Italy’s AI oversight decree takes effect on 23 October
Italy’s new AI oversight decree enters into force on 23 October 2026, two days from today. Organisations using AI should check their regulator, employment safeguards and incident-reporting arrangements now, while preparing for training measures scheduled for 2027.
What's changing
Legislative Decree No. 179 of 7 October 2026 adapts Italy’s national framework to the EU AI Act. It supplements the European rules rather than replacing them or creating a separate timetable for every AI Act obligation.
The decree was issued on 7 October and published in the Gazzetta Ufficiale on 8 October. Those steps have already happened; 23 October is the entry-into-force date.
A central change is the allocation of oversight powers. Italy’s National Cybersecurity Agency handles general AI market surveillance. Banking, investment and insurance authorities oversee relevant financial-sector uses, while the Agency for Digital Italy supervises bodies that assess whether AI systems meet regulatory requirements. Authorities can inspect systems, investigate complaints and serious incidents, and require corrective action.
For employers, the decree protects human control over covered final employment decisions. The person making the decision must have genuine, independent authority: simply approving an AI recommendation without meaningful judgment is not enough. Decisions that breach this rule are void, and worker consent cannot waive the safeguard.
The scope has an important boundary. Candidate searching and selection, including exclusion from later recruitment stages, fall outside the decree’s definition of final hiring decisions. That does not exempt those activities from other applicable laws.
Workers must receive the required information before processing. On request, they must also receive an understandable explanation delivered by a person, identifying AI’s possible influence and the main factors considered. Employers must address relevant AI risks in workplace safety assessments and training.
Article 23 provides the enforcement stakes. Maximum administrative fines include €35 million or 7% of previous-year worldwide turnover, whichever is higher, for prohibited practices; €15 million or 3% for specified compliance failures; and €7.5 million or 1% for inaccurate, incomplete or misleading responses to information requests. Breaches of specified impact-assessment and explanation duties can attract maximum fines of €1 million or 0.5%. Special rules apply to smaller businesses and innovative start-ups, and low-harm breaches may receive corrective orders or public declarations instead of fines.
Who is affected
This is a national Italian decree, not a regional measure. It applies to people and organisations covered by the EU AI Act, alongside specified employers, education providers, professional bodies and public-sector organisations. Responsibilities depend on the organisation’s role and activity, not simply on whether it buys or builds AI.
Financial-sector organisations should identify the relevant sector authority rather than assume the general market-surveillance route applies. Employers should examine AI-assisted employment decisions and worker communications. Education institutions and professional bodies should map the training measures relevant to them.
Higher-education content must address subjects including interpreting AI outputs, human oversight and cybersecurity. The decree also sets later implementation milestones:
- 21 January 2027: the calculated ninety-day deadline for surveillance-cost parameters under Article 10, the teacher-training-plan launch under Article 37, and the ministerial training decree under Article 38.
- 23 April 2027: the calculated six-month deadline for professional-training updates and the healthcare-training agreement under Article 47, plus ECM allocation and healthcare-management programmes under Article 51.
- 23 October 2027: the calculated twelve-month deadline for professional fair-compensation parameter updates under Article 49.
These are deadlines for the specified measures, not a general grace period for every organisation using AI.
Three things to do this week
1. Screen your AI uses and employment workflows. Identify systems in use, their purposes and accountable owners. Check for practices prohibited by the EU AI Act, a critical compliance area under Article 23. For covered final employment decisions, confirm that a person can independently assess the evidence and make the decision. Check worker-information procedures, requested explanations and workplace safety documentation too.
2. Prepare reliable responses to regulators. Assign responsibility for information requests and establish a review process for accuracy and completeness. Locate system documentation, supplier information, relevant assessments and decision records. Article 23 addresses inaccurate, incomplete or misleading responses, so teams should flag uncertainty rather than present assumptions as verified facts.
3. Test incident reporting and assign training owners. Confirm how staff escalate AI incidents, who assesses reporting requirements and which authority should receive a report. Apply the relevant incident-reporting rules; do not assume this decree creates one universal reporting deadline. Article 23 makes incident reporting a critical compliance item. Separately, allocate responsibility for relevant 2027 training milestones and track the implementing measures needed to deliver them.
Related context
The essential companion is the EU AI Act, Regulation (EU) 2024/1689. It supplies the European framework that this decree supports through Italian oversight powers and additional national measures. Organisations should read the two together: the Italian entry-into-force date does not reset the EU instrument’s timetable, and the recruitment boundary described above does not displace other applicable protections.
Note: this article was drafted by AI - OpenAI GPT-6.1