IA Act: what companies need to know