From the AI Act sanctions For two years, there's been talk of a single figure: 35 million euros. It's true, but it's the tip of the pyramid, and it's not the one that concerns you.
Starting August 2, 2026, national authorities can challenge violations and impose fines. Before that date, the regulation existed, but there was no enforcement authority. Now, there is.
The three levels, in order of severity
Article 99 of EU Regulation 2024/1689 classifies sanctions into three levels:
| What did you violate? | Maximum ceiling |
|---|---|
| Prohibited AI practices (Article 5) | 35 million or the 7% of global turnover |
| Other obligations, including transparency (Article 50) | 15 million or the 3% |
| Inaccurate or misleading information to authorities | 7.5 million or the’1% |
The first step involves things that almost no SME does: emotion recognition in the workplace, social scoring, biometric categorization. The second, however, concerns everyone: it's the one where those who generate content with AI and don't disclose it end up, or those who have a chatbot communicate with customers without disclosing it's a machine.
The line that changes everything for small businesses
The headlines always read "up to 35 million o 7% of turnover, if higher." That "if higher" applies to large companies.
For SMEs and start-ups the regulation reverses the criterion: it applies the minor Between the fixed amount and the percentage. On a turnover of €400,000, the 3% would be €12,000, not €15 million. The regulation also requires authorities to take into account proportionality and the interests of small businesses when setting the amount.
It's not a free-for-all: it's the difference between a fine that shuts down a company and one that simply does harm. But it removes the excuse of "that stuff is for multinationals anyway.".
Who controls in Italy?
Supervision is not the responsibility of a single entity. In Italy, the role of market surveillance authority is entrusted to the’National Cybersecurity Agency, while they remain competent in their respective fields Guarantor for the protection of personal data, the Bank of Italy, the Consob and the’Ivass.
Above them, the European Commission acts directly on general-purpose models through the AI Office: it can request information, evaluate the models, impose corrective measures, and impose fines.
Translated for online sellers: if you use an AI system in your customer relations, disputes can come from multiple sources, and the most likely one isn't from Europe. It's from those who are already monitoring you for other reasons.
What to do this week
Three concrete things, in order.
- Write down the list of systems you use. Website chatbots, product description generators, email writing tools, and assistants that respond to messages. If you don't know what you're using, you can't declare it.
- Control where you talk to a customer through a machine. That's where the obligation to disclose it comes in, and it's the easiest violation to contest because it's visible to anyone who visits your site.
- Keep track of who proofreads. Human review of published texts is not just editorial common sense: it impacts labeling requirements.
The real risk for a small business isn't a record-breaking fine. It's arriving at an audit without knowing which tools you use and who authorized them. That list costs an hour.
If you want to understand which of your tools fall under the obligations, write to me: I always start with a list of what you actually use.
Sources
- Regulation (EU) 2024/1689 (AI Act), Article 99: Sanctioning regime and criteria applicable to SMEs and start-ups
- Il Sole 24 Ore, AI Act, supervision and transparency duties debut on August 2nd, July 2026
- Cybersecurity360, AI Act 2026: A guide to bans, penalties, and new compliance deadlines
- Altalex, AI Act: What's really changing for businesses and professionals starting August 2, 2026?, July 31, 2026
The responsibilities of national authorities are currently being operationally defined: before formal compliance, they will verify the status of implementing measures.