Artificial intelligence policy

Enrico Giubertoni works on artificial intelligence applied to marketing, and he also uses it to produce his own work. This page explains how, citing the relevant legal provisions, because a client is entitled to know this before signing and because Italian law requires the disclosure.

Regulation (EU) 2024/1689, the Artificial Intelligence Act (AI Act), assigns roles to the operators on the market. Enrico Giubertoni is a deployer: under Article 3, point (4), a deployer is «a natural or legal person […] using an AI system under its authority», except for personal non-professional use. He uses tools developed by others in his professional work.

He is not a provider, which under Article 3, point (3), is the person who develops a system, or has it developed, and places it on the market under its own name or trademark, whether for payment or free of charge. The distinction has practical consequences: if he were to deliver to a client an automated assistant under his own brand, he would become the provider of that system, with different obligations, and this page would state it.

The ideas, the structure and the decisions of a project are his. Artificial intelligence accelerates work that remains his own, and every document delivered is reviewed by him line by line. This is also the rule laid down in Article 13(1) of Legge 23 settembre 2025, n. 132 (Law No 132 of 23 September 2025), the Italian law on artificial intelligence: in the intellectual professions, the use of these systems «is intended solely for the exercise of instrumental activities and of support to the professional activity, with the prevalence of the intellectual work that is the object of the service» (unofficial translation).

Article 13(2) of the same law requires that «the information relating to the artificial intelligence systems used by the professional shall be communicated to the recipient of the intellectual service in clear, simple and comprehensive language» (unofficial translation), and the law gives the relationship of trust as the reason. In practice:

• at the start of an engagement the client receives the list of the artificial intelligence tools that will be used, and for which part of the work;
• the materials delivered indicate where artificial intelligence had a substantial role, for example in the analysis of a body of texts or in the first draft of a document that was then rewritten;
• if a tool is replaced during the project, the client is informed in advance.

A client’s confidential data, documents and figures are excluded from public artificial intelligence services. Where a project requires client data to be processed with these tools, the tool, the conditions of data processing and the retention period are agreed in writing. Where personal data is involved, the agreement is the one provided for in Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), which requires processing «only on documented instructions from the controller» and prohibits engaging another processor without the controller’s written authorisation.

The technical measures, namely where files are stored, who has access and how they are deleted, are those of Article 32 of the same Regulation. In services that permit it, the use of submitted content for model training is disabled.

No assessment of people, no selection and no measure concerning a person results from an automated calculation. Article 22 GDPR gives every data subject «the right not to be subject to a decision based solely on automated processing», and in a project the final decision is always taken by a human being and attributable to a named person.

Article 5 of the AI Act lists the prohibited practices: subliminal or deceptive techniques that distort behaviour; exploitation of vulnerabilities due to age, disability or economic situation; social scoring; assessment of the risk that a person will commit a criminal offence based solely on profiling; untargeted scraping of facial images from the internet or from video surveillance; biometric categorisation that infers beliefs or orientation; real-time remote biometric identification in publicly accessible spaces. None of these is part of his work.

One of them is stated in full, because it is the only one a consultant and trainer may actually encounter: point (f) prohibits systems that infer the emotions of natural persons in the workplace and in education institutions, except for medical or safety reasons. Training programmes use no tool that measures the attention, engagement or mood of participants.

Any data produced by a language model is verified against its source before it enters a document. Figures, quotations and legal references carry their source, and where the source is missing the sentence is removed. This page applies the same method: the texts of the European regulation and of the Italian law were downloaded and read article by article, and the passages in quotation marks are taken from those texts.

Article 50 of the AI Act, applicable from 2 August 2026, places the obligation to mark generated content on the provider of the system, and places two separate obligations on the deployer. The first concerns images, audio and video that constitute a deep fake: if such material were produced for a client, this would be disclosed. The second concerns «text which is published with the purpose of informing the public on matters of public interest», and the same Article excludes the obligation where the content «has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication».

On this site editorial responsibility is declared and named: it lies with Enrico Giubertoni. Every article is reviewed by him, and data, sources and links are checked before publication.

Article 25 of Law No 132/2025 amended the Italian copyright law, Legge 22 aprile 1941, n. 633 (Law No 633 of 22 April 1941), which now protects works of «human» creativity, including those «created with the aid of artificial intelligence tools, provided that they are the result of the author’s intellectual work» (unofficial translation). The outputs of an engagement fall within that definition, and the right of use the client receives is the one described in the code of conduct.

This page claims no certified compliance with the AI Act, because for a professional who uses artificial intelligence tools such certification does not exist: the Regulation provides for conformity assessment and marking only for high-risk systems, and places them on the provider. A further point deserves attention: Article 19 of Decreto legislativo 9 settembre 2026, n. 160 (Legislative Decree No 160 of 9 September 2026) states that compliance with the Regulation, «even if certified», «does not in itself exclude liability» (unofficial translation). A certificate cannot replace a working method, and this page describes the method.

The framework has changed recently, and the dates in circulation are often the earlier ones. The following dates were verified against the official texts on 21 September 2026:

• Regulation (EU) 2024/1689, the Artificial Intelligence Act: in force since 1 August 2024 and generally applicable from 2 August 2026. The prohibited practices and AI literacy apply from 2 February 2025, the rules on general-purpose AI models and on governance from 2 August 2025.
• Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, in force since 27 July 2026: it rewrote Article 4 on AI literacy, added two prohibitions to Article 5 applicable from 2 December 2026, and postponed the dates for high-risk systems to 2 December 2027 for those listed in Annex III and to 2 August 2028 for those covered by Annex I.
• Law No 132 of 23 September 2025, the Italian law on artificial intelligence, in force since 10 October 2025: Article 3(5) states that it creates no obligations additional to those of the European regulation, and Article 13 lays down the obligation concerning the intellectual professions.
• Legislative Decree No 160 of 9 September 2026, in force since 30 September 2026: among other provisions, it introduces into civil proceedings a presumption of a causal link where damage results from a breach of the obligations laid down in the Regulation.
• In Italy, under Article 20 of Law No 132/2025, the Agenzia per l’Italia digitale (AgID, Agency for Digital Italy) is the notifying authority and the Agenzia per la cybersicurezza nazionale (ACN, National Cybersecurity Agency) is the market surveillance authority.

This page bears the date of the latest verification against the official texts. The Italian implementing measures are not yet complete, so the page will be updated whenever the law changes. Anyone who finds an incorrect reference is invited to report it to the email address in the footer of the site: on a page like this one, a correction is worth more than a compliment.

Verified on 21 September 2026 against the texts published on EUR-Lex, Normattiva and the Gazzetta Ufficiale (Official Journal of the Italian Republic).