{"id":3653,"date":"2026-08-17T09:00:00","date_gmt":"2026-08-17T07:00:00","guid":{"rendered":"https:\/\/brentasoft.com\/blog\/ai-act-compliance-odoo-19-pmi-italiane\/"},"modified":"2026-06-10T11:24:51","modified_gmt":"2026-06-10T09:24:51","slug":"ai-act-compliance-odoo-19-pmi-italiane","status":"publish","type":"post","link":"https:\/\/brentasoft.com\/blog\/ai-act-compliance-odoo-19-pmi-italiane\/","title":{"rendered":"AI Act compliance in Odoo: classification, obblighi, governance (guida PMI italiane 2026)"},"content":{"rendered":"<p><em>Settantunesima guida operativa Odoo 19 per PMI italiane. L&#8217;AI Act EU (Regolamento 2024\/1689) \u00e8 il primo framework normativo al mondo per AI. Approccio risk-based: classifica AI systems in unacceptable\/high\/limited\/minimal risk con obblighi proporzionati. Le PMI che usano AI (lead scoring, predictive maintenance, document classification \u2014 vedi guida #46) devono adeguarsi. Obblighi entry in vigore progressivi 2025-2027 con sanzioni fino a 35M \u20ac o 7% fatturato globale. In questa guida vediamo come prepararsi all&#8217;AI Act con Odoo 19.<\/em><\/p>\n<p>Vediamo: cosa \u00e8 AI Act, i 4 livelli di rischio, identificazione AI systems in PMI, obblighi per livello, timeline applicazione, ruolo di Odoo, casi pratici PMI italiane.<\/p>\n<h2>Cosa \u00e8 AI Act EU<\/h2>\n<h3>Framework approach<\/h3>\n<ul>\n<li>Risk-based regulation<\/li>\n<li>Tecnologia-agnostic (AI definition broad)<\/li>\n<li>Lifecycle approach (design \u2192 deployment \u2192 monitoring)<\/li>\n<li>Extraterritorial application (anche non-EU se uso in EU)<\/li>\n<\/ul>\n<h3>Timeline applicazione<\/h3>\n<ul>\n<li><strong>Feb 2025<\/strong>: prohibitions on unacceptable risk + AI literacy<\/li>\n<li><strong>Ago 2025<\/strong>: governance + general-purpose AI<\/li>\n<li><strong>Ago 2026<\/strong>: high-risk AI systems compliance<\/li>\n<li><strong>Ago 2027<\/strong>: high-risk AI in regulated products<\/li>\n<\/ul>\n<h3>Sanzioni<\/h3>\n<ul>\n<li>Prohibited practices: 35M \u20ac o 7% fatturato globale<\/li>\n<li>Non-compliance high-risk: 15M \u20ac o 3%<\/li>\n<li>Wrong information: 7.5M \u20ac o 1.5%<\/li>\n<li>SME ottiene proporzionate<\/li>\n<\/ul>\n<h2>I 4 livelli di rischio<\/h2>\n<h3>1. Unacceptable risk (proibito)<\/h3>\n<ul>\n<li>Social scoring by governments<\/li>\n<li>Manipulative AI exploiting vulnerabilities<\/li>\n<li>Biometric categorization sensitive (race, religion)<\/li>\n<li>Untargeted face scraping<\/li>\n<li>Emotion recognition workplace\/education<\/li>\n<li>Predictive policing on individuals<\/li>\n<\/ul>\n<h3>2. High-risk<\/h3>\n<ul>\n<li>AI in safety-critical products (medical, transport)<\/li>\n<li>Biometric identification<\/li>\n<li>Critical infrastructure management<\/li>\n<li>HR (recruiting, performance, dismissal)<\/li>\n<li>Credit scoring<\/li>\n<li>Law enforcement specific use<\/li>\n<li>Education + worker management<\/li>\n<li>Migration + border control<\/li>\n<\/ul>\n<h3>3. Limited risk (transparency obligations)<\/h3>\n<ul>\n<li>Chatbot \u2014 user must know talking to AI<\/li>\n<li>Deepfakes \u2014 must be labeled<\/li>\n<li>Emotion recognition (non-prohibited contexts)<\/li>\n<li>Biometric categorization (non-prohibited)<\/li>\n<\/ul>\n<h3>4. Minimal risk<\/h3>\n<ul>\n<li>AI spam filter<\/li>\n<li>AI in video games<\/li>\n<li>Most business AI applications (lead scoring, recommendation)<\/li>\n<li>No specific obligations<\/li>\n<\/ul>\n<h2>AI in PMI Odoo: classification tipica<\/h2>\n<h3>Use cases minimal risk<\/h3>\n<ul>\n<li>Lead scoring CRM<\/li>\n<li>Demand forecasting<\/li>\n<li>Document classification<\/li>\n<li>Anomaly detection (fraud, quality)<\/li>\n<li>Chatbot Q&amp;A interno<\/li>\n<\/ul>\n<h3>Use cases limited risk<\/h3>\n<ul>\n<li>Customer-facing chatbot (transparency)<\/li>\n<li>AI generating content (label)<\/li>\n<\/ul>\n<h3>Use cases potentially high-risk<\/h3>\n<ul>\n<li>AI in HR recruiting\/promotion<\/li>\n<li>AI quality control safety-critical products<\/li>\n<li>AI credit scoring (financial services)<\/li>\n<li>AI medical device classification<\/li>\n<\/ul>\n<h2>AI in manufacturing: quality+process<\/h2>\n<p>L&#8217;AI applicata al processo produttivo (quality prediction, anomaly detection in MO) \u00e8 generally minimal risk. Ma se il prodotto \u00e8 safety-critical (medical, automotive safety), pu\u00f2 diventare high-risk. Classification corretta \u00e8 il primo step:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-01-mo.png\" alt=\"AI in Manufacturing Order Odoo 19 AI Act compliance PMI italiane\" class=\"aligncenter size-full wp-image-3648\"\/><\/p>\n<ul>\n<li>AI system classification per use case<\/li>\n<li>Risk assessment formal<\/li>\n<li>Documentation modello + decisions<\/li>\n<li>Human oversight protocols<\/li>\n<li>Audit trail decisions AI<\/li>\n<li>Monitoring drift performance<\/li>\n<\/ul>\n<h2>AI-enabled products<\/h2>\n<p>Se vendi un prodotto con AI embedded (es. macchinario smart con AI), devi valutare classificazione AI Act + conformity assessment se high-risk. Il product record Odoo deve documentare AI components + compliance status:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-02-product.png\" alt=\"AI-enabled product compliance AI Act Odoo 19 PMI manifattura\" class=\"aligncenter size-full wp-image-3649\"\/><\/p>\n<ul>\n<li>AI components disclosed<\/li>\n<li>Risk classification per product<\/li>\n<li>Technical documentation requirements<\/li>\n<li>Conformity assessment se high-risk<\/li>\n<li>CE marking AI-specific<\/li>\n<li>Post-market monitoring<\/li>\n<\/ul>\n<h2>BOM e AI components<\/h2>\n<p>Per prodotti che includono AI come componente (chip ML, sensori smart), la BOM \u00e8 il punto centrale per tracking. Documenta provenance + AI capability + compliance status per ogni AI module:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-03-bom.png\" alt=\"BOM AI components AI Act compliance Odoo 19 PMI manifattura\" class=\"aligncenter size-full wp-image-3650\"\/><\/p>\n<ul>\n<li>AI components identified in BOM<\/li>\n<li>Provider compliance status<\/li>\n<li>Model card + datasheet<\/li>\n<li>License + restrictions<\/li>\n<li>Update process tracking<\/li>\n<li>End-of-support dates<\/li>\n<\/ul>\n<h2>AI provider relationship<\/h2>\n<p>L&#8217;AI Act distingue tra &#8220;provider&#8221; (chi sviluppa AI) e &#8220;deployer&#8221; (chi usa). Le PMI sono di solito deployer ma anche con responsabilit\u00e0. Il partner record AI provider in Odoo deve essere strutturato:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-04-partner.png\" alt=\"AI provider partner relationship AI Act Odoo 19 PMI italiane\" class=\"aligncenter size-full wp-image-3651\"\/><\/p>\n<ul>\n<li>Provider compliance status<\/li>\n<li>Contract AI-specific clauses<\/li>\n<li>Documentation provided<\/li>\n<li>Update notification process<\/li>\n<li>Incident reporting protocol<\/li>\n<li>Liability allocation chiara<\/li>\n<\/ul>\n<h2>AI-driven customer scoring<\/h2>\n<p>L&#8217;AI usato per customer scoring (credit, churn prediction, segmentation) pu\u00f2 essere limited o high-risk a seconda del contesto. Sale order tracking + decisions AI documentate sono evidence necessari:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-05-sale.png\" alt=\"AI customer scoring sale order AI Act Odoo 19 PMI italiane\" class=\"aligncenter size-full wp-image-3652\"\/><\/p>\n<ul>\n<li>AI decision tracking<\/li>\n<li>Customer transparency dove applicabile<\/li>\n<li>Right to explanation<\/li>\n<li>Human review option<\/li>\n<li>Bias monitoring<\/li>\n<li>Documentation methodology<\/li>\n<\/ul>\n<h2>Obblighi per high-risk AI system<\/h2>\n<h3>Pre-market (prima di deployment)<\/h3>\n<ul>\n<li>Risk management system<\/li>\n<li>Data governance + quality<\/li>\n<li>Technical documentation<\/li>\n<li>Logging + record-keeping<\/li>\n<li>Transparency + information user<\/li>\n<li>Human oversight<\/li>\n<li>Accuracy, robustness, cybersecurity<\/li>\n<\/ul>\n<h3>Conformity assessment<\/h3>\n<ul>\n<li>Self-assessment (most cases)<\/li>\n<li>Third-party assessment (specific cases)<\/li>\n<li>CE marking + EU declaration<\/li>\n<li>Registration EU AI Database<\/li>\n<\/ul>\n<h3>Post-market<\/h3>\n<ul>\n<li>Post-market monitoring<\/li>\n<li>Reporting serious incidents<\/li>\n<li>Corrective actions when needed<\/li>\n<li>Continuous compliance<\/li>\n<\/ul>\n<h2>Obblighi limited risk (transparency)<\/h2>\n<h3>Per chatbot<\/h3>\n<ul>\n<li>User informed talking to AI<\/li>\n<li>Right to human conversation if requested<\/li>\n<li>Limitations clearly communicated<\/li>\n<\/ul>\n<h3>Per AI-generated content<\/h3>\n<ul>\n<li>Content labeled as AI-generated<\/li>\n<li>Deepfakes especially<\/li>\n<li>Watermarking tecnologie<\/li>\n<\/ul>\n<h3>Per emotion recognition<\/h3>\n<ul>\n<li>User informed<\/li>\n<li>Consent where appropriate<\/li>\n<li>Particular categories disclosure<\/li>\n<\/ul>\n<h2>Governance AI per PMI<\/h2>\n<h3>Inventory AI systems<\/h3>\n<ul>\n<li>Lista tutti AI use cases attivi<\/li>\n<li>Classification per ognuno<\/li>\n<li>Owner business + technical<\/li>\n<li>Review periodica<\/li>\n<\/ul>\n<h3>AI ethics committee<\/h3>\n<ul>\n<li>Cross-functional (legal, IT, business, HR)<\/li>\n<li>Review nuovi use cases<\/li>\n<li>Approval high-risk applications<\/li>\n<li>Incident review<\/li>\n<\/ul>\n<h3>AI literacy programma<\/h3>\n<ul>\n<li>Training general per tutti dipendenti che usano AI<\/li>\n<li>Specialized per AI developers\/deployers<\/li>\n<li>Refresh annuale<\/li>\n<li>Documentation participation<\/li>\n<\/ul>\n<h3>Vendor management AI<\/h3>\n<ul>\n<li>Due diligence AI providers<\/li>\n<li>Compliance verification<\/li>\n<li>Contract clauses<\/li>\n<li>Monitoring ongoing<\/li>\n<\/ul>\n<h2>Costi setup AI Act compliance<\/h2>\n<h3>Setup iniziale<\/h3>\n<ul>\n<li>AI inventory + classification: 8-22k \u20ac<\/li>\n<li>Risk assessment: 12-30k \u20ac<\/li>\n<li>Documentation high-risk: 15-50k \u20ac per system<\/li>\n<li>Governance setup: 10-25k \u20ac<\/li>\n<li>AI literacy training: 5-15k \u20ac<\/li>\n<li>External consulting: 10-35k \u20ac<\/li>\n<li><strong>Totale: 60-177k \u20ac<\/strong><\/li>\n<\/ul>\n<h3>Ricorrente annuale<\/h3>\n<ul>\n<li>Monitoring + audit: 12-30k \u20ac<\/li>\n<li>Documentation updates: 8-22k \u20ac<\/li>\n<li>Training ongoing: 5-15k \u20ac<\/li>\n<li>Incident management: 5-15k \u20ac<\/li>\n<li><strong>Totale ricorrente: 30-82k \u20ac\/anno<\/strong><\/li>\n<\/ul>\n<h2>Errori comuni AI Act prep<\/h2>\n<h3>&#8220;Pensare &#8216;minimal risk = nessun obbligo'&#8221;<\/h3>\n<p><strong>Problema<\/strong>: anche minimal risk ha implicit obligations (AI literacy).<br \/>\n<strong>Soluzione<\/strong>: assessment formal anche per minimal risk, document.<\/p>\n<h3>&#8220;Inventory non completo&#8221;<\/h3>\n<p><strong>Problema<\/strong>: shadow AI deployments unknown.<br \/>\n<strong>Soluzione<\/strong>: company-wide audit periodico, governance strict per new deployments.<\/p>\n<h3>&#8220;Classification sbagliata&#8221;<\/h3>\n<p><strong>Problema<\/strong>: high-risk classified low.<br \/>\n<strong>Soluzione<\/strong>: legal review per classification, especially borderline cases.<\/p>\n<h3>&#8220;No human oversight&#8221;<\/h3>\n<p><strong>Problema<\/strong>: AI deciding autonomously su critical.<br \/>\n<strong>Soluzione<\/strong>: human-in-the-loop mandatory per high-risk, options per limited.<\/p>\n<h3>&#8220;No incident response&#8221;<\/h3>\n<p><strong>Problema<\/strong>: AI failure occorre, no process per gestire.<br \/>\n<strong>Soluzione<\/strong>: incident response plan dedicated AI, reporting authority.<\/p>\n<h2>Casi pratici PMI italiane<\/h2>\n<h3>Caso 1 \u2014 Metalmeccanica: AI quality assessment<\/h3>\n<ul>\n<li>AI quality vision system<\/li>\n<li>Classification: minimal risk (no safety-critical product)<\/li>\n<li>Documentation + monitoring<\/li>\n<li>Investimento: 35k \u20ac<\/li>\n<li>Outcome: full compliance entry 2026<\/li>\n<\/ul>\n<h3>Caso 2 \u2014 HR tech provider: high-risk<\/h3>\n<ul>\n<li>AI recruiting tool<\/li>\n<li>Classification: high-risk<\/li>\n<li>Full compliance programme<\/li>\n<li>Investimento: 145k \u20ac<\/li>\n<li>Customer trust significant boost<\/li>\n<\/ul>\n<h3>Caso 3 \u2014 E-commerce: customer chatbot<\/h3>\n<ul>\n<li>Customer-facing AI chatbot<\/li>\n<li>Classification: limited risk<\/li>\n<li>Transparency requirements implementation<\/li>\n<li>Investimento: 18k \u20ac<\/li>\n<li>NPS customer mantained<\/li>\n<\/ul>\n<h3>Caso 4 \u2014 Tessile: shadow AI<\/h3>\n<ul>\n<li>Multiple AI tools used without governance<\/li>\n<li>Inventory revealed 12 AI systems<\/li>\n<li>2 inadvertently high-risk<\/li>\n<li>Remediation: 95k \u20ac + 8 mesi delay<\/li>\n<li>Lesson learned: governance prima di deployment<\/li>\n<\/ul>\n<h2>FAQ<\/h2>\n<h3>Devo essere PMI grande per AI Act?<\/h3>\n<p>No, applica a tutti. Differenza: large company more obligations + scrutiny. PMI ottiene supports (regulatory sandboxes, simplified procedures).<\/p>\n<h3>Quanto tempo per essere compliant?<\/h3>\n<p>Minimal risk: 1-3 mesi. Limited risk: 3-6 mesi. High-risk: 12-24 mesi. Continuous compliance: ongoing.<\/p>\n<h3>Posso usare ChatGPT\/Claude liberamente?<\/h3>\n<p>General-purpose AI ha specific obligations per provider. Deployer (te) ha obligations basate su use case classification. Sensitive data e high-risk applications richiedono cautela + governance.<\/p>\n<h3>Cosa fare se AI vendor non \u00e8 compliant?<\/h3>\n<p>Risk per deployer trasferito. Process: (1) engagement constructive; (2) corrective action plan; (3) alternative sourcing; (4) terminate if necessary. Documentation per evidence.<\/p>\n<h3>AI Act vs GDPR?<\/h3>\n<p>Diversi scope ma sovrapposizione. GDPR: personal data processing. AI Act: AI systems regardless of data. Some AI applications: both apply. Combined compliance approach raccomandato.<\/p>\n<h2>Prossimi passi<\/h2>\n<p>Nelle prossime guide vedremo come <strong>gestire Cyber Resilience Act (CRA)<\/strong> per prodotti con elementi digitali, come <strong>preparare per Forced Labour Regulation EU<\/strong>, e come <strong>integrare Data Act<\/strong> per data sharing requirements.<\/p>\n<p style=\"margin-top:30px;background:#f4f4f8;padding:18px;border-radius:8px;\"><strong>Vuoi preparare AI Act compliance Odoo nella tua PMI?<\/strong><br \/>\nG Tech Group implementa programmi AI Act compliance per PMI italiane: AI inventory, classification, governance, documentation, training. Track record di PMI pronte before 2026 deadline.<br \/>\n<a href=\"https:\/\/brentasoft.com\/preventivatore.php\"><strong>Richiedi un preventivo gratuito<\/strong><\/a> oppure prova la nostra <a href=\"https:\/\/odoo.brentasoft.com\/\">demo Odoo 19 live<\/a>. Oppure <a href=\"https:\/\/www.odoo.com?utm_campaign=partner-d192ce8a&amp;utm_source=partner_ref\" target=\"_blank\" rel=\"noopener noreferrer\">prova Odoo direttamente su odoo.com<\/a> (link partner Brentasoft).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Settantunesima guida Odoo 19: AI Act EU compliance. 4 livelli rischio, identificazione AI systems, obblighi, governance, casi pratici PMI italiane.<\/p>\n","protected":false},"author":2,"featured_media":3648,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"AI Act compliance Odoo: guida PMI italiane","_seopress_titles_desc":"AI Act EU compliance con Odoo 19 per PMI italiane: 4 livelli rischio, classification, obblighi, governance, timeline, casi pratici.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"https:\/\/brentasoft.com\/blog\/ai-act-compliance-odoo-19-pmi-italiane\/","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-aia-01-mo.png","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","footnotes":""},"categories":[25,689],"tags":[],"class_list":["post-3653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-normative","category-guide-odoo"],"_links":{"self":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts\/3653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/comments?post=3653"}],"version-history":[{"count":0,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts\/3653\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/media\/3648"}],"wp:attachment":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/media?parent=3653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/categories?post=3653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/tags?post=3653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}