AI & Compliance Resources
CIELO Project by Himmel Advisors ®
Objective
This section is designed to provide organizations with a tool to support them in fulfilling their personal data protection responsibilities, with specific attention to the scope of artificial intelligence and applicable industry regulations. Here, you'll find resources and guidance for independently managing key activities—for example, preparing a clear and transparent privacy policy, conducting a risk assessment or Fundamental Rights Impact Assessment (FRIA), drafting any documentation needed to manage a compliant organizational model, and submitting the required notification (where applicable) to the Supervisory Body—as well as regulatory references and best practices for ensuring compliant and responsible use of AI.
Please remember that the requirements set forth by the AI legislation are the sole responsibility of organizations intending to implement it within their own organizations.
This section aims to guide you in evaluating and implementing the necessary procedures, providing clear and practical guidance for tackling these delicate tasks in a knowledgeable manner and in compliance with current legislation.
We invite you to consult the available resources. Our goal is to support you in fulfilling your obligations, helping you manage crisis situations or requests effectively and independently.
Note : Some of our content is reserved exclusively for our customers or newsletter subscribers. Please note that access to the "Resources" section is completely free and does not involve any further processing of your personal data. Consequently, Himmel will not be able to directly trace your identity if you decide to download restricted content on the page you access, or the number of times you have accessed it. Our cookies are only technical (including anonymous analytics cookies).
For further information regarding the processing of your personal data, please consult our privacy policy.
12 Tips for Using AI in a Compliant Way Under the AI Act
1
Classificare il sistema
Verificate se il sistema IA rientra nelle categorie previste dall’AI Act (vietato, ad alto rischio, limitato, basso rischio) e applicate i requisiti specifici per ciascuna categoria.
2
Condurre una valutazione preliminare del rischio
Prima della messa in esercizio effettuate una valutazione documentata dei rischi per diritti fondamentali, salute e sicurezza, e adottate misure mitiganti.
3
Implementare governance e responsabilità chiare
Nominate un responsabile interno per la conformità AI (e, se necessario, un DPO) e definite ruoli, responsabilità e processi decisionali formali
4
Assicurare trasparenza e informativa
Comunicate in modo comprensibile agli utenti l’uso dell’IA, finalità, limiti e, quando richiesto, la presenza di output generati automaticamente o decisioni autonome
5
Documentare tutto (record-keeping)
Mantenete registrazioni tecniche e di conformità complete e aggiornate (dossier tecnico, test, versioni, log) per dimostrare il rispetto degli obblighi
6
Validare dati e modelli
Garantite qualità, rappresentatività e provenienza lecita dei dataset; monitorate e testate i modelli per bias, accuratezza e robustezza, con aggiornamenti periodici
7
Proteggere la sicurezza e la privacy
Applicate misure tecniche e organizzative per sicurezza informatica, gestione degli accessi e protezione dei dati personali (minimizzazione, pseudonimizzazione, DPIA se necessario)
8
Implementare misure di controllo umano
Dove richiesto, prevedete possibilità di intervento, supervisione o revoca umana delle decisioni automatizzate e indicate chiaramente le modalità di ricorso.
9
Preparare piani di gestione degli incidenti
Definite procedure per rilevazione, segnalazione e risoluzione di malfunzionamenti, impatti negativi o violazioni, incluse comunicazioni alle autorità competenti quando obbligatorie
10
Request advice and regulatory updates
Engage experienced legal/technical advisors and continuously monitor Authority guidelines and updates to adjust policies and practices
AI in brief
Artificial intelligence (AI) is described as a rapidly evolving family of technologies that embody automated systems designed to operate with varying degrees of autonomy. Unlike traditional software based exclusively on rigid rules defined by humans, the fundamental characteristic of an AI system is its inferential capacity. This ability allows the system to:
Derive models or algorithms from received data or inputs.
Generate specific outputs, such as predictions, content (generative AI), recommendations, or decisions, that can impact both physical and virtual environments.
Adapt after deployment, thanks to self-learning capabilities that allow the system to change during use.
The techniques that enable this include machine learning, which learns from data how to achieve specific goals, and logic- and knowledge-based approaches. According to the EU regulatory framework, AI must be a human-centric technology. This means it must serve as a tool for people, with the ultimate goal of improving human well-being and ensuring a high level of protection of health, safety, and fundamental rights. In short, AI doesn't simply follow step-by-step instructions; it analyzes vast amounts of information to "understand" patterns and suggest or implement the best solution for a specific goal.
The impact assessment or FRIA
A Fundamental Rights Impact Assessment (FRIA) is an analytical process designed to evaluate how an artificial intelligence (AI) system may impact individuals' fundamental rights, especially in relation to the processing of personal data. This assessment aims to identify, analyze, and mitigate any risks and negative impacts that the use of such systems could have on privacy, dignity, non-discrimination, and other human rights. Through the FRIA, organizations can ensure that their projects comply with regulations and ethical principles, thus promoting the responsible use of AI.
The FRIA is provided for in Article 10 of the AI Act (Regulation (EU) 2024/1689 of 13 June 2024 establishing harmonized rules on artificial intelligence) by virtue of the provisions of Article 35 of the GDPR (Regulation (EU) 2016/679).
What is the goal of FRIA?
1
Identify potentially compromised rights
Analyze how the use of AI systems can impact fundamental rights, such as the right to protection of personal data, freedom of expression, and non-discrimination.
2
Assess the associated risks
Assess the risks inherent in data processing and the possible negative consequences for individuals and society, particularly those belonging to vulnerable groups (e.g. minors)
3
Propose mitigation measures
Develop and recommend strategies and measures to reduce identified risks, ensuring responsible and transparent management of the processing of personal data and information
Main regulatory references in the EU
Main regulatory references/guidelines in Italy
Provisions and delegations to the Government regarding artificial intelligence. (25G00143)
(Official Journal n.223 of 25-9-2025)
Ministerial Decree no. 180 of 17 December 2025
Guidelines for Implementing AI in the Workplace
(December 17, 2025)
Key news on the implementation of AI regulation in the EU
European Parliament
AI Regulation: The First Artificial Intelligence Regulation (external link)
Metodologia per la conduzione della FRIA
1
Scoping
Identify the context and objectives of the AI system, including the nature of the data processed and the purposes of the processing. Potentially compromised rights
2
Rights Analysis
Examination of the fundamental rights involved (e.g. categories of data subjects and the potential impact of the use of AI on them) and assessment of the applicable regulatory provisions
3
Risk assessment
Identification and analysis of potential impacts on respect for fundamental rights, including risks of discrimination and violation of privacy
4
Consultation and involvement of stakeholders
Creation of a working group of internal and/or external experts: DPO, privacy consultant, top figures of the organizations, Supervisory Body (where present), IT Office or external ADS as well as representatives of potentially interested communities and interested parties with the aim of making decisions in a democratic and informed manner
5
Final report
Drafting a final report summarizing the evaluation findings and outlining recommendations for the implementation and management of the AI system
Shall we prepare the FRIA?
To prepare a Fundamental Rights Impact Assessment (FRIA), it is essential to use a "Guide" containing a reference checklist. This checklist allows you to determine whether a FRIA is necessary, identify the information required to initiate it, such as the type of data processed and the purposes of the processing, and structure the assessment process. Thus, the "Guide" with the checklist is essential to ensuring effective implementation of the FRIA.
Download our free Guide!
Doc. version / Version: V01_2025 (1.7 MB) · Virus-free document
Let's start with the FRIA!
If you already have all the information needed to initiate a Fundamental Rights Impact Assessment (FRIA), you can proceed. The FRIA is not just a mandatory accountability document. It also represents a valuable opportunity to assess potential risks to data subjects' fundamental rights and freedoms .
Conducting a FRIA allows for early identification of potential issues, thus providing the opportunity to take corrective and mitigating measures before implementing an AI tool. This proactive process not only helps ensure compliance with applicable privacy and AI regulations, but also fosters the ethical and responsible management of emerging technologies , protecting user rights and promoting the sustainable use of AI.
Watch the following video to understand what are the fundamental elements that such an evaluation should contain.
Obligation of transparency and information
The principle of transparency requires organizations that process personal data to inform data subjects so that they understand the uses to which their data will be put (why, how, and in what manner) and can exercise their rights (rights of objection, access, rectification, etc.). This principle applies to all processing of personal data, whether the data is:
collected directly from interested parties
collected indirectly (also called third-party data) or through other subjects
In the case of indirect collection of personal data, the data controller may be exempted from the obligation to provide individual communications to data subjects if this requirement is impracticable or involves excessive effort. However, it is essential that general information be provided, for example through the data controller's website, which must contain all the elements required by Article 14 of the GDPR.
AI and Work (Italian system)
_edited.jpg)
The Principles of AI in the World of Work
Guiding Principles for Ethical and Safe AI at Work According to the Ministry of Labor Guidelines Approved by Ministerial Decree No. 28 of December 17, 2025
Chapter 7, “Guiding principles for the responsible and safe use of AI at work,” of the Guidelines issued by Ministerial Decree of 17 December 2025, defines the ethical and legal coordinates necessary for AI to represent an opportunity for innovation without compromising the dignity, health, and fundamental rights of workers.
Download our Guide! (V. 01.1.2026) Language: IT
When to inform
A. In conjunction with the collection
B. Before carrying out processing through AI systems as established by the principles of privacy by design and by default
C. In the case of indirect data collection , the organization is required to inform the data subjects as soon as possible, and in any case no later than the first contact with the data subjects or the disclosure of the data to third parties, providing detailed information where applicable. Furthermore, this information must be provided within one month of the data collection date.
Please note that...
It is ALWAYS mandatory if the data controller intends to proceed with further processing for purposes other than those for which the data was originally collected. For example, a digital platform intending to use user data to train an artificial intelligence model must disclose this intention in advance.
How to inform in an accessible and intelligible way
Data subjects must be able to easily access and understand information relating to their personal data. Notices should be distinct from other communications (such as the "Terms and Conditions of Use" for a specific service or other information contained, for example, on a website). It is advisable to clarify which sections of the notices apply to specific categories of individuals, especially in complex contexts such as the development of AI systems.
Information can be provided via:
Online forms
E-mail
Communications on the occasion of the first useful contact
Notices on freely accessible websites or bulletin boards
The GDPR requires that information be concise, transparent, and provided in plain language. It is essential to clearly describe the consequences of processing, for example, through diagrams or logos that illustrate the use of data during the learning phase and the functioning of the AI systems in which their data is used.
This information can be integrated into existing documents, but it must still be easily accessible and understandable. Unclear technical language does not meet the intelligibility requirements.
Note
It is possible to provide information at multiple levels, first covering the essential information (identity of the data controller, purposes, and rights of the data subjects) and then providing more detailed information regarding the functioning of the AI system.
What information to provide
When the Organization provides individual information, whether through direct collection of data from individuals (Article 13 of the GDPR) or through collection of data from third parties, where it has a means of contact without disproportionate effort, it is obliged to provide the following information in accordance with Articles 13 and 14 of the GDPR:
Identity and contact details of the data controller (email, postal address, telephone number) and of the data protection officers (including, where applicable, the DPO)
Purpose and legal basis of the processing
Recipients or categories of recipients of the data
Potential data transfers beyond the EU
Data retention period
Rights of data subjects (access, rectification, erasure, limitation, portability, opposition or withdrawal of consent) and the possibility of filing a complaint with the Guarantor Authority
Information
Le informazioni e i link presenti nella sezione dedicata del presente sito web sono da considerarsi esclusivamente a titolo informativo. Tali contenuti non hanno la finalità di sostituire, in alcun modo, i canali ufficiali, le normative vigenti, né le previsioni normative delle autorità competenti. L’obiettivo principale di questa sezione è quello di sensibilizzare i clienti di Himmel, ovvero i soggetti incaricati di gestire autonomamente gli adempimenti necessari in materia AI, fornendo loro indicazioni di carattere generale. Si precisa altresì che i contenuti di questa pagina potranno essere soggetti a modifiche nel tempo senza preavviso, al fine di garantire un’informazione aggiornata e coerente con l’evoluzione normativa.
