Italy has enacted a comprehensive national law on AI: law n. 132/2025, published on 25 September 2025 and in force from 10 October 2025. This law complements and expressly defers the EU AI Act and its definitions and obligations, filling national gaps and aiming at balancing innovation with the need for security and protection of rights. It initially comes across as a set of general statements, though it contains specific provisions that deserve further scrutiny.
Who supervises what. Italy designates two competent authorities: AgID (Agency for Digital Italy) and the ACN (National Cybersecurity Agency). AgID handles promotion of innovation and development of AI and deals with the monitoring of entities responsible for verifying AI system compliance; ACN is the supervisory and sanctioning authority overseeing the security and resilience of AI systems. AgID and ACN must also run AI systems experimentation spaces, fostering innovation through controlled testing environments.
Sector-specific regulation. Employment sector. The Italian AI law specifically addresses AI applications in critical areas such as security and defense, healthcare, research and clinical studies, employment, public administration, judicial services. In employment, AI should improve working conditions and the mental and physical well-being of workers as well as performance quality and productivity, and cannot undermine dignity or data protection. Employers must inform workers when AI is used in hiring, tasking, performance or monitoring, building on Italy’s existing transparency duties. Italian AI law provides for the creation of a National Observatory to monitor the impact of AI systems and models on the employment sector.
Data protection. Concerning personal data protection, the AI Law refers to the national and European legislation, especially Regulation EU 2016/679 (GDPR), insisting in the enforcement of core GDPR principles such as lawfulness, fairness, and transparency in data processing. Additionally, it emphasizes the importance of communicating processing information clearly and understandably, ensuring individuals are fully informed about potential risks and their right to object.
Minors and consent. The Italian AI law introduces a distinctive national rule concerning the protection of minors in AI data processing. Access to AI technologies by children under 14 and the related personal-data processing requires parental consent. Teenagers over 14 may express their consent, provided that information on data processing related to AI systems is clear and accessible.
Copyright and deepfake. The AI law amends the Italian copyright law confirming the protection of works created with the aid of AI, provided they are the result of human intellectual work. Furthermore, to address the increasing and dangerous spread of deepfakes and to minimize the damages caused by the misuse of such technologies, a distinct offense for the “illicit dissemination of content generated or altered with AI systems” has been established, punishable by imprisonment from one to five years.
