Italy
EU AI Act implementation, 2026
Italy has the EU's most complete framework: Law 132/2025 (in force 10 October 2025) made ACN the market surveillance authority and single point of contact and AgID the notifying authority, and two implementing decrees (D.Lgs. 160/2026 on policing, biometrics and liability; D.Lgs. 179/2026 on authorities, penalties, sandbox, labour and training, in force 23 October 2026) completed the delegation on time.
- Implementing law
- EnactedOct 2025
- Penalty regime (Art. 99)
- Adopted
- Regulatory sandbox
- Planned
- Readiness rank
- 1 of 27score 90 / 100
Key findings
- Italy was the first member state with a national AI law (Law 132/2025, in force 10 October 2025) and completed its implementing decrees within the twelve-month delegation (D.Lgs. 160/2026 and 179/2026).
- ACN is market surveillance authority, single point of contact and general penalty authority; AgID is notifying authority; Banca d'Italia, CONSOB, IVASS and the Garante keep sector and fundamental-rights remits.
- National Article 99 penalties are set in D.Lgs. 179/2026 (Art. 23), graduated by supply-chain role, with reductions for natural persons and SMEs and the option of remediation orders for minor breaches; they apply from 23 October 2026.
- The Italian AI sandbox is created in law (Art. 26 D.Lgs. 179/2026) but is not yet operational pending management rules.
- Italy layers national rules on top of the AI Act: judicial authorisation for real-time biometrics, a ban on scraped biometric databases, civil-liability presumptions, a new criminal offence (Art. 437-bis) and mandatory AI training across public administration, healthcare and the professions.
National authorities
Agenzia per la cybersicurezza nazionale (ACN)
National market surveillance authority, single point of contact with the Commission and other member states, general penalty authority, inspection powers (including unannounced remote inspections of real-world testing), keeper of the national register of Annex III point 2 (critical infrastructure) high-risk systems, recipient of complaints.
noze.it (opens in new tab)Banca d'Italia, CONSOB and IVASS
Supervisory authorities for high-risk AI systems in banking/credit, financial markets and insurance respectively (Art. 74(6) AI Act), with their own supervisory and inspection powers and penalty procedures.
noze.it (opens in new tab)Garante per la protezione dei dati personali
Supervision within the limits of Article 74(8) of the AI Act: high-risk systems affecting fundamental rights (biometrics, law enforcement, migration and border control, justice, democratic processes).
studiolegalestefanelli.it (opens in new tab)Agenzia per la cybersicurezza nazionale (ACN), listed by the European Commission
Implementing law, penalties and sandbox
Legge 23 settembre 2025, n. 132 – Disposizioni e deleghe al Governo in materia di intelligenza artificiale; implemented by D.Lgs. 9 settembre 2026, n. 160 and D.Lgs. 7 ottobre 2026, n. 179
Oct 2025
gazzettaufficiale.it (opens in new tab)National rules on penalties under Article 99 have been laid down.
Article 26 of D.Lgs. 179/2026 establishes the 'Spazio di sperimentazione italiano per l'IA' under the direct supervision of the national AI authorities, with priority for SMEs and start-ups; the decree takes effect on 23 October 2026 and operational rules and strategic management (via the Coordination Committee at the Presidency of the Council) remain to be issued.
noze.it (opens in new tab)Strategia Italiana per l'Intelligenza Artificiale 2024–2026 (AgID / Department for Digital Transformation)
2024
agid.gov.it (opens in new tab)Notable developments
-
Law 132/2025 published – first national AI law in the EU
Published in the Gazzetta Ufficiale on 25 September 2025 and in force from 10 October 2025, Law 132/2025 designated AgID (notifying authority) and ACN (market surveillance and single point of contact), preserved Banca d'Italia, CONSOB and IVASS, authorised up to EUR 1bn in venture investment, and delegated the government to adopt implementing decrees within twelve months.
iapp.org (opens in new tab) -
Council of Ministers gives preliminary approval to two implementing decrees
On 10 June 2026 (meeting no. 177) the Council of Ministers approved in first reading one decree on governance, penalties, training and labour, and one on policing, biometrics and civil/criminal liability, sending them for parliamentary committee and Unified Conference opinions.
noze.it (opens in new tab) -
Digital Omnibus on AI defers high-risk deadlines
Regulation (EU) 2026/1744 (in force 27 July 2026) moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, so ACN's and the sector authorities' high-risk enforcement powers under D.Lgs. 179/2026 will first bite on transparency, GPAI-related and prohibited-practice matters.
actuia.com (opens in new tab) -
D.Lgs. 160/2026 on policing, biometrics and liability published
Legislative Decree no. 160 of 9 September 2026 was published on 15 September 2026 and entered into force on 30 September 2026, requiring prior judicial authorisation for real-time remote biometric identification, banning scraped biometric databases, and adding civil-liability presumptions and a new Article 437-bis of the criminal code.
normattiva.it (opens in new tab) -
D.Lgs. 179/2026 on authorities, penalties and sandbox published
Legislative Decree no. 179 of 7 October 2026 (Gazzetta Ufficiale Serie Generale no. 234 of 8 October 2026, in force 23 October 2026) details AgID and ACN powers, sets national fines (up to EUR 35m/7% for prohibited practices, 15m/3% for operator obligations, 7.5m/1% for misleading information, 1m/0.5% for Articles 27 and 86), creates the Italian AI sandbox (Art. 26), reserves employment decisions to humans and mandates AI training.
noze.it (opens in new tab)
Analysis
Italy chose to legislate early and broadly. Law 132/2025 did more than designate authorities: it set principles for AI in healthcare, labour, the professions and public administration, criminalised harmful deepfakes, and delegated the government to fill in the AI Act machinery within a year. The two decrees adopted in September and October 2026 discharged that delegation on time, which places Italy ahead of nearly every other member state in having a complete, in-force national rulebook before the Digital Omnibus-deferred high-risk phase begins.
Institutionally, Italy avoided the data-protection-authority model chosen by Greece or Luxembourg and instead gave the cybersecurity agency ACN the market surveillance, contact-point and general penalty roles, with AgID handling conformity-assessment bodies. The Garante nonetheless keeps a defined slice (biometrics, law enforcement, migration, justice, democratic processes) and the financial supervisors keep theirs, so the practical map is still multi-authority. D.Lgs. 179/2026 adds a Coordination Committee at the Presidency of the Council that will also steer the sandbox strategy.
What remains is execution. The sandbox exists on paper from 23 October 2026 but needs operating rules; the fine schedule is in force but ACN has no track record yet as an AI enforcer; and the national overlay (human-reserved employment decisions, training mandates, the Article 437-bis offence) creates compliance duties that go beyond the Regulation and may be tested for consistency with the AI Act's maximum-harmonisation logic. Even so, on the schema's measures of designation, law, penalties and sandbox basis, Italy is the benchmark for this group.
EU AI Act 2026 Q3 Report
All 27 member-state profiles including Italy, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.
Sources
- Agenzia per la cybersicurezza nazionale (ACN) (opens in new tab) noze.it
- Garante per la protezione dei dati personali (opens in new tab) studiolegalestefanelli.it
- Notifying authority: Agenzia per l'Italia Digitale (AgID) (opens in new tab) gazzettaufficiale.it
- Strategia Italiana per l'Intelligenza Artificiale 2024–2026 (AgID / Department for Digital Transformation) (opens in new tab) agid.gov.it
- Law 132/2025 published – first national AI law in the EU (opens in new tab) iapp.org
- Council of Ministers gives preliminary approval to two implementing decrees (opens in new tab) noze.it
- Digital Omnibus on AI defers high-risk deadlines (opens in new tab) actuia.com
- D.Lgs. 160/2026 on policing, biometrics and liability published (opens in new tab) normattiva.it