Introduction
This policy describes how Aiot Solutions uses artificial intelligence (AI) in its products, services and internal processes, in compliance with Regulation (EU) 2024/1689 (EU AI Act). It is addressed to clients, suppliers, employees, candidates and anyone affected by the AI systems that may be used in the Company’s activities.
Regulatory framework
Our company has adopted governance measures for compliance with Regulation (EU) 2024/1689, known as the EU AI Act, which entered into force on 1 August 2024 and applies in stages between 2 February 2025 and 2 August 2027. In particular:
- Article 4, in force since 2 February 2025, commits us to ensuring an adequate level of AI literacy for staff working with artificial intelligence systems;
- Article 5 prohibits certain AI practices deemed unacceptable: we confirm that we do not use any of the prohibited systems;
- Articles 8-22 and 26-27 set out the obligations of providers and deployers of high-risk AI systems, applicable from 2 August 2026;
- Article 50 introduces transparency obligations towards people who interact with AI systems or with their outputs.
Role of the Company under the Regulation
Aiot Solutions complies with the Regulation both as a provider, when it develops and places on the market AI systems embedded in its products, and as a deployer, when it uses AI systems developed by third parties for internal processes. For each role, dedicated company policies have been adopted, subject to legal review and signed by the Legal Representative.
AI systems in use
The AI systems we use, directly or through qualified third-party suppliers, are classified by risk level under the Regulation:
- Unacceptable risk (Art. 5): no prohibited system is in use.
- High risk (Annex III): features supporting personnel selection, allocation of resources to projects and skills analysis. For these features, human oversight of the final decisions is always ensured.
- Limited risk (Art. 50): conversational assistants (chatbots) that clearly identify themselves as automated systems on first use.
- Minimal risk: business intelligence, document search and technical monitoring features. No specific obligation under the Regulation.
Guiding principles
Human oversight
No decision producing significant effects on natural persons is taken solely by our AI systems. Their output is always reviewed and confirmed by qualified staff.
Transparency
We clearly and accessibly disclose the use of AI systems in interactions involving natural persons, in line with Article 50 of the Regulation and the notices required by the GDPR.
Data quality and governance
The data used to train, validate and operate our AI systems are selected with attention to representativeness and bias mitigation, in coordination with the impact assessments required by the GDPR.
Staff AI literacy
Staff working with AI systems receive documented and recurring training on risks, safe operating practices and the rights of the people concerned, under Article 4 of the Regulation.
AI tools used in software development
A significant part of our software development is carried out with the support of agentic tools based on large language models (LLMs), both in the cloud and locally. Their use is governed by a dedicated company policy that ensures: activation of the provider’s no data retention mode (“zero retention”) where required by the client or by the sensitivity of the data; a ban on entering secrets, credentials or confidential data in prompts; human review of generated code before it is integrated into the product; staff training on risks and safe operating practices.
Rights of the people concerned
People affected by a decision supported by a high-risk AI system have the right, under Article 86 of the Regulation and the GDPR, to:
- receive clear information on the role of the AI system in the decision concerning them;
- request human review of the decision, in particular when it produces legal or similarly significant effects;
- exercise the rights granted by the GDPR (access, rectification, erasure, restriction, objection, portability);
- lodge a complaint with the Italian Data Protection Authority or with the national authority competent for AI.
Incident management
If a high-risk AI system malfunctions in a way that could cause significant harm to the people concerned, a management procedure applies: precautionary suspension of the feature, root cause analysis, corrective measures and, where required, notification to the provider, the competent authorities and the people concerned.
Contact
To exercise the rights listed above or for any information on the AI systems used by Aiot Solutions, please contact the data controller:
AIoT Solutions S.r.l. - Registered office: Via Olindo Guerrini, 24 - 00137 Rome (RM) - Operational office: Corso Valdocco, 2 - 10122 Turin (TO) - info@aiotsolutions.it
Updates to this policy
This policy is reviewed at least once a year and whenever relevant regulatory updates occur (delegated and implementing acts of the Regulation, the Digital Omnibus on AI, national implementing rules). Significant changes will be announced on this website.