Italy Implements National EU AI Act Enforcement Framework
Italy has completed a key part of its national framework for the EU AI Act with Legislative Decree No. 179/2026, effective from 23 October 2026. The decree follows Law No. 132/2025 and addresses areas left to Member States, including competent authorities, enforcement procedures, penalties, and AI regulatory sandboxes. Organizations operating in Italy must now assess compliance under both the EU AI Act and the Italian national rules.
The decree divides supervisory responsibilities among several authorities. AgID is Italy’s notifying authority for conformity assessment bodies, while the National Cybersecurity Agency, ACN, acts as the principal market surveillance authority and single contact point for EU institutions. ACN also oversees certain high-risk AI systems used in critical infrastructure. In regulated financial sectors, the Bank of Italy, CONSOB, and IVASS supervise AI systems within their established mandates. The Garante retains its GDPR powers and acts as a market surveillance authority in the situations specified by Article 74(8) of the AI Act.
Italy has largely adopted the AI Act’s tiered sanctions. Fines may reach €35 million or 7% of worldwide annual turnover for prohibited AI practices, €15 million or 3% for most compliance failures, and €7.5 million or 1% for providing misleading information to authorities. The decree adds a separate penalty tier of up to €1 million or 0.5% of worldwide annual turnover for failures concerning fundamental rights impact assessments under Article 27 or the right to explanation under Article 86. Authorities may impose non-monetary corrective measures for less serious breaches, although non-compliance with such orders can increase a later fine by up to one third.
The most immediate national measure concerns AI-supported employment decisions. Article 41 prohibits final decisions on hiring relationships, dismissal, discipline, changes to employment terms, and performance evaluations from being based solely on automated processing. A person with genuine and independent authority must make the final decision. Employee consent cannot remove this restriction. Workers may request an intelligible explanation of the decision, including the role played by AI and the main factors considered. Decisions adopted in breach of the rule are null and void.
Candidate sourcing and screening are not treated as final decisions on establishing an employment relationship. However, recruitment systems will often remain high-risk AI systems under Annex III of the AI Act and must comply with GDPR and national transparency obligations. Article 41 already applies, while the AI Act’s Annex III high-risk system requirements are expected to apply from 2 December 2027. Employers should therefore review AI-enabled HR processes now, identify where automated scores or recommendations affect personnel decisions, and ensure that meaningful human decision-making and worker information are documented.
Italy will also establish the Italian Experimental Space for AI, jointly supervised by AgID and ACN. The sandbox is intended to support testing, regulatory learning, and market access, especially for SMEs and startups. More implementing measures may follow, but the central Italian structure is now in force. Businesses should map their AI systems, identify the relevant sector supervisor, prepare for impact assessments and explanation requests, and maintain records of any significant changes to existing high-risk systems.
