Skip to main content

    AI by country · Southern Europe

    AI in Italy: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Italy know before starting with AI?

    Italy has its own general AI law, Law No. 132 of 23 September 2025, which sits alongside the EU AI Act and the GDPR. Two legislative decrees in 2026 set out how AgID and the National Cybersecurity Agency (ACN) supervise AI and impose sanctions. A company should check its duties to workers, clients and patients under Law 132, as well as its AI Act and GDPR obligations.

    At a glance

    Italy at a glance

    Key facts about Italy
    Data protection lawGDPR (applies since 25 May 2018) plus the Privacy Code, Legislative Decree 196/2003, as adapted by Legislative Decree 101/2018
    RegulatorGarante per la protezione dei dati personali for personal data; AgID and ACN for AI
    AI policyLaw No. 132/2025, in force since 10 October 2025, plus Legislative Decrees 160/2026 and 179/2026; EU AI Act phased
    Time zoneCET, UTC+1 in winter and UTC+2 in summer
    CurrencyEUR (euro)
    Business languageItalian; English common in larger and export-focused firms

    Why now

    Why Italy is worth watching

    Each point links to the document it comes from.

    • Eurostat data show 16.4% of Italian enterprises with 10 or more staff used at least one AI technology in 2025, double the 8.2% of 2024 but below the EU figure of 19.95%.[10]

    • Law No. 132/2025 has been in force since 10 October 2025 and must be read in line with the EU AI Act.[3]

    • Article 23 of Law 132 authorises up to 1 billion euros of equity investment in companies working on AI, cybersecurity and related technologies.[5]

    • Legislative Decree 179/2026 on the powers of the national AI authorities, sanctions and sandboxes came into force on 23 October 2026.[6]

    • Legislative Decree 160/2026 on police use of AI and civil and criminal liability came into force on 30 September 2026.[7]

    • The AI Act's Article 50 transparency duties began on 2 August 2026, while high-risk rules for Annex III systems now start on 2 December 2027.[1]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Law No. 132 of 23 September 2025, Disposizioni e deleghe al Governo in materia di intelligenza artificiale

    In force2025Employers must tell workers when AI is used, following the information rules of Legislative Decree 152/1997 (Article 11). Professionals may use AI only in a supporting role and must tell clients which AI systems they use (Article 13). Children under 14 need parental consent to use AI services that process their data (Article 4), and in health care the doctor keeps the final decision (Article 7).[3]

    Law No. 132/2025: authorities and criminal offences

    In force2025AgID is the notifying authority and ACN the market surveillance authority and single point of contact (Article 20). Banca d'Italia, CONSOB and IVASS keep AI market surveillance in their sectors, and the Garante's powers are unchanged. Spreading harmful AI-generated or altered images, video or voices without consent is a crime punished by 1 to 5 years in prison (Article 26, new Article 612-quater of the Criminal Code).[4]

    Legislative Decree 7 October 2026, No. 179

    In force2026It adapts Italian law to the AI Act. Its table of contents covers national authority powers, a national registration of high-risk AI systems, administrative sanctions, an Italian AI sandbox, and AI in employment, health and public administration. We read the structure but not every article, so check the text for the detail.[6]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI

    Phased2024Prohibitions and AI literacy have applied since 2 February 2025, and general-purpose AI rules since 2 August 2025. High-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in Annex I products). Fines reach 35 million euros or 7% of worldwide turnover for prohibited practices.[1]

    General Data Protection Regulation, Regulation (EU) 2016/679, with the Italian Privacy Code

    In force2016People have a right not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Article 22). High-risk processing needs an impact assessment (Article 35), and breaches go to the Garante within 72 hours where feasible (Article 33). Fines reach 20 million euros or 4% of worldwide turnover.[8]

    Where AI fits first

    Where AI fits first

    Manufacturing and machinery

    Visual quality inspection and predictive maintenance on production lines.

    AI that is a safety component of machinery falls under Annex I of the AI Act, whose high-risk rules now apply from 2 August 2028.[1]

    Banking and insurance

    Summarising credit files and classifying customer complaints in Italian.

    Banca d'Italia, CONSOB and IVASS are the AI market surveillance authorities for their sectors under Article 20 of Law 132.[4]

    Health care

    Drafting discharge letters and triaging referrals, with a doctor deciding.

    Article 7 of Law 132 keeps the decision with the doctor and gives patients the right to know when AI is used.[3]

    Professional services

    Research and first drafts for accountants, lawyers and engineers.

    Article 13 of Law 132 requires professionals to tell clients which AI systems they use, in plain language.[3]

    Your first steps

    Your first steps

    1. List every AI system you use and mark which fall under the AI Act's prohibited, high-risk or transparency categories.
    2. Write the worker information notice required by Article 11 of Law 132 before using AI that affects staff, and share it with union representatives.
    3. If you are a professional firm, add a plain-language note on AI use to your client engagement letters.
    4. Check age gates: users under 14 need parental consent under Article 4 of Law 132.
    5. Run a GDPR impact assessment for AI that profiles people or uses health data.
    6. Put a GDPR transfer mechanism, such as standard contractual clauses, in place before personal data goes outside the EU.
    7. Read Legislative Decree 179/2026 on sanctions and the high-risk registration, and watch AgID and ACN for guidance.

    AI services for Italy

    AI consulting and development for teams in Italy

    We work remotely with companies in Italy, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Italy is on UTC+1 in winter and UTC+2 in summer, and India is on UTC+5:30, a gap of 4.5 hours in winter and 3.5 hours in summer. Taking a 9:00 to 18:00 day in Italy and 9:30 to 18:30 in India, the overlap is 5 hours in winter (09:00 to 14:00 Italian time) and 6 hours in summer (09:00 to 15:00). India has no EU adequacy decision, so personal data we handle from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Italy

    Does Italy have its own AI law?

    Yes. Law No. 132 of 23 September 2025 was published in Gazzetta Ufficiale No. 223 on 25 September 2025 and has applied since 10 October 2025. It works alongside the EU AI Act, not in place of it.

    Who supervises AI in Italy?

    ACN is the market surveillance authority and single point of contact, and AgID is the notifying authority. Banca d'Italia, CONSOB and IVASS cover their own sectors, and the Garante still handles personal data.

    Do I have to tell staff we use AI?

    Yes. Article 11 of Law 132 requires employers to inform workers about AI use under the rules in Legislative Decree 152/1997. Workers can ask for more information and must get a written reply within 30 days.

    Were the AI Act deadlines delayed?

    Only some. The Digital Omnibus on AI moved high-risk rules to 2 December 2027 and 2 August 2028. Transparency duties under Article 50 still apply from 2 August 2026.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, AI Act Service Desk, 2026-10-29. Timeline for the implementation of the EU AI Act(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      Timeline for the implementation of the EU AI Act. Primary. Accessed on this date; the page states it reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744). Fine caps were read on the Service Desk Article 99 page.

    2. [2] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists the Agenzia per la cybersicurezza nazionale as Italy's single point of contact, not marked as pending.

    3. [3] Normattiva (Istituto Poligrafico e Zecca dello Stato), 2025-09-25. Legge 23 settembre 2025, n. 132, Disposizioni e deleghe al Governo in m…(normattiva.it)
      Full title and what we used it for

      Legge 23 settembre 2025, n. 132, Disposizioni e deleghe al Governo in materia di intelligenza artificiale. Primary. Used for publication in GU No. 223, entry into force on 10 October 2025, and Articles 1, 4, 7, 11 and 13 (each read on its own Normattiva article page). Consolidated version last updated 26 June 2026.

    4. [4] Normattiva, 2025-09-25. Law 132/2025, Articles 20 and 26(normattiva.it)
      Full title and what we used it for

      Law 132/2025, Articles 20 and 26. Primary. Article 20 for AgID, ACN, the Garante and the financial authorities. Article 26 was read at the same address ending ~art26; Normattiva marks it as amended, current text in force from 17 October 2025.

    5. [5] Normattiva, 2025-09-25. Law 132/2025, Article 23(normattiva.it)
      Full title and what we used it for

      Law 132/2025, Article 23. Primary. Used for the authorisation of up to 1 billion euros in equity investments.

    6. [6] Normattiva, 2026-10-08. Decreto legislativo 7 ottobre 2026, n. 179, Adeguamento della normativa…(normattiva.it)
      Full title and what we used it for

      Decreto legislativo 7 ottobre 2026, n. 179, Adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2024/1689. Primary. Used for publication in GU No. 234 of 8 October 2026, entry into force on 23 October 2026, and the table of contents. We did not read every article.

    7. [7] Gazzetta Ufficiale della Repubblica Italiana, 2026-09-15. Decreto legislativo 9 settembre 2026, n. 160(gazzettaufficiale.it)
      Full title and what we used it for

      Decreto legislativo 9 settembre 2026, n. 160. Primary. Used for its subject (police use of AI, civil and criminal liability), publication in GU No. 214 and entry into force on 30 September 2026.

    8. [8] Boletín Oficial del Estado (copy of the Official Journal of the EU, L 119), 2016-05-04. Regulation (EU) 2016/679 (General Data Protection Regulation)(boe.es)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary text of the GDPR, read in the Spanish official copy because EUR-Lex could not be opened from our tools. Used for Articles 22, 33, 35 and 83.

    9. [9] Normattiva, 2018-09-04. Decreto legislativo 10 agosto 2018, n. 101(normattiva.it)
      Full title and what we used it for

      Decreto legislativo 10 agosto 2018, n. 101. Primary. Used to confirm it adapted the Privacy Code (Legislative Decree 196/2003) to the GDPR, in force since 19 September 2018.

    10. [10] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary dataset, read through the Eurostat API. Indicator E_AI_TANY, enterprises with 10 or more persons employed, excluding the financial sector.

    This is general information, not legal advice. Italy's AI rules are new and the 2026 decrees are only weeks old, so guidance from AgID, ACN and the Garante will follow. Check with a qualified Italian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Italy?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score