Italy AI Act
Italy Law No. 132/2025 on Artificial Intelligence
First EU member state comprehensive national AI law complementing the EU AI Act. 28 articles covering AI governance principles, sector-specific rules for healthcare, employment, justice, and public administration, criminal provisions, copyright protections, and a EUR 1 billion AI investment fund.
Jurisdiction
Italy
Enacted
Sep 17, 2025
Effective
Oct 10, 2025
Enforcement
Agency for Digital Italy (AgID) and National Cybersecurity Agency (ACN)
Adopted by Parliament September 17, 2025 (Law of September 23, 2025, no. 132); entered into force October 10, 2025. Article 24 delegated the Government to adopt implementing legislative decrees by October 10, 2026. Both decrees were approved in preliminary examination on June 10, 2026 and in final examination on August 4, 2026. Legislative Decree 9 September 2026, n. 160 (police use of AI; civil and criminal liability) was published in Gazzetta Ufficiale n. 214 of September 15, 2026 and entered into force September 30, 2026 (tracked as it-dlgs-160-2026). Legislative Decree 7 October 2026, n. 179 (national authorities, sanctions, regulatory sandbox, and AI in training, work, the professions, health and public administration) was published in Gazzetta Ufficiale n. 234 of October 8, 2026 and enters into force October 23, 2026 (tracked as it-dlgs-179-2026).
Normattiva: Legge 23 settembre 2025, n. 132 (Gazzetta Ufficiale n. 223, 25 September 2025)Why It Matters
First comprehensive national AI law in the EU, establishing sector-specific rules that go beyond the EU AI Act's horizontal framework. Notable for criminal liability for harmful deepfakes and explicit prohibition on AI replacing human decision-making.
Recent Developments
The implementing package is complete. Legislative Decree 160/2026 (in force September 30, 2026) regulates police use of AI, adds Penal Code Article 437-bis on unsecured high-risk AI systems, and strengthens civil remedies for AI-caused damage. Legislative Decree 179/2026 (Gazzetta Ufficiale n. 234, October 8, 2026; in force October 23, 2026) makes ACN the market surveillance authority and single point of contact and AgID the notifying authority, assigns high-risk financial-services systems to Banca d Italia, CONSOB and IVASS, sets fines at the AI Act Article 99 levels (EUR 35 million or 7% down to EUR 7.5 million or 1%) plus a EUR 1 million or 0.5% tier for Articles 27 and 86, creates the Italian AI sandbox, voids dismissals decided solely by automated processing, and funds a EUR 100 million school training plan on social media and AI-based relational environments.
At a Glance
Applies to
Harms addressed
Who Must Comply
- AI system developers and deployers in Italy
- Healthcare providers using AI
- Employers deploying AI in workplace
- Public administration using AI
Safety Provisions
- AI must enhance but not replace human decision-making
- Mandatory human oversight throughout AI lifecycle
- Healthcare AI: ultimate responsibility remains with healthcare professionals
- Healthcare AI: patients have right to be informed when AI is used in their care
- Prohibition on AI discrimination in healthcare access
- Workplace: employers must inform employees of AI deployment
- Criminal offences for misuse of AI including harmful deepfakes
- Bans AI applications that interfere with democratic institutions or distort public debate
Compliance & Enforcement
Key Dates
Oct 10, 2026
Deadline under Article 24 for the Government to adopt implementing legislative decrees. Delegation exercised: Legislative Decree 160/2026 (published September 15, 2026; in force September 30, 2026) and Legislative Decree 179/2026 (published October 8, 2026; in force October 23, 2026)
Oct 23, 2026
Legislative Decree 179/2026 enters into force: ACN market surveillance, AgID notification, national AI Act fines and the Italian AI regulatory sandbox
Penalties
criminal (up to 5yr)
View on map
Italy
Focus Areas
Cite This
APA
Italy. (2025). Italy Law No. 132/2025 on Artificial Intelligence.
Related Regulations
Italy D.Lgs. 179/2026
Second of the two legislative decrees implementing Italy's AI law (Law 132/2025). It designates the national authorities under the EU AI Act, sets national administrative fines for AI Act breaches, creates the Italian AI regulatory sandbox, and adds rules on AI in schools, work, the professions, health and public administration, including a bar on employment decisions taken solely by automated processing.
Italy D.Lgs. 160/2026
First of two legislative decrees implementing Italy's AI law (Law 132/2025) and adapting national law to the EU AI Act. Title I sets the first organic rules for police use of AI systems on a human-oversight basis, including exceptional, time-limited and judicially authorised real-time biometric identification and a ban on biometric databases built by untargeted mass scraping of the web. Title II introduces Penal Code Article 437-bis, punishing failure to adopt security measures in high-risk AI systems and their unlawful alteration, and gives claimants procedural tools for damages caused by AI systems: access to the system's technical documentation, a presumption of causal link, an alternative forum near the claimant's residence and direct action against the insurer.
EU AI Content Transparency Code
Voluntary code of practice under the EU AI Act that sets out how providers of generative AI systems can meet the Article 50(2) duty to mark AI-generated or manipulated content in a machine-readable, detectable way, and how deployers can meet the Article 50(4) duty to label deepfakes and AI-generated text published on matters of public interest. The Commission and the AI Board have assessed it as an adequate means of demonstrating compliance.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
Singapore OSRA
Creates a dedicated Online Safety Commission (OSC) with powers to order takedowns and disable access, establishes statutory torts providing victims of online harms with direct civil remedies against platforms and perpetrators.
EU DSA Minors Guidelines
Commission guidelines under DSA Article 28(1) establishing measures for online platforms to protect minors, including age assurance, default privacy settings, anti-addictive design restrictions, recommender system safeguards, and protections against grooming and exploitation.
Last updated October 11, 2026. Verify against primary sources before relying on this information.