AI Act: obligations, deadlines and what changes for insurance

Fact sheet updated to 1 November 2026 on Regulation (EU) 2024/1689 (AI Act), the 2026 amendments and the related Italian rules (Law 132/2025 and Legislative Decree 160/2026): who is in scope, prohibited and high-risk systems, deadlines, fines, authorities and what it means for cyber, PI and liability policies, including life and health pricing.

Regulatory fact sheet · updated 1 November 2026 · by cybercoverinsurance

Regulation (EU) 2024/1689, the AI Act, is the first general law on artificial intelligence. It has been in force since 1 August 2024 and applies in stages until 2028 (Gibson Dunn). It classifies AI systems by risk and sets different obligations for those who develop them and those who use them.

For those who take on risk, the AI Act matters for three reasons. In Italy, a breach of it creates a presumption of causation in a damages claim. It applies directly to insurers, because systems used to price life and health policies are high-risk. And it creates verifiable obligations to bring into the underwriting questionnaire.

In the text, "Article" means a binding rule; "recital" means one of the introductory paragraphs that explain how to read it.

Who is in scope

The AI Act distinguishes two main roles:

provider: whoever develops an AI system and places it on the market under its own name;
deployer: whoever uses an AI system in its professional activity, for example a company using recruitment software or an insurer using a pricing model.

It also applies to providers outside the EU when their systems are used in Europe. Providers of general-purpose AI models, the large models on which other systems are built, have their own obligations.

The four risk classes

Prohibited practices

Since 2 February 2025 certain uses considered unacceptable are banned (Article 5), including social scoring of people, manipulation that exploits vulnerabilities and emotion recognition in the workplace and in schools. From 2 December 2026 a ban is added on systems that generate non-consensual intimate images or child sexual abuse material (FPF).

High-risk systems

There are two kinds. Annex III systems are listed by area of use: recruitment and workforce management, creditworthiness assessment, access to essential services, education, justice, migration. They include systems used for risk assessment and pricing in life and health insurance (EIOPA). Annex I systems are safety components of products already regulated, such as medical devices, machinery and vehicles.

The provider must manage risks, ensure data quality, draw up technical documentation, log operation and pass a conformity assessment. The deployer must use the system according to the instructions, assign oversight to competent people, monitor it and keep the logs (Article 26).

Transparency

Since 2 August 2026, anyone using systems that interact with people, such as a virtual assistant, must say it is AI; generated or manipulated content, including deepfakes, must be labelled (Article 50) (Gibson Dunn).

Minimal risk

All other systems have no specific obligations. Providers and deployers must still support AI literacy among their staff (Article 4), an obligation softened by the 2026 amendments (FPF).

Deadlines

Regulation (EU) 2026/1744, published in the EU Official Journal on 24 July 2026, moved some dates (FPF, Orrick):

2 February 2025: prohibited practices and AI literacy;
2 August 2025: general-purpose models and the penalty regime;
2 August 2026: transparency obligations of Article 50;
2 December 2027: Annex III high-risk systems, including life and health pricing (previously 2 August 2026);
2 August 2028: Annex I high-risk systems (previously 2 August 2027).

Fines

Article 99 sets three levels: up to 35 million euros or 7% of worldwide turnover for prohibited practices; up to 15 million or 3% for breaches of other obligations; up to 7.5 million or 1% for incorrect information given to authorities. For small and medium-sized enterprises the lower of the two amounts applies.

In Italy

Law no. 132 of 23 September 2025, in force since 10 October 2025, sits alongside the AI Act (Cleary Gottlieb):

the National Cybersecurity Agency (ACN) is the market surveillance authority, with inspection and sanctioning powers; the Agency for Digital Italy (AgID) oversees conformity assessment bodies; Banca d'Italia, Consob and IVASS remain competent for their sectors;
professionals may use AI only as a support tool and must tell their clients (Article 13);
spreading deepfakes that cause unjust harm is a criminal offence (Article 612-quater of the Criminal Code), punishable by one to five years in prison.

Legislative Decree no. 160 of 9 September 2026, in force since 30 September 2026, completes the picture (PG Legal, Lavorosì):

if AI Act obligations are breached, causation of the damage is presumed unless proven otherwise (Article 18);
compliance with the AI Act, even if certified, does not by itself exclude liability (Article 19);
the injured party can ask the person responsible whether a liability policy exists and sue the insurer directly (Article 20);
failing to put in place security measures or human oversight on high-risk systems becomes a criminal offence (Article 437-bis of the Criminal Code) and triggers corporate liability under Legislative Decree 231/2001.

What changes for insurance

Liability and PI. In Italy a breach of the AI Act creates a presumption of causation and the injured party can sue the insurer directly. Deployer obligations, such as human oversight and log retention, become the insured's line of defence and therefore the insurer's. The topic is covered in the analysis of AI civil liability.

Fines. AI Act ceilings exceed those of NIS2. As with other laws, cover for administrative fines "where insurable by law" should not be taken for granted.

D&O and corporate liability. The new offence of Article 437-bis and corporate liability under Legislative Decree 231/2001 bring AI governance into the scope of D&O and compliance programmes.

Cyber. The AI Act requires high-risk systems to have an appropriate level of cybersecurity. An attack that alters a model, such as poisoning its training data, is both a cyber incident and a possible breach of the AI Act.

Insurers as deployers. From 2 December 2027, pricing and risk assessment models in life and health insurance are high-risk systems. For non-life lines, including cyber, the AI Act does not classify them as high-risk, but IVASS and EIOPA still expect governance, fairness and explainability of the models used.

Impact for insurersHigh

The AI Act sets verifiable obligations for those who develop and use AI, and in Italy breaching them creates a presumption of causation in a damages claim.