AI Decree 179/2026 requires you to demonstrate in the event of an inspection.
Discover Second BrainDocumentsOvia Documents
Tracks every version of documents processed with AI support, with a full history of submissions and checks: exactly the oversight log that inspectors can request.
Discover DocumentsControlOvia CRM
Structures the firm's workflows with deadlines, roles, and documented processes, making it visible and measurable who did what on every matter — including those handled with the support of AI systems.
Discover CRMSources
- Decreto AI 179/2026: come preparare l’impresa ai controlli — Agenda Digitale
- Alfabetizzazione IA: il decreto italiano lascia scoperte le imprese — Agenda Digitale
- Sicurezza degli LLM: quando ridurre i costi significa aumentare la superficie d’attacco — Cybersecurity360
- Costi AI imprevedibili: perché il modello più economico può costare di più — AI4Business
An article by the Ovia editorial team, written with the support of artificial intelligence tools from the sources cited, which remain the property of their respective authors. Translated from the Italian original. This information is for general guidance and does not constitute legal or tax advice. Corrections: oviaitalia@gmail.com.