Italy D.Lgs. 179/2026
Legislative Decree No. 179 of 7 October 2026: adaptation of national law to Regulation (EU) 2024/1689 on the powers of the national authorities and the use of AI in training (implementing Article 24 of Law 132/2025)
Second of the two legislative decrees implementing Italy's AI law (Law 132/2025). It designates the national authorities under the EU AI Act, sets national administrative fines for AI Act breaches, creates the Italian AI regulatory sandbox, and adds rules on AI in schools, work, the professions, health and public administration, including a bar on employment decisions taken solely by automated processing.
Jurisdiction
Italy
Enacted
Oct 7, 2026
Effective
Oct 23, 2026
Enforcement
ACN (market surveillance authority and single point of contact); AgID (notifying authority); Banca d'Italia, CONSOB and IVASS for high-risk systems in financial services; Garante per la protezione dei dati personali within Article 74(8) of the AI Act; labour courts for Article 41 nullity
Approved by the Council of Ministers in preliminary examination on June 10, 2026 and, after opinions from AgID, ACN, the Garante per la protezione dei dati personali, the Conferenza unificata and the parliamentary committees, in final examination on August 4, 2026. Signed October 7, 2026 and published in Gazzetta Ufficiale n. 234 of October 8, 2026 (26G00200). Enters into force October 23, 2026.
Normattiva: Decreto Legislativo 7 ottobre 2026, n. 179 (Gazzetta Ufficiale n. 234, 8 October 2026)Why It Matters
Sets Italy's AI Act enforcement map, with the cybersecurity agency ACN as the main market surveillance authority, and writes the AI Act's fine ceilings into national law with an added EUR 1 million or 0.5% tier for deployer fundamental-rights assessments and the right to explanation. Article 37 is one of the first national provisions to name AI-based relational environments as a source of behavioural dependency among students.
Recent Developments
Published October 8, 2026, the day before the October 10, 2026 deadline in Article 24 of Law 132/2025 for exercising the delegation. With Legislative Decree 160/2026 (in force September 30, 2026) it completes the implementing package.
At a Glance
Applies to
Harms addressed
Who Must Comply
- Providers, deployers, importers and distributors of AI systems subject to Regulation (EU) 2024/1689 in Italy
- Employers using AI systems in decisions on hiring, changes to or termination of employment
- Schools, universities, professional bodies and public administrations (training duties)
Safety Provisions
- AgID is the notifying authority; ACN (Agenzia per la cybersicurezza nazionale) is the market surveillance authority for AI systems and the single point of contact (Articles 4 to 6)
- Banca d'Italia, CONSOB and IVASS supervise high-risk AI systems used in credit, investment and insurance services; the Garante supervises within Article 74(8) of the AI Act (Article 5)
- Fines for AI Act breaches: up to EUR 35 million or 7% of worldwide turnover for prohibited practices; EUR 15 million or 3% for operator, notified-body and Article 50 transparency obligations; EUR 7.5 million or 1% for misleading information; EUR 1 million or 0.5% for Article 27 and 86 obligations (Article 23)
- Non-pecuniary measures for minor breaches: orders to cease and public declarations, with fines raised by up to one third if an order is ignored (Article 22)
- Italian AI regulatory sandbox under Article 57 of the AI Act (Articles 26 to 31)
- Final employment decisions, including dismissal, discipline and performance evaluation, may not rest solely on automated processing; a natural person must decide, worker consent is no exception, and a dismissal in breach is void (Article 41)
- Workers may obtain, on request and through a natural person, an intelligible explanation of a decision including the role of AI and the main parameters (Article 41(3))
- Teacher training plan and school interventions on excessive social media use and behavioural dependencies arising from AI-based relational environments, funded up to EUR 100 million (Article 37)
- AI literacy and training for students, teachers, adults, public employees, justice staff, regulated professions and continuing medical education (Articles 36 to 51)
Compliance & Enforcement
Key Dates
Oct 23, 2026
Decree enters into force: national AI authorities, sanctions regime and regulatory sandbox provisions apply
Jan 21, 2027
Ministry of Education to launch the teacher training plan on social media and AI-based relational environments (Article 37, within 90 days of entry into force)
Oct 23, 2027
Professional fee parameters to be supplemented to reflect the risk class of AI systems used (Article 49, within 12 months of entry into force)
Penalties
€35M or 7% revenue (whichever higher)
View on map
Italy
Focus Areas
Cite This
APA
Italy. (2026). Legislative Decree No. 179 of 7 October 2026: adaptation of national law to Regulation (EU) 2024/1689 on the powers of the national authorities and the use of AI in training (implementing Article 24 of Law 132/2025).
Related Regulations
Italy AI Act
First EU member state comprehensive national AI law complementing the EU AI Act. 28 articles covering AI governance principles, sector-specific rules for healthcare, employment, justice, and public administration, criminal provisions, copyright protections, and a EUR 1 billion AI investment fund.
Italy D.Lgs. 160/2026
First of two legislative decrees implementing Italy's AI law (Law 132/2025) and adapting national law to the EU AI Act. Title I sets the first organic rules for police use of AI systems on a human-oversight basis, including exceptional, time-limited and judicially authorised real-time biometric identification and a ban on biometric databases built by untargeted mass scraping of the web. Title II introduces Penal Code Article 437-bis, punishing failure to adopt security measures in high-risk AI systems and their unlawful alteration, and gives claimants procedural tools for damages caused by AI systems: access to the system's technical documentation, a presumption of causal link, an alternative forum near the claimant's residence and direct action against the insurer.
Poland AI Systems Act
Polish national law implementing the EU AI Act. It creates the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI, AI Development and Safety Commission) as market surveillance authority and single point of contact, and sets the procedure for inspections, enforcement proceedings and administrative fines for breaches of Regulation (EU) 2024/1689.
CA AB 2246
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
EU DSA Minors Guidelines
Commission guidelines under DSA Article 28(1) establishing measures for online platforms to protect minors, including age assurance, default privacy settings, anti-addictive design restrictions, recommender system safeguards, and protections against grooming and exploitation.
EU Kids Act (Proposed)
Commission proposal for an EU regulation on minors' online safety that would set a harmonised minimum age of 15 for autonomous accounts on risky social networking and video-sharing services, impose safety-by-design duties on those services, online games, app stores, AI companions and general conversational chatbots, and lay down EU-wide rules for privacy-preserving age assurance. Providers of AI companions and general conversational chatbots would have to avoid designs and behaviours that simulate interpersonal relationships likely to create emotional dependency in minors, disable use of a minor's prior interactions by default, gate access for under-13s behind guardian tools, and test and monitor their systems for risks to minors' health, safety and wellbeing.
Last updated October 11, 2026. Verify against primary sources before relying on this information.