The Regulatory Perimeter

Until 2025 compliance was a downstream theme of design. From 2026 it enters the design perimeter, because it directly touches what is seen on screen. What follows is not a regulatory review but the list of things to do, for two concrete cases: a traditional digital site or service, and an AI chat integrated into your product.

If you have an AI chat (or a generative function) inside your product:

1. Declare that one is interacting with an AI system, in a way perceivable within the interaction itself — not in a line of the terms of service, not in a tooltip. In force since 2 August 2026 (AI Act, art. 50).
2. Mark AI-generated or AI-altered content in a machine-readable format — metadata, C2PA, or equivalents. For what is already in production there is time until 2 December 2026.
3. Make the declaration itself accessible: announced by screen readers, with sufficient contrast, without disappearing after a few seconds. It is the point where compliance and accessibility coincide.
4. If the audience can include minors — and with 89% of Italian 9-16-year-olds using GenAI, it is almost always the case: information understandable to a fourteen-year-old, and parental consent under 14 (L. 132/2025, art. 4 co. 4). The law does not prescribe an age verification mechanism: the choice of how to implement it — and whether to limit oneself to self-declaration — falls entirely on the team.
5. If the chat performs actions and not just answers: log of executed actions, explicit confirmation on irreversible operations, rectification channel and escalation to an operator. On delegated payments the framework (PSD3) is still being defined and autonomous checkout is not currently practicable in the EU.

If you have a traditional digital site or service:

6. Check whether you fall under the European Accessibility Act — e-commerce, banking services, transport, telecommunications, e-books: in force since 28 June 2025, reference standard EN 301 549, which refers to WCAG 2.1 AA. If there is a chat on top of a covered service, the chat is covered too.
7. Decide whether to stay in Google’s AI answers. Since 17 June 2026 there is a toggle in Search Console to opt out of AI Overviews and AI Mode without organic ranking penalty. It is a decision to make and document, not to suffer by omission.
8. Define an access policy for automatic agents: robots.txt, rate limiting, terms of use. Blocking them is legitimate; not knowing they are there, no.

These eight items are the mandatory floor. Treating them as the whole perimeter confuses compliance with design ethics, which are different things: a method such as Value Sensitive Design (see Serendipity declines) covers what the law does not require but that still affects the autonomy and wellbeing of whoever uses the product.

The decision this observation informs

The decision is which of these obligations to treat as compliance items and which as product decisions. Without an explicit choice, they all get treated as compliance items, delegated to legal, and the organisation discovers downstream that three of them changed the product without the product knowing: items 4, 5 and 7 are product decisions dressed up as compliance items — age verification, where law 132/2025 sets the goal and not the mechanism; confirmation and escalation in agentic actions; and Google’s toggle on AI answers, which is a decision to make and document, not to suffer by omission.

Treating them as product decisions costs design and research time on constraints that arrive with a fixed, non-negotiable date. Treating them as compliance items costs having the mechanism chosen by someone who does not design the experience: age verification becomes as defensive as possible, confirmation becomes a pop-up, the Google toggle stays on its default value. The choice belongs to Legal / Compliance for the obligation and to the Product Manager for the mechanism: the obligation says what to achieve, the mechanism is product.

The deadlines are known: 28 June 2025 for the EAA, already in force; 2 August 2026 for the AI Act art. 50 disclosure; 17 June 2026 for the Google toggle on AI answers; 2 December 2026 for the marking of generated content. Item 7 falls on Staying in AI answers, item 5 on The delegation scale.

Effects and role responsibilities

• Legal / Compliance — From advisory function to presence in the design process, with an operational perimeter: validate disclosures before release, not after; define who answers for an action performed by an agent on behalf of a user; establish audit trail requirements; guard minors’ consent and verifiability. Two questions to ask the team, immediately: who signs the disclosure, and who answers if the agent is wrong.
• UX Writer / Copywriter — The AI disclosure is microcopy and must be designed as such: perceivable without being invasive, understandable to a fourteen-year-old, compatible with screen readers, without timeout. Write it well once and reuse it, instead of improvising it on every touchpoint.
• Front-end Developer — Technical implementation: machine-readable marking of generated content, accessible disclosure (announced, not just visible), management of the opt-out toggle, action logging.
• Product Manager — Items 4, 5, and 7 are product decisions disguised as compliance: they must go on the roadmap with a date, not be delegated to legal.