Italy - AI Adoption Guidelines

Overview

The AgID draft "Linee guida per l'adozione dell'Intelligenza Artificiale nella Pubblica Amministrazione" (Bozza V.1.0, 14 Feb 2025) sets out operational guidance for Italian public administrations to harness AI in delivering public services while protecting rights and ensuring legal compliance. The draft was published for public consultation by Determinazione n.17/2025 (consultation open 18 February–20 March 2025) and is anchored to the Piano Triennale per l'Informatica nella Pubblica Amministrazione 2024–2026. The document mirrors the EU risk-based approach under the EU Artificial Intelligence Act and integrates obligations under the GDPR, national procurement and cybersecurity rules. It aims to provide PAs with policies, templates and a lifecycle framework for procurement, deployment, testing and monitoring of AI systems, and to flag prohibited or highly restricted uses in line with EU prohibitions (for example social scoring and pervasive biometric surveillance).

Definitions

The draft defines core terms to ensure common understanding across PAs: "AI system" (broad functional definition consistent with the AI Act); "provider" (entity making an AI system available on the market or putting it into service); "deploying administration" or "deployer" (PA that uses the AI system to achieve public functions); "high-risk system" (uses that substantially affect rights, health, safety or access to essential public services); "model lifecycle" (from design and dataset curation to decommissioning); and governance terms such as "AI steward", "AI steering committee" and "record of processing and decisions". These definitions aim for alignment with EU terminology to facilitate interoperability and compliance.

Governance and Institutional Framework

The draft prescribes internal governance structures inside PAs: formation of an AI governance body (e.g., an AI Steering Committee or a designated AI Responsible Officer), clear allocation of responsibilities across procurement, legal, data protection and ICT/security units, and processes to involve sectoral regulators where needed. AgID positions itself as a central support and coordination point—providing templates, running training, hosting "environments for experimentation" and curating technical and ethical guidance. The document also identifies coordination needs with the national Data Protection Authority (Garante), the national cybersecurity authority and sectoral regulators (e.g., Ministry of Health for healthcare AI) and references the AgID transparency and determination pages for the consultation materials (Determination n.17/2025 and AgID AI area).

Key Focus Areas

The draft concentrates on several intersecting themes: (1) risk-based classification and assessment—requiring PAs to evaluate potential impacts on rights, safety and fairness before procurement or deployment; (2) transparency and documentation—obliging detailed records (model cards, documentation of training data provenance, decision logs) to enable audits and explainability; (3) data protection and privacy—embedding DPIA integration and minimisation principles consistent with the GDPR; (4) cybersecurity and model security—requiring technical safeguards against data poisoning, model theft and adversarial manipulation and referencing national cyber guidance; (5) human oversight—ensuring that final decisions with legal or significant effects on citizens include appropriate human review; (6) procurement and contractual clauses—incorporating compliance, audit and liability terms into supplier contracts; and (7) skills and organisational preparedness—recommending training plans and dedicated operational roles. The draft highlights prohibited or restricted uses consistent with EU rules (e.g., social scoring and most forms of real-time remote biometric identification).

Implementation Framework

Operationally, the guidelines provide PAs with procedural steps, templates and annexed tools for implementation: a) an initial screening and risk classification flowchart; b) detailed DPIA and AI impact assessment templates; c) procurement clauses and model contractual language for suppliers (including requirements for access to documentation and logs); d) pre-deployment testing protocols and acceptance criteria; e) post-deployment monitoring plans with KPIs and incident reporting routes; and f) decommissioning checklists to manage model retirement and data retention. AgID signals that the annexed "tools" are modular and will be updated more frequently than the main text to reflect technological or normative changes.

Monitoring and Evaluation

The draft requires continuous monitoring and periodic re-evaluation of deployed systems, including automated telemetry on key performance indicators (accuracy, fairness metrics, drift detection) and scheduled audits. It suggests establishing incident reporting and remediation procedures, logging and retention policies sufficient for technical forensic analysis, and mechanisms for citizens to request human review or lodge complaints. AgID envisages coordination with national supervisory authorities for systemic issues and information sharing via designated national channels. Monitoring also includes periodic review of contracts and supplier compliance.

Penalties, Liability, and Appeals

While the Bozza itself is a non-binding guidance instrument, it clarifies how compliance with mandatory EU and national obligations should be operationalised within PAs. It points out that violations of binding law (for example the AI Act or GDPR) remain subject to statutory sanctions (administrative fines and corrective measures by competent authorities) and that non-compliance can also trigger procurement remedies, contractual sanctions and internal administrative or disciplinary measures. The draft recommends clear internal appeals processes for citizens and staff affected by automated decisions and creates a procedural link to sectoral appeal bodies and the national Data Protection Authority for privacy-related disputes.

Relationship to Other Instruments

The document is explicitly designed to complement and operationalise higher-level instruments: the EU Artificial Intelligence Act (risk-based obligations and prohibited practices), the GDPR (privacy and DPIA obligations), the DPCM Piano Triennale 2024–2026 (strategic priorities for PA digitalisation) and national procurement and cybersecurity frameworks. It also cross-references instruments prepared by sectoral regulators (e.g., health, justice, finance) and invites PAs to align sectoral deployments with any additional sector-specific rules or technical standards.

International Alignment

The draft references the EU AI Act and encourages alignment with EU-level conformity, standardisation (CEN-CENELEC activities), and the evolving work of the European AI Office. It also recommends that PAs follow internationally recognised technical best practices for security and testing and to monitor international developments in AI regulation to maintain interoperability and legal consistency. AgID positions the guidelines as compatible with EU-wide supervisory frameworks and anticipates cooperation with the national contact points emerging from EU implementation mechanisms.

Implementation Timeline

Sources and References