Italy Police AI Decree

Overview

Decreto legislativo 9 settembre 2026, n. 160 is an Italian legislative decree issued under delegated legislative authority. Published on 15 September 2026, it entered into force on 30 September 2026. Article 1, headed Oggetto e finalità, establishes the subject and purposes of the title governing artificial intelligence in police activities. It addresses use by the organs, offices and commands of the police forces in connection with their specific functions. That use must be consistent with Regulation (EU) 2024/1689 and Law No. 132 of 23 September 2025. The Gazzetta Ufficiale publication is the primary source. The title identifies the instrument by its official designation without adding a longer descriptive heading.

The central structure is regulatory alignment rather than a separate, self-contained AI compliance code. Article 1(2) places police AI use within constitutional and European rights protections and expressly names proportionality, non-discrimination, human oversight and transparency. Article 1(3) states that the police title creates no additional obligations beyond those established by the EU AI Act for systems and models used for police activities and purposes. Rights safeguards remain applicable, but introductory principles do not independently establish additional technical duties. Article 1 establishes the scope and principles described here; the preamble and official notes establish legislative context. Provisions of other instruments remain provisions of those instruments, not independent amendments introduced by this decree.

Definitions

Article 1 uses the expressions artificial intelligence systems, artificial intelligence models, police activities and police purposes without providing technical definitions in that article. Its institutional addressees are the organs, offices and commands of the police forces. The reference to their specific functions connects the title to functions actually exercised rather than AI use in the abstract. The expressly identified European framework is Regulation (EU) 2024/1689. Article 1 does not establish decree-specific definitions of biometric identification, high-risk systems, providers or deployers; applicable legal definitions must govern those concepts.

The safeguards named in Article 1 are legal principles, not technical classifications. Proportionality concerns the relationship between an intervention and its lawful purpose; non-discrimination protects against unjustified differential treatment; human oversight preserves an effective human role; transparency supports intelligibility and scrutiny. These are ordinary-language explanations, not statutory definitions. Article 3 of Law No. 132/2025, reproduced in the official notes, additionally addresses human autonomy, explanation, prevention of harm, data quality and cybersecurity. Those concepts belong to the referenced national statute and retain that attribution in the broader police AI framework.

Governance and Institutional Framework

The preamble identifies the decree's constitutional and legislative authority. Article 76 of the Constitution governs delegation of legislative power to the Government. Article 87, fifth paragraph, concerns the President of the Republic's authority to issue decrees having the force of law. Article 14 of Law No. 400/1988 supplies the framework for legislative decrees. The specific AI delegation appears in Article 24(1), Article 24(2)(h), and Article 24(3) and (5) of Law No. 132/2025. Article 24(2)(h) calls for a dedicated discipline for AI use in police activities. These provisions establish delegated governmental action, not an independent legislative initiative by an agency.

The preamble records a preliminary Council of Ministers deliberation on 10 June 2026 and a final deliberation on 4 August 2026. It also records opinions from the data protection authority, the Unified Conference and the competent parliamentary committees. The Unified Conference opinion is dated 20 July 2026. These are adoption procedures, not allocations of ongoing supervisory powers. Article 1 identifies the police institutions concerned but does not itself designate an inspection authority, create a regulator or establish an appeals body. The parent law's delegation criteria concerning supervisory and sanctioning powers remain distinct from powers conferred by particular operative provisions.

Key Focus Areas

Fundamental-rights protection is central to police functions involving AI. Article 1(2) expressly names the Italian Constitution, the Charter of Fundamental Rights of the European Union and the Convention for the Protection of Human Rights and Fundamental Freedoms. These establish overlapping rights frameworks for police technology. Proportionality and non-discrimination constrain application of the police title. Article 1 does not prescribe a numerical fairness threshold, approve particular technical methods or generally authorise a surveillance technology. The lawful basis and safeguards must be established for the actual activity.

Human oversight and transparency are further priorities. Article 1 connects these principles to Article 3 of Law No. 132/2025, which addresses human autonomy and decision-making, oversight and intervention, explainability and prevention of harm. Regulatory consistency is also essential: national rules must operate coherently with the EU AI Act, and the police title expressly avoids additional obligations beyond that regulation. The preamble cites the GDPR and the law-enforcement data protection framework. These references establish relevant legal context, not a single processing regime applying indiscriminately to every police task.

Implementation Framework

Application starts with Article 1(1)'s institutional and functional scope: whether a police organ, office or command uses AI, and how that use relates to its specific functions. The next question is consistency with the EU AI Act and Law No. 132/2025. This sequence explains application of the provision; it is not a new statutory registration process. Article 1 does not specify procurement conditions, conformity-assessment procedures, retention periods or technology-specific authorisations. Those requirements must be traced to their operative legal bases. The express restriction on additional obligations matters when translating general principles into institutional practice.

Rights safeguards are part of implementation, not an optional policy overlay. Police AI use must respect the constitutional, Charter and Convention protections identified in Article 1(2), alongside proportionality, non-discrimination, human oversight and transparency. The parent law's broader lifecycle approach includes data quality and risk-proportionate cybersecurity. Such principles inform legal analysis but do not establish a decree-specific audit cycle or certification requirement. Institutions must distinguish binding requirements from internal compliance measures. Technical controls, training and documentation practices should identify whether their basis is the AI Act, another applicable law or organisational discretion.

Monitoring and Evaluation

Article 1 establishes substantive evaluation benchmarks: consistency with European and national AI rules, fundamental-rights protection and adherence to the four named principles. These support scrutiny of whether actual use is legally justified and whether human involvement and transparency are meaningful operationally. They do not constitute a complete monitoring procedure. Article 1 prescribes no annual report, independent audit interval, incident-reporting deadline or specified performance indicators. Procedural requirements must be established from the provisions creating them, not inferred solely from a general duty to respect rights.

Article 3 of Law No. 132/2025 states that correctness, reliability, security, quality, appropriateness and transparency of relevant data and processes must be ensured and supervised according to proportionality. It treats lifecycle cybersecurity as an essential condition for protecting rights and principles. These are parent-law provisions, not a separate monitoring schedule introduced by Article 1 of the decree. Institutional review should distinguish technical performance, rights effects and legal compliance. Accuracy alone does not establish lawful use, and general conformity language does not replace oversight obligations under applicable European or national instruments.

Penalties, Liability, and Appeals

The preamble cites legislation concerning criminal law, criminal and civil procedure, civil liability and the administrative liability of entities. References include the Criminal Code, the Code of Criminal Procedure, Legislative Decree No. 231/2001 and Directive (EU) 2024/2853 on liability for defective products. These establish context, not new offences or remedies. Article 1 states no criminal penalty, administrative fine, insurance requirement or appeal deadline. It does not establish imprisonment ranges, entity-liability quotas, specific biometric authorisation procedures or penalty amounts merely through preambular citations.

The official notes reproduce existing Civil Code Articles 2050 and 2051 and Civil Procedure Code Article 116. Article 2050 concerns damage arising from dangerous activities and proof of suitable preventive measures. Article 2051 concerns damage caused by things in custody and the fortuitous-event defence. Article 116 addresses judicial evaluation of evidence and inferences from procedural conduct. These remain existing code provisions. Article 24(5) of Law No. 132/2025 establishes delegation criteria concerning unlawful AI, liability and protection of injured persons; those criteria are not completed amendments, new presumptions or direct insurance actions. Specific criminal offences, civil evidentiary changes, insurance remedies and later-article implementation deadlines cannot be established from Article 1 and the cited context alone.

Relationship to Other Instruments

Article 1(1) requires consistency with Regulation (EU) 2024/1689 and Law No. 132/2025; Article 1(2) refers expressly to Article 3 of the national law. Article 1(3) mirrors that statute's approach of avoiding obligations beyond the EU AI Act. The preamble also invokes Law No. 234/2012, governing Italy's participation in implementing EU legislation and policies. These references situate the decree within delegated national legislation and a European regulatory framework. They do not make it a replacement for the EU AI Act or the parent statute.

The data-protection references include Regulation (EU) 2016/679, Directive (EU) 2016/680, Legislative Decree No. 196/2003, Legislative Decree No. 51/2018 and Presidential Decree No. 15/2018. The law-enforcement directive and its Italian implementing decree concern competent-authority processing for specified criminal-law purposes. The GDPR supplies a different general framework whose application depends on the processing concerned. Police organisational legislation and substantive and procedural codes remain relevant within their respective scopes. A preambular citation is not an amendment, repeal, exemption or finding that every cited regime applies concurrently to every deployment.

International Alignment

The decree aligns police AI use with harmonised European rules, principally Regulation (EU) 2024/1689 of 13 June 2024. Article 1(3)'s limit on additional obligations defines the relationship between national implementation and directly applicable EU legislation. It establishes no mutual recognition arrangement, cross-border approval procedure or permission for international transfers. Those matters require separate legal analysis. Regulatory and rights alignment does not generally authorise sharing AI outputs, biometric information or operational datasets with foreign authorities.

Article 1(2) names the EU Charter and European Convention on Human Rights alongside the Italian Constitution. The official notes also reproduce the parent law's reference to the United Nations Convention on the Rights of Persons with Disabilities concerning equal access to AI systems and functionality. That accessibility provision belongs to Law No. 132/2025. Together, these references establish a layered rights context, not adherence to a separate international technical standard, participation in treaty-based AI certification or adoption of another country's regulatory model.

Implementation Timeline

Sources and References