Key developments following Italy’s implementation of the EU AI Act.
On 23 October 2026, Legislative Decree No. 179 of 7 October 2026 entered into force in Italy in order to adapt the national legislation to Regulation (EU) 2024/1689 “AI Act”. The decree modifies law no. 132/2025, through which Italy had already established a national framework for artificial intelligence.
The Italian legislation is based on the “human-centred approach” with respect to the AI.
The development and adoption of AI are encouraged, while human autonomy, oversight and responsibility remain central. This approach is particularly clear in professional services and healthcare. For lawyers and other professionals providing intellectual services, the law provides that AI may be used for ancillary and supporting activities, but human intellectual work has to remain predominant. In healthcare, AI supports prevention, diagnosis, care and treatment choices, while the final decision remains with the medical individual professional.
A key focus of the new decree is education and training. Its provisions oblige to organize AI training seminars to the benefit of students, citizens, teachers, public-sector personnel, professionals and workers, with the goal to improve AI literacy across the whole society. In the workplace, the decree also requires employers to provide appropriate information and training on specific AI-related risks and the preventive and protective measures adopted.
The decree also addresses the protection of business know-how: it expressly includes data, algorithms and mathematical methods used to train AI systems within the scope of trade secret protection.
Another important element concerns the allocation of regulatory responsibilities. AgID, Italy’s digital agency, acts as the national notifying authority responsible for procedures concerning conformity assessment bodies. The National Cybersecurity Agency, ACN, exercises market surveillance functions, alongside the sector-specific responsibilities of the Bank of Italy, CONSOB and IVASS. The Italian Data Protection Authority also has a defined role within the framework. Businesses should therefore identify the competent authority by reference to their activities and the systems concerned.
These developments show that lawmaker is actively responding to the growth of AI. As often happens with technological and economic changes, legislation follows innovations emerging in society and business. We should expect this process to become increasingly iterative, with successive measures refining the framework as technologies and their uses evolve. Given the speed of AI development, this has to be considered a constructive and appreciated approach.
For lawyers, this means continuously monitoring developments and translating them into practical advice. For businesses, it means treating AI compliance as an ongoing responsibility.
Mapping AI uses, assigning internal responsibilities, training staff and reviewing contractual safeguards are practical steps towards responsible adoption. As the framework develops, keeping these measures up to date will help businesses manage legal exposure while making informed use of AI’s opportunities.
