As part of the workshop “The EU Artificial Intelligence Regulation – Governance and Operational Compliance”, organised by Paradigma, Alessandro Del Ninno held as a sole speaker a full-day training session examining the European and Italian regulatory frameworks governing Artificial Intelligence, the compliance obligations established by the AI Act, and the organisational and operational strategies required to manage the risks associated with the adoption of AI systems and models within business organisations.

The session explored the structure, scope and implementation timeline of Regulation (EU) 2024/1689, with particular emphasis on the amendments introduced by the Digital Omnibus, the European Commission’s guidance and the interaction between the AI Act and other relevant legal frameworks, including the GDPR, cybersecurity legislation, copyright law, employment law and Italian Law No. 132/2025 on Artificial Intelligence.

Particular attention was devoted to the distinction between AI systems, general-purpose AI (GPAI) models, generative AI applications and autonomous AI agents, as well as the identification of roles and responsibilities across the AI value chain. The programme examined the risk-based regulatory approach, prohibited AI practices, the classification of high-risk AI systems and the corresponding obligations concerning risk management, data governance, technical documentation, human oversight, transparency, cybersecurity and conformity assessment.

A specific focus concerned the obligations imposed on organisations deploying AI systems, fundamental rights impact assessments (FRIAs), their coordination with Data Protection Impact Assessments (DPIAs) under the GDPR, and the development of integrated compliance documentation. Further analysis addressed GPAI-related obligations, copyright protection, synthetic content, deepfakes and transparency requirements governing interactions with Artificial Intelligence systems.

The workshop also examined the development of corporate AI governance programmes, internal AI policies, AI use-case inventories, shadow AI management, AI literacy and training requirements, as well as procurement processes and contractual arrangements with technology providers. Additional topics included AI cybersecurity, incident management, coordination with NIS 2, DORA and the Cyber Resilience Act, regulatory sandboxes, enforcement mechanisms and contractual and civil liability arising from AI systems.

The workshop provided a comprehensive legal and operational overview of the AI Act, with the aim of equipping businesses, professionals and corporate functions with practical tools to translate regulatory requirements into effective governance arrangements, internal controls, documented procedures and compliance measures, supporting the lawful, responsible and sustainable adoption of Artificial Intelligence.