EU AI Act consulting in Italy — based in Lombardy

Services

• AI Act gap analysis

  What the Regulation asks of the organisation in the role it actually holds — provider or deployer — against what already exists. The output is a prioritised list of gaps, not a filled-in questionnaire.

• AI inventory and risk classification

  Every AI system in use or being procured, including those embedded in third-party software, classified under the AI Act: prohibited practices, high risk, transparency obligations, minimal risk.

• Technical documentation and quality management

  Technical documentation, logs and the quality management system required of high-risk providers (Article 17), with EN 18286 as a reference where adopting it is worthwhile.

• Human oversight and AI literacy

  Who can stop or correct an output and how that is shown (Article 14); AI literacy measures for staff who use the systems (Article 4), proportionate to their role.

• GDPR, Model 231 and risk assessment

  One AI system touches several controls in Italy: data protection, the Legislative Decree 231/2001 compliance model, the workplace risk assessment (DVR). Each control is written once and documented against each regime.

• On-premise and sovereign AI platforms

  When data cannot leave the perimeter, the same practice designs and runs the infrastructure — identity, approvals and an audit of every model call — on Nexus MDS Core or on the client’s own stack.

Beyond the AI Act: Italian AI law

Italy adds national rules on top of the Regulation. Law 132/2025 supplements the AI Act with principles for healthcare, employment and the professions. Legislative Decree 179/2026 requires AI-assisted decisions about staff to be taken by a natural person with effective authority and explained to the worker (Article 41), and brings AI into the workplace risk assessment under Legislative Decree 81/2008 (Article 42). Legislative Decree 160/2026 adds a new predicate offence to Legislative Decree 231/2001, so corporate compliance models need revisiting.

What this means in practice is set out under Italian AI law compliance.

Sectors

• Healthcare and pharmacy

  Documentary assistants, clinical software, health data. AI Act for healthcare and pharmacy.

• Logistics and manufacturing

  Shift planning, task allocation, AI in products and production lines. AI Act for logistics and manufacturing.

• Other regulated services

  Finance, insurance, energy, professional services. AI governance and compliance advisory.

Method

1. Assessment

   Inventory of systems, the organisation’s role for each, the regimes that apply and the deadlines already passed.

2. Plan

   Gaps ranked by urgency, with owners and effort estimates; what is already due is kept apart from what is scheduled.

3. Implementation

   Procedures, roles and technical controls: human oversight, logging, access management, supplier checks.

4. Demonstrable evidence

   Records that hold up in an inspection or a dispute: who decided, on what basis, with which system and which version.

5. Monitoring

   Periodic review whenever a system, a supplier or the law changes. The underlying method is the Compliance-Epistemic Project Framework (CEPF).

Most engagements start with the fixed-scope exposure assessment. The methodology is described under CEPF, and the software that implements it under Calibra.

Who runs the engagement

Engagements are led by Corrado Patierno, founder of Dynamics Consulting: more than 25 years of enterprise systems architecture in regulated and business-critical environments, board member of ENTD from 2020 to 2025, author of Logistica Fluida. Regulatory analysis and engineering sit in the same practice, so whoever writes the requirement can also build to it.

In production: the regulatory assistant for Federfarma Lombarda, used by more than 1,000 pharmacies across the provinces of Milan, Lodi and Monza Brianza. Full profile · Corrado Patierno on LinkedIn.

Where we work

Based in Lombardy, Italy: registered office in Milan, operating office in Comazzo (LO). On-site meetings across Lombardy; remote work with clients throughout Italy and the EU. Engagements run in English or Italian.

Frequently asked questions

Does the AI Act apply to a small company?

Yes, if it uses or supplies AI systems: Regulation (EU) 2024/1689 does not exempt SMEs. Obligations follow from the company’s role (provider or deployer) and from the risk class of each system, not from its size. For an SME using off-the-shelf tools the usual work is an inventory, AI literacy for staff (Article 4), transparency towards people who interact with the AI, and supplier checks.

What does Italy add to the AI Act?

Law 132/2025 supplements the Regulation with sector principles and names the national authorities. Legislative Decree 179/2026 sets rules on AI-assisted decisions about staff (Article 41) and on AI in the workplace risk assessment (Article 42). Legislative Decree 160/2026 adds a new predicate offence under Legislative Decree 231/2001.

What is EN 18286 and is it mandatory?

It is the European standard for the quality management system that Article 17 of the AI Act requires of high-risk providers. It is voluntary: applying it gives a presumption of conformity for the requirements it covers, but it does not remove liability and does not cover the other obligations.

Is using ChatGPT at work compliant?

There is no yes-or-no answer; it depends on what data goes in and what the output is used for. The questions are the legal basis and supplier contracts under the GDPR, AI literacy for the people using it (Article 4 of the AI Act), an internal policy on permitted data and uses, and — in Italy — Article 41 of Legislative Decree 179/2026 if the output feeds decisions about staff.

Do you provide legal advice or certification?

No. The work is technical and organisational, and the deliverables are written for the organisation’s lawyers to use. No consultant can certify conformity: it is established by the assessment the law provides for.

Do you work outside Italy?

Yes, remotely, for organisations elsewhere in the EU — particularly those with Italian operations, where the Italian rules apply alongside the AI Act.