Italy AI Regulation Overview

Overview

Italy's regulatory framework for artificial intelligence has evolved into a comprehensive, national statutory system built upon European legal foundations and dedicated national legislation. The primary legislative backbone is Legge 23 September 2025, n.132 (promulgated following parliamentary proceedings under DDL S.1146/C.2316), which entered into force on 10 October 2025. This statute establishes core principles, sectoral requirements, governance mandates, and criminal penalties while operating in explicit conformity with Regulation (EU) 2024/1689 (the EU AI Act).

Complementing primary legislation, Italy's framework features executive policies and institutional guidance across the public sector and data protection domains. Key policy instruments include the Three-Year ICT Plan for the Public Administration (Piano Triennale per l'Informatica nella Pubblica Amministrazione 2024–2026), the National Digital Strategy (Italia Digitale 2026), AgID's draft guidelines on AI adoption in public bodies (Bozza Linee guida PA 2025), and supervisory enforcement decisions by the Data Protection Authority (Garante per la protezione dei dati personali). Together, these measures establish an anthropocentric regulatory approach prioritizing human dignity, fundamental rights, cybersecurity, and national data sovereignty.

Regulatory Approach

Italy combines binding horizontal statutory legislation with sector-specific mandates and soft-law administrative guidance. Legge n.132/2025 codifies fundamental statutory principles—such as human-centricity (anthropocentrism), transparency, non-discrimination, proportionality, and security—while authorizing the Government to adopt implementing decrees (decreti legislativi and decreti ministeriali) for technical execution, thresholds, and administrative procedures.

The national regime mirrors the EU AI Act's risk-based architecture, superimposing additional national requirements for high-risk applications, public administration adoption, and data governance. Public sector deployments face strict operational criteria, including mandatory human oversight for decisions affecting citizens' rights, server localization within national territory for sovereign security, and systematic risk and data protection impact assessments. Additionally, proactive soft-law guidance from AgID and the Garante provides modular toolkits and technical standards for continuous risk management and compliance monitoring.

Key AI Legislation

Italy's AI statutory and regulatory landscape comprises primary statutes, public administration plans, regulatory decisions, and strategic policy frameworks:

• Legge 23 settembre 2025, n.132 (Disposizioni e deleghe al Governo in materia di intelligenza artificiale): Italy's baseline national statute on AI (originating as DDL n.1146). It sets high-level anthropocentric principles, designates AgID and ACN as primary AI authorities, introduces new criminal offenses (including Art. 612-quater c.p. on illicit deepfake dissemination), mandates server localization for public sector systems, and delegates detailed rule-making to the Government.
• Piano Triennale per l'Informatica nella Pubblica Amministrazione 2024–2026: National strategic and operational blueprint issued by AgID and the Department for Digital Transformation, establishing operational directives, procurement standards, and risk-based AI tools for public bodies.
• Bozza Linee guida per l'adozione dell'Intelligenza Artificiale nella Pubblica Amministrazione (2025): Draft AgID guidelines providing lifecycle governance, procurement clauses, model cards, and risk classification flowcharts for public sector deployers.
• Garante Provvedimento n.114 (11 April 2023) & Provvedimento n.329 (20 May 2024): Enforcement and guidance measures issued by the Data Protection Authority regarding generative AI systems, addressing emergency limitations on ChatGPT, age verification, consent legal bases, and technical countermeasures against unauthorized web scraping for model training.
• Italia Digitale 2026 & Programma Strategico per l'AI 2022–2024: National strategic policy blueprints embedding AI development into recovery investments (PNRR), digital infrastructure expansion, and national research initiatives.

Governance & Enforcement Bodies

Legge n.132/2025 establishes a multi-layered governance architecture led by the Presidency of the Council of Ministers (structure for innovation and digital transition), which oversees national AI strategy, interministerial direction, and policy coordination. Operational supervision and technical execution are shared between two designated primary national AI authorities: the Agenzia per l'Italia Digitale (AgID) and the Agenzia per la Cybersicurezza Nazionale (ACN).

AgID is tasked with innovation promotion, sandbox environments, notification management, technical standards, and the accreditation of conformity-assessment bodies. ACN serves as the national market surveillance and inspection authority, holding powers over cybersecurity oversight, technical inspections, and compliance enforcement. Specialized sector supervisory authorities—including the Garante per la protezione dei dati personali for data privacy, alongside Banca d'Italia, CONSOB, and IVASS for financial and insurance markets—maintain their existing statutory jurisdiction in conjunction with the primary AI authorities.

Penalties & Enforcement

Enforcement of AI rules in Italy relies on a dual track of statutory criminal offenses and administrative sanction mechanisms. Under Legge n.132/2025, criminal provisions are established for harmful abuses, notably introducing Article 612-quater of the Penal Code (c.p.), which criminalizes the illicit dissemination of AI-generated or altered audio, visual, or audiovisual content (deepfakes) causing unjust damage, punishable by 1 to 5 years of imprisonment. The law further adjusts existing offenses regarding market manipulation, financial misstatements, and corporate crimes when committed through AI technologies.

Administrative enforcement and market surveillance are conducted by ACN, AgID, and sectoral regulators. Under delegated powers, the framework provides for administrative fines, corrective orders, system suspensions, and non-conformity penalties. Furthermore, data processing breaches committed during AI training or deployment remain fully subject to GDPR enforcement mechanisms by the Garante, including corrective orders and administrative fines up to 20 million EUR or 4% of total global annual turnover under GDPR Article 83.

Data Protection Framework

Data protection serves as a foundational pillar of Italy's AI regulatory architecture, governed by the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the national Data Protection Code (d.lgs. 196/2003 as amended). The Garante per la protezione dei dati personali plays a highly active role in enforcing privacy requirements against AI developers and deployers, demanding explicit legal bases for training data collection, data subject opt-out tools, and mandatory Data Protection Impact Assessments (DPIAs).

National legislation introduces specific data sovereignty and protection constraints. Legge n.132/2025 requires that public sector AI processing systems processing sensitive data be hosted on servers located within national territory to safeguard security and sovereignty. Additionally, Garante Provvedimento n.329 outlines guidance for data controllers to combat unauthorized web scraping for AI model training, recommending technical rate-limiting, CAPTCHAs, API gating, and contractual prohibitions. Special statutory age-consent safeguards also govern minors' interaction with AI platforms.

Sector-Specific Rules

Italian AI regulation establishes dedicated provisions across key public and private sectors. In healthcare, Legge n.132/2025 regulates AI used as clinical decision support, mandating explicit patient information and mandatory human oversight over AI-driven diagnoses or treatment plans. In the public administration, AgID guidelines and the Piano Triennale require formal risk classification, algorithmic transparency, auditability, and human intervention before final decisions affecting citizens' legal rights are executed.

In employment and workplace settings, the law enforces worker transparency rules, limiting automated employee monitoring and prohibiting unfair automated profiling in hiring, performance evaluation, or workplace management. Within financial markets, Legge n.132/2025 updates market abuse regulations and financial disclosure requirements, subjecting AI systems operated by financial institutions to joint oversight by Banca d'Italia, CONSOB, and IVASS. Copyright law is also updated to require clear disclosure of AI assistance in creative works.

International Alignment

Italy's national AI regulatory architecture is directly integrated with European Union legislation and international frameworks. Legge n.132/2025 explicitly mandates that all national provisions and secondary decrees be interpreted and applied in full conformity with Regulation (EU) 2024/1689 (the EU AI Act). The national risk classification, provider-deployer obligations, and conformity assessment schemes align directly with the European harmonized standards.

Furthermore, Italian regulatory bodies actively participate in European and international policy coordination. The Garante participates in the European Data Protection Board (EDPB) task forces on generative AI, while national strategies explicitly incorporate principles from the OECD AI Principles and the EU Digital Decade 2030 objectives. National market surveillance structures under ACN and AgID are structured to interface directly with the European AI Board and EU incident reporting repositories.

Future Developments

The Italian AI regulatory landscape will undergo significant operational expansion through delegated legislative decrees (decreti legislativi) authorized under Legge n.132/2025. Over the 12 months following enactment, the Government is mandated to issue detailed secondary legislation establishing precise sanctioning scales, accreditation criteria for conformity bodies, procedures for market surveillance, and national extensions for high-risk system classifications.

Additional near-term developments include the formalization of AgID's public administration AI guidelines following public consultation, the deployment of regulatory sandboxes and testing environments for SMEs and public bodies, and the publication of updated biennial national AI strategy documents by the Presidency of the Council. Authorities will also finalize technical standards for public sector server localization and age-verification mechanisms for online platforms.

Enforcement Bodies