AI Act compliance in Odoo: classification, obblighi, governance (guida PMI italiane 2026)

Settantunesima guida operativa Odoo 19 per PMI italiane. L’AI Act EU (Regolamento 2024/1689) è il primo framework normativo al mondo per AI. Approccio risk-based: classifica AI systems in unacceptable/high/limited/minimal risk con obblighi proporzionati. Le PMI che usano AI (lead scoring, predictive maintenance, document classification — vedi guida #46) devono adeguarsi. Obblighi entry in vigore progressivi 2025-2027 con sanzioni fino a 35M € o 7% fatturato globale. In questa guida vediamo come prepararsi all’AI Act con Odoo 19.

Vediamo: cosa è AI Act, i 4 livelli di rischio, identificazione AI systems in PMI, obblighi per livello, timeline applicazione, ruolo di Odoo, casi pratici PMI italiane.

Cosa è AI Act EU

Framework approach

• Risk-based regulation
• Tecnologia-agnostic (AI definition broad)
• Lifecycle approach (design → deployment → monitoring)
• Extraterritorial application (anche non-EU se uso in EU)

Timeline applicazione

• Feb 2025: prohibitions on unacceptable risk + AI literacy
• Ago 2025: governance + general-purpose AI
• Ago 2026: high-risk AI systems compliance
• Ago 2027: high-risk AI in regulated products

Sanzioni

• Prohibited practices: 35M € o 7% fatturato globale
• Non-compliance high-risk: 15M € o 3%
• Wrong information: 7.5M € o 1.5%
• SME ottiene proporzionate

I 4 livelli di rischio

1. Unacceptable risk (proibito)

• Social scoring by governments
• Manipulative AI exploiting vulnerabilities
• Biometric categorization sensitive (race, religion)
• Untargeted face scraping
• Emotion recognition workplace/education
• Predictive policing on individuals

2. High-risk

• AI in safety-critical products (medical, transport)
• Biometric identification
• Critical infrastructure management
• HR (recruiting, performance, dismissal)
• Credit scoring
• Law enforcement specific use
• Education + worker management
• Migration + border control

3. Limited risk (transparency obligations)

• Chatbot — user must know talking to AI
• Deepfakes — must be labeled
• Emotion recognition (non-prohibited contexts)
• Biometric categorization (non-prohibited)

4. Minimal risk

• AI spam filter
• AI in video games
• Most business AI applications (lead scoring, recommendation)
• No specific obligations

AI in PMI Odoo: classification tipica

Use cases minimal risk

• Lead scoring CRM
• Demand forecasting
• Document classification
• Anomaly detection (fraud, quality)
• Chatbot Q&A interno

Use cases limited risk

• Customer-facing chatbot (transparency)
• AI generating content (label)

Use cases potentially high-risk

• AI in HR recruiting/promotion
• AI quality control safety-critical products
• AI credit scoring (financial services)
• AI medical device classification

AI in manufacturing: quality+process

L’AI applicata al processo produttivo (quality prediction, anomaly detection in MO) è generally minimal risk. Ma se il prodotto è safety-critical (medical, automotive safety), può diventare high-risk. Classification corretta è il primo step:

• AI system classification per use case
• Risk assessment formal
• Documentation modello + decisions
• Human oversight protocols
• Audit trail decisions AI
• Monitoring drift performance

AI-enabled products

Se vendi un prodotto con AI embedded (es. macchinario smart con AI), devi valutare classificazione AI Act + conformity assessment se high-risk. Il product record Odoo deve documentare AI components + compliance status:

• AI components disclosed
• Risk classification per product
• Technical documentation requirements
• Conformity assessment se high-risk
• CE marking AI-specific
• Post-market monitoring

BOM e AI components

Per prodotti che includono AI come componente (chip ML, sensori smart), la BOM è il punto centrale per tracking. Documenta provenance + AI capability + compliance status per ogni AI module:

• AI components identified in BOM
• Provider compliance status
• Model card + datasheet
• License + restrictions
• Update process tracking
• End-of-support dates

AI provider relationship

L’AI Act distingue tra “provider” (chi sviluppa AI) e “deployer” (chi usa). Le PMI sono di solito deployer ma anche con responsabilità. Il partner record AI provider in Odoo deve essere strutturato:

• Provider compliance status
• Contract AI-specific clauses
• Documentation provided
• Update notification process
• Incident reporting protocol
• Liability allocation chiara

AI-driven customer scoring

L’AI usato per customer scoring (credit, churn prediction, segmentation) può essere limited o high-risk a seconda del contesto. Sale order tracking + decisions AI documentate sono evidence necessari:

• AI decision tracking
• Customer transparency dove applicabile
• Right to explanation
• Human review option
• Bias monitoring
• Documentation methodology

Obblighi per high-risk AI system

Pre-market (prima di deployment)

• Risk management system
• Data governance + quality
• Technical documentation
• Logging + record-keeping
• Transparency + information user
• Human oversight
• Accuracy, robustness, cybersecurity

Conformity assessment

• Self-assessment (most cases)
• Third-party assessment (specific cases)
• CE marking + EU declaration
• Registration EU AI Database

Post-market

• Post-market monitoring
• Reporting serious incidents
• Corrective actions when needed
• Continuous compliance

Obblighi limited risk (transparency)

Per chatbot

• User informed talking to AI
• Right to human conversation if requested
• Limitations clearly communicated

Per AI-generated content

• Content labeled as AI-generated
• Deepfakes especially
• Watermarking tecnologie

Per emotion recognition

• User informed
• Consent where appropriate
• Particular categories disclosure

Governance AI per PMI

Inventory AI systems

• Lista tutti AI use cases attivi
• Classification per ognuno
• Owner business + technical
• Review periodica

AI ethics committee

• Cross-functional (legal, IT, business, HR)
• Review nuovi use cases
• Approval high-risk applications
• Incident review

AI literacy programma

• Training general per tutti dipendenti che usano AI
• Specialized per AI developers/deployers
• Refresh annuale
• Documentation participation

Vendor management AI

• Due diligence AI providers
• Compliance verification
• Contract clauses
• Monitoring ongoing

Costi setup AI Act compliance

Setup iniziale

• AI inventory + classification: 8-22k €
• Risk assessment: 12-30k €
• Documentation high-risk: 15-50k € per system
• Governance setup: 10-25k €
• AI literacy training: 5-15k €
• External consulting: 10-35k €
• Totale: 60-177k €

Ricorrente annuale

• Monitoring + audit: 12-30k €
• Documentation updates: 8-22k €
• Training ongoing: 5-15k €
• Incident management: 5-15k €
• Totale ricorrente: 30-82k €/anno

Errori comuni AI Act prep

“Pensare ‘minimal risk = nessun obbligo'”

Problema: anche minimal risk ha implicit obligations (AI literacy).
Soluzione: assessment formal anche per minimal risk, document.

“Inventory non completo”

Problema: shadow AI deployments unknown.
Soluzione: company-wide audit periodico, governance strict per new deployments.

“Classification sbagliata”

Problema: high-risk classified low.
Soluzione: legal review per classification, especially borderline cases.

“No human oversight”

Problema: AI deciding autonomously su critical.
Soluzione: human-in-the-loop mandatory per high-risk, options per limited.

“No incident response”

Problema: AI failure occorre, no process per gestire.
Soluzione: incident response plan dedicated AI, reporting authority.

Casi pratici PMI italiane

Caso 1 — Metalmeccanica: AI quality assessment

• AI quality vision system
• Classification: minimal risk (no safety-critical product)
• Documentation + monitoring
• Investimento: 35k €
• Outcome: full compliance entry 2026

Caso 2 — HR tech provider: high-risk

• AI recruiting tool
• Classification: high-risk
• Full compliance programme
• Investimento: 145k €
• Customer trust significant boost

Caso 3 — E-commerce: customer chatbot

• Customer-facing AI chatbot
• Classification: limited risk
• Transparency requirements implementation
• Investimento: 18k €
• NPS customer mantained

Caso 4 — Tessile: shadow AI

• Multiple AI tools used without governance
• Inventory revealed 12 AI systems
• 2 inadvertently high-risk
• Remediation: 95k € + 8 mesi delay
• Lesson learned: governance prima di deployment

FAQ

Devo essere PMI grande per AI Act?

No, applica a tutti. Differenza: large company more obligations + scrutiny. PMI ottiene supports (regulatory sandboxes, simplified procedures).

Quanto tempo per essere compliant?

Minimal risk: 1-3 mesi. Limited risk: 3-6 mesi. High-risk: 12-24 mesi. Continuous compliance: ongoing.

Posso usare ChatGPT/Claude liberamente?

General-purpose AI ha specific obligations per provider. Deployer (te) ha obligations basate su use case classification. Sensitive data e high-risk applications richiedono cautela + governance.

Cosa fare se AI vendor non è compliant?

Risk per deployer trasferito. Process: (1) engagement constructive; (2) corrective action plan; (3) alternative sourcing; (4) terminate if necessary. Documentation per evidence.

AI Act vs GDPR?

Diversi scope ma sovrapposizione. GDPR: personal data processing. AI Act: AI systems regardless of data. Some AI applications: both apply. Combined compliance approach raccomandato.

Prossimi passi

Nelle prossime guide vedremo come gestire Cyber Resilience Act (CRA) per prodotti con elementi digitali, come preparare per Forced Labour Regulation EU, e come integrare Data Act per data sharing requirements.

Vuoi preparare AI Act compliance Odoo nella tua PMI?
G Tech Group implementa programmi AI Act compliance per PMI italiane: AI inventory, classification, governance, documentation, training. Track record di PMI pronte before 2026 deadline.
Richiedi un preventivo gratuito oppure prova la nostra demo Odoo 19 live. Oppure prova Odoo direttamente su odoo.com (link partner Brentasoft).