Italy AI Act Implementation Decree

Overview

Decreto legislativo 7 ottobre 2026, n. 179 adapts Italian legislation to Regulation (EU) 2024/1689, which establishes harmonised rules on artificial intelligence. Its official subject concerns national authority powers and the use of AI in education and training. The decree was published in the Gazzetta Ufficiale, Serie Generale, No. 234 of 8 October 2026, under publication code 26G00200, and enters into force on 23 October 2026. Awaiting Entry applies between publication and commencement. From 23 October 2026, its entry-into-force status becomes In Force, subject to subsequent amendments or repeal. The official gazette publication provides the instrument's title and publication metadata.

The decree is delegated legislation with force of law, not a bill, voluntary strategy or administrative guideline. Its preamble invokes Articles 76 and 87, fifth paragraph, of the Constitution and Article 14 of Law No. 400/1988. Article 24 of Law No. 132 of 23 September 2025 supplies the specific legislative delegation. Article 1 establishes a shared vocabulary and identifies institutions relevant to implementation. Institutional definitions must be distinguished from operative provisions allocating powers or creating obligations. The preamble, Article 1 and legislation reproduced in the explanatory notes establish the framework described below; they do not independently establish every enforcement procedure, training requirement or implementation deadline.

Definitions

Article 1(1) incorporates Article 3 of Regulation (EU) 2024/1689 and Article 2 of Law No. 132/2025, alongside the additional definitions in Article 1(2). It also incorporates Article 1 of the Consolidated Financial Intermediation Act, Legislative Decree No. 58/1998; Article 1 of the Consolidated Banking Act, Legislative Decree No. 385/1993; and Article 1 of the Private Insurance Code, Legislative Decree No. 209/2005. The definition of an AI system therefore follows the European regulation rather than an independently constructed national test. The national AI law defines data as digital representations of acts, facts or information and collections of them, including sound, visual and audiovisual recordings.

Article 1(2) distinguishes national AI authorities, national market-surveillance authorities, sectoral market-surveillance authorities, financial-sector authorities and the national notifying authority. Financial institutions include banks, investment firms, authorised asset managers, specified fund managers, payment and electronic-money institutions, crowdfunding providers, certain benchmark administrators, specified crypto-asset businesses, trading venues, securities infrastructures, insurers and insurance intermediaries. Several categories contain establishment, authorisation or branch conditions that remain essential to coverage. Article 1 also defines the Coordination Committee, the national accreditation body, the Italian AI experimentation space and FinTech experimentation. These terms identify distinct institutional and experimental arrangements rather than interchangeable regulatory categories.

Governance and Institutional Framework

Article 1(2)(a) identifies the Agenzia per l'Italia digitale, or AgID, and the Agenzia per la cybersicurezza nazionale, or ACN, as national authorities for AI, referring to Article 20(1) of Law No. 132/2025. Article 1(2)(e) identifies AgID as the national notifying authority. Article 1(2)(b) lists ACN, Banca d'Italia, CONSOB, IVASS and the Garante per la protezione dei dati personali as national market-surveillance authorities, expressly referring to Article 5 for their allocation of responsibilities. Designation as a national AI authority does not itself confer responsibility for every supervisory action involving an AI system. Banca d'Italia, CONSOB and IVASS are also defined as financial-sector authorities in their market-surveillance capacity.

Article 20 of Law No. 132/2025 assigns innovation and notification-related functions to AgID and surveillance, inspection and sanction-related responsibilities to ACN, while preserving financial-sector responsibilities. It designates ACN as the single contact point with EU institutions. Article 1(2)(f) recognises the Coordination Committee at the Presidency of the Council of Ministers. Under the parent law, the committee includes the directors-general of AgID and ACN and the head of the Department for Digital Transformation; senior representatives of Banca d'Italia, CONSOB and IVASS participate when their responsibilities are involved. The committee supports collaboration among national authorities, public administrations and independent authorities. Existing data-protection and digital-services competences remain legally distinct.

Key Focus Areas

The decree's central focus is national implementation of the European AI framework, particularly institutional powers and education and training. Article 24 of Law No. 132/2025 authorises adaptation of existing legislation, including banking, financial, insurance and payment-services rules. Article 1 reflects this cross-sector approach through its financial definitions. It also recognises sectoral market-surveillance authorities by reference to Article 3 of Legislative Decree No. 157/2022 and the Union harmonisation legislation listed in Annex I to the AI regulation. The institutional framework therefore combines AI-specific arrangements with established sectoral supervisory structures.

The parent law's delegation addresses AI literacy, professional-sector training, scientific and related educational competences, and learning in universities, AFAM institutions and ITS Academies. It also addresses research, technology transfer and collaboration with experimentation spaces. These objectives explain the education and training dimension of the decree's official subject. They are delegation objectives, not independently established decree-specific curricula, credit thresholds, training schedules, implementation deadlines or compensation entitlements. Article 1 supplies relevant definitions but does not itself prescribe detailed courses or professional training duties. A specific obligation requires an operative provision rather than inference from the decree's title or the parent law's objectives.

Implementation Framework

Implementation requires identifying both the applicable definitions and the responsible institution. Article 1 maintains a shared vocabulary across the EU AI regulation, the Italian AI law and financial-sector legislation. An organisation's legal classification is distinct from the characteristics and use of an individual AI system. The financial-institution definition contains express authorisation, establishment and Italian-branch qualifications for several categories; a general description such as financial-services business cannot replace those conditions. The list of national market-surveillance authorities is likewise not a complete allocation of jurisdiction: Article 1 expressly directs that allocation to Article 5.

Article 1(2)(n) defines the Italian AI experimentation space as the national regulatory sandbox under Article 57 of the AI regulation. Article 1(2)(o) separately defines FinTech experimentation by reference to Article 36(2-bis) to (2-novies) of Decree-Law No. 34/2019, converted by Law No. 58/2019. The national AI law provides for joint AgID and ACN establishment and management of AI experimentation spaces, with consultation of the defence and justice ministries for specified matters, while preserving the financial experimentation framework. These definitions do not confer automatic admission, unrestricted testing or exemption from mandatory Union law. Admission conditions, permissions and operational safeguards depend on the applicable substantive rules.

Monitoring and Evaluation

The framework distinguishes monitoring of conformity-assessment bodies from market surveillance of AI systems. Article 20 of Law No. 132/2025 assigns AgID functions concerning notification, evaluation, accreditation and monitoring of entities entrusted with verifying AI-system conformity. ACN's role encompasses surveillance, including inspection and sanction-related activities, within applicable national and European legislation. Article 1 of the decree recognises the relevant institutions but does not itself provide a complete inspection procedure. A conformity-assessment organisation, provider and deployer should therefore distinguish the purpose, competent authority and legal basis of each monitoring interaction.

The existing FinTech framework has a separate evaluation mechanism. Article 36(2-septies) of Decree-Law No. 34/2019 requires Banca d'Italia, CONSOB and IVASS to prepare annual analyses within their respective responsibilities. These analyses report experimentation findings and identify possible legislative or regulatory changes supporting sector development, savings protection and financial stability. That requirement belongs to the FinTech legislation; it is not a new general reporting duty for all AI operators created by Article 1. No universal audit frequency, operator reporting interval or national AI performance indicator follows from the definitional provisions. Monitoring obligations must remain connected to their operative statutory source.

Penalties, Liability, and Appeals

The decree rests on an enforcement-oriented delegation. Article 24(2)(d) of Law No. 132/2025 directs the Government to assign powers to impose sanctions and other administrative measures under Article 99 of the AI regulation, respecting its limits and procedures and the relevant national arrangements. Article 24(2)(n) addresses adaptation of the sanctioning framework and procedures, including possible departures from specified national legislative criteria and Law No. 689/1981. These provisions establish the legislative basis for enforcement legislation, but do not themselves supply the decree's complete penalty schedule or identify the procedure governing a particular infringement.

Article 1 identifies authorities relevant to enforcement without stating monetary sanction amounts, turnover percentages, limitation periods, appeal deadlines or the competent court for each challenge. Institutional definitions and a delegation to adapt administrative sanctions do not establish a compensation entitlement, a new burden-of-proof rule or an insurance obligation. The preamble's references to industrial property, trade-secret protection and specialised judicial sections do not independently establish a specific litigation remedy. Sanction exposure, inspection powers, civil liability and routes of appeal require the relevant operative provisions; precise amounts and procedures cannot be derived from institutional designation alone.

Relationship to Other Instruments

Regulation (EU) 2024/1689 is the central European instrument to which national legislation is adapted. Article 1(2)(h) defines it as the AI regulation, while Article 1(2)(i) defines Law No. 132/2025 as the AI law. The latter supplies both the delegation and the national institutional framework. Regulation (EU) 2019/1020 on market surveillance and product conformity, together with Legislative Decree No. 157/2022 adapting Italian legislation to it, supplies another connection. Article 1(2)(c) uses that national market-surveillance legislation to identify sectoral authorities responsible for Union harmonisation legislation listed in Annex I to the AI regulation.

The financial statutes incorporated by Article 1(1) preserve specialised banking, investment and insurance terminology. Article 1 also refers to the existing FinTech experimentation regime and the national accreditation framework associated with Regulation (EC) No. 765/2008 and the ministerial designation cited in Article 1(2)(m). The preamble cites Directive (EU) 2016/943 on trade secrets, the Industrial Property Code, administrative-sanctions legislation and the statutes establishing AgID and ACN. A citation establishes relevance to the legislative framework, not automatic amendment or repeal. Changes to another instrument require the corresponding operative amendment and cannot be inferred solely from its appearance in the preamble.

International Alignment

The decree's international alignment is principally European. Incorporation of the AI regulation's terminology, recognition of a national notifying authority and market-surveillance authorities, reference to Union harmonisation legislation, and definition of an Article 57 sandbox connect Italian implementation to the EU regulatory architecture. The national AI law's designation of ACN as the single contact point with EU institutions supports that connection. These arrangements do not create a separate international treaty or replace the European regulation with an independent Italian AI code. National implementation provisions and Union-level obligations must be read together, including their distinct application dates.

The financial-institution definition has a cross-border dimension. It includes specified EU entities operating through Italian branches and specified third-country entities authorised in Italy, with additional qualifications for certain fund managers. Those conditions determine whether a foreign-established organisation belongs to a defined category; they do not place every foreign AI supplier under Italian financial supervision. Defining the national accreditation body does not independently establish mutual recognition of all foreign certificates. The institutional and definitional provisions do not establish an additional bilateral agreement, third-country equivalence decision or global certification arrangement.

Implementation Timeline

Compliance Checklist

Sources and References