AI governance and EU AI Act compliance for companies
I help companies build proportionate AI governance under the EU AI Act: knowing which AI tools you use, who uses them, with which data and under which rules. The AI Act applies in every EU member state, so the core of the work is the same whether your teams sit in Italy, Germany or Spain. As a reference model I use the ISO/IEC 42001 standard.
Ing. Vito Domenico Amodio
Engineer and Innovation Manager, I work with you directly
- UNI 11814 Innovation Manager · Apave no. 38-M
- Licensed engineer, Lecce no. 4603
- Listed by MISE as innovation manager in 2019
- Working with SMEs since 2014
If you operate in Italy, through a company, branch or plant, there is one more layer: Italian Law 132/2025 adds national duties, for example towards workers. I cover both.
I am based in Lecce, Italy. I work on site in Italy and remotely across Europe, in English.
When you need AI governance
Generative AI without rules
People use assistants such as ChatGPT, Copilot or Gemini, often with personal accounts, and nobody knows which data goes in.
Chatbots and generated content
You run a chatbot on your website or messaging channels, or publish text and images created with AI.
Potentially high-risk uses
You use, or plan to buy, AI software for recruitment, customer assessment or education, areas the AI Act may classify as high risk from 2 December 2027.
Group policies to roll out locally
Headquarters has an AI policy and your Italian or European sites need to turn it into practice, with training and records.
Client and tender requests
A large customer or a public tender asks how you manage artificial intelligence.
AI solutions for your clients
You develop or integrate them and need to know whether you are a provider or a deployer.
What I do
AI system inventory
Tools, vendors, users, data processed and purposes, including personal accounts used for work.
Classification under the AI Act
Your role, prohibited practices, Article 50 transparency duties, any high-risk uses.
Company AI usage policy
Approved tools, data that must not be uploaded, human review, error handling, responsibilities.
Risk and impact assessment
On people, data, service quality and reputation, with measures to reduce them.
AI literacy (Article 4)
Role-based training plan and a record of the activities.
Italian Law 132/2025 duties
For organisations operating in Italy: information to workers (Article 11) and, for professional firms, to clients (Article 13), to be validated with your lawyer.
Structure based on ISO/IEC 42001
Roles, objectives, controls and periodic review, integrated with quality, information security or innovation management systems if you have them.
AI vendor assessment
Questions to ask before signing, on data, security and compliance.
How I work
Listening about a week
With a call and a questionnaire I learn how you use AI today and who decides.
Diagnosis
I build the inventory through short interviews with departments and a check of the tools in use. For each system I record duties, risks and measures in a single register.
Plan and resources
We write the usage policy and appoint an internal AI lead.
Delivery and results
Role-based training, on site in Italy or online, with materials that stay with you. After a few months we check what works and update the register.
These are the four steps of the method I follow in every project.
The overall duration depends on the number of tools and people involved: I state it in the written proposal.
Why work with me
- Certified Innovation Manager (UNI 11814) since 2023, certificate no. 38-M issued by Apave Italia CPM: my job is to bring technology into a company with a method and to measure the results.
- Licensed engineer (Italy), registered with the Order of Engineers of the Province of Lecce, no. 4603, Section A, information sector: I understand how AI systems work, not only what the rules say.
- CIO of Moviweb S.r.l. since 2022: every day I follow the adoption of AI and automation in a digital company’s processes and in client projects.
- Trainer for over ten years with companies, Chambers of Commerce, higher technical institutes and Google Digital Training: I know how to make Article 4 training practical.
- Research and publications: author of a 2026 systematic review on deep learning in farming and of articles in Innovation Post and AI4Business.
What you get
AI system register
with AI Act classification.
Company AI usage policy
signed off by management.
Risk and impact assessment
with an action plan.
AI literacy plan
and training record.
Information notice templates
for workers and clients in Italy, to be validated with your lawyer.
Gap map against ISO/IEC 42001
useful if you later consider certification with an accredited body.
Shall we talk for half an hour?
Tell me where you are so I understand what you need. If I can help, I send you a written quote.
Legal framework
| Reference | What it covers | Applies from |
|---|---|---|
| Regulation (EU) 2024/1689 (AI Act), Articles 4 and 5 | AI literacy and prohibited practices | 2 February 2025 |
| AI Act, Article 50 | Transparency for chatbots, deepfakes and generated text on matters of public interest | 2 August 2026 |
| Regulation (EU) 2026/1744 | Postponement of high-risk obligations, new wording of Article 4 | In force since 27 July 2026 |
| AI Act, Annex III and Article 26 | Duties of deployers of high-risk systems | 2 December 2027 |
| Italian Law 132/2025, Articles 11 and 13 | Information to workers and to clients of professionals (Italy only) | 10 October 2025 |
| ISO/IEC 42001:2023 | AI management system, voluntary | Published December 2023 |
If you are still choosing where to use AI, start from artificial intelligence for SMEs. For courses, see training and workshops. My background is on the about page. A longer guide to the AI Act for SMEs is available in Italian.
Frequently asked questions
Can't find your question? Write to me and I will answer.
We only use ChatGPT or Copilot. Does the EU AI Act apply to us?
Yes, in a light form. If you use AI at work, you are a deployer: you must take AI literacy measures for the people who use it (Article 4) and meet the transparency duties of Article 50 when you publish generated content or run chatbots. In Italy, Law 132/2025 also asks you to inform workers. An inventory, a usage policy and role-based training cover most of the work.
What is ISO/IEC 42001 and why do you use it?
It is the international standard published in 2023 that sets the requirements for an artificial intelligence management system, with the same structure as ISO 9001. An annex lists 38 reference controls. I use it as a model to organise roles, risks and controls in an orderly way that fits the management systems you already have. Adopting it is voluntary.
Does alignment with ISO/IEC 42001 mean we comply with the AI Act?
No. ISO/IEC 42001 is not a harmonised standard under the AI Act and gives no presumption of conformity. It does give you a method to do, in an orderly way, much of what the regulation asks: inventory, roles, risk assessment, training, documentation. For providers of high-risk systems, CEN-CENELEC is preparing specific harmonised standards.
When do the high-risk obligations apply?
After Regulation (EU) 2026/1744, the obligations for the high-risk systems listed in Annex III, such as recruitment or credit scoring, apply from 2 December 2027. For systems built into products regulated under Annex I, the date is 2 August 2028. AI literacy and the prohibited practices have applied since 2 February 2025.
Do you replace our lawyer or DPO, and can you work with teams outside Italy?
I do not replace them. I cover the technical and organisational side: which systems you use, how they work, what risks they create, which rules and controls you need. Legal opinions, contracts and personal data stay with your lawyer and DPO, to whom I hand a clear technical picture. I work in English and remotely, so teams in other EU countries can take part.
Book an introductory call
Tell me which AI tools you use and who uses them. In a call I understand your request and then send you a written proposal, with what to do first and what can wait.
Tell me about your company and what you want to achieve. The call is for me to understand your request: if I can help, I prepare a written quote. or fill in the formBook a 30-minute introductory call