Italy is the first EU Member State to adopt a comprehensive national framework concerning the use of Artificial Intelligence.
Laws/Regulations directly regulating AI (the "AI Regulations")
On October 10, 2025, Italy adopted Law no. 132/2025 (the "National AI Law"). Italy is therefore the first EU Member State to adopt a comprehensive national framework dedicated to Artificial Intelligence.
The National AI Law1 intends to complement the Regulation (EU) 2024/1689 (the "EU AI Act"), establishing sector-specific rules which fall under the scope of national law and defining the institutional architecture responsible for overseeing AI in Italy, with designated authorities as well as administrative and criminal sanctions.
Status of the AI Regulations
The EU AI Act is addressed separately here.
On October 10, 2025, the National AI Law entered into force.
Unlike the EU AI Act, which provides for gradual implementation and will only become fully binding over time, several provisions of the National AI Law are already in force and fully applicable.
However, the National AI Law also delegates the Italian Government to adopt implementing decrees concerning the training of AI systems and civil redress (Article 16), the compliance of the National AI Law with the EU AI Act (Article 24(1)), specific civil procedure rules on damages (Article 24(5)(d)) and criminal sanctions (Article 24(5)(b)). The implementing decrees shall be adopted within twelve months – i.e., by October 10, 2026.
Other laws affecting AI
On May 20, 2024, the Italian Data Protection Authority (DPA) adopted a Notice on the use of web-scraping for the purpose of training AI models and contrasting the misuse of personal data.2
Moreover, the DPA has had a specific organizational unit dedicated to artificial intelligence in place since 2021.
Furthermore, Italian courts and regulators have begun to interpret existing laws with regard to AI.3
Additionally, there are various laws that do not directly seek to regulate AI, but may affect the development or use of AI in Italy, such as:
- The GDPR and the Italian Data Privacy Code (Legislative Decree no. 196/2003)
- EU and Italian competition law (Articles 101 and 102 TFEU and Law no. 287/1990)
- The Italian Consumer Code (Legislative Decree no. 206/2005)
- Intellectual property laws may also affect several aspects of AI development and use: the Italian Copyright Law (Law No. 633/1941) and the Industrial Property Code (Legislative Decree No. 30/2005)
Definition of "AI"
Article 2 of the National AI Law refers to the definitions of "Artificial Intelligence" and "AI system" contained in the EU AI Act.
Interestingly, the Parliament bill first introduced a standalone definition of such concepts, but was subsequently modified after the intervention of the European Commission which noted that the proposal did not align with the EU AI Act and risked causing fragmentation.
The National AI Law highlights the importance of an "anthropo-centric" use of artificial intelligence (Article 1). Additionally, research, experimentation, development and application of AI systems and AI models shall respect human rights and the principles enshrined in the Italian Constitution and in EU law (Article 3).
Territorial scope
The National AI Law is set to apply to the development and deployment of AI systems and AI models within the Italian territory.
Sectoral scope
The National AI Law applies to the following sectors:
-
National health service and healthcare: Article 7 permits the use of AI to strengthen the national health service and support disease prevention, diagnosis, and treatment, provided fundamental rights and data protection are respected. AI cannot be used to discriminate in healthcare access and must promote inclusion for persons with disabilities. AI systems may only « support » medical procedures; final decisions remain with medical professionals, whose clinical judgment and liability are unchanged. Patients must be informed when AI is used in medical assistance.
With respect to research and development, Article 8 enables public and non-profit entities to process personal data for AI development as a matter of "paramount public interest", requiring only general notice to individuals and anonymization. No additional consent is needed, but the DPA must be notified at least 30 days in advance and may exercise its inspection powers.
By February 2026, the Minister of Health is expected to issue guidelines on the processing of medical data for research purposes with regard to AI systems (Article 9). The National AI Law also established a national AI platform, which aims to assist: healthcare professionals (by providing non-binding decision support), doctors in their daily clinical practice, and patients in accessing community services (Article 10).
- Labor conditions: The use of AI in the workplace shall be safe, reliable and transparent and must respect human dignity and the treatment of personal data. Employers must inform employees about the use of AI in decision-making processes. The law establishes an Observatory on the adoption of AI systems in the workplace4, with the purpose of defining a strategy on the use of AI in employment and monitoring the impact of AI on the job market. The Observatory shall also promote the training of employers and employees on the use of AI.
- Intellectual professions: With regard to intellectual professions, AI systems may only support professionals who must ensure the prevalence of intellectual work over the use of AI. The employer or client must be clearly informed if AI systems have been used in providing the service.
- Public administration and judicial system: Public bodies may use AI solely to support decision-making and organizational tasks; responsibility remains with the competent authority or official to protect citizens' rights. Judges and prosecutors must retain final authority over legal interpretation and application. The Minister of Justice regulates AI use for court administration and promotes training for judiciary members.
- AI and Copyright: The National AI Law clarifies that copyright protects "works of human intellect," including those created with AI, as long as there is human creative input. Content generated solely by machines is not protected. The National AI Law also expressly regulates text and data mining (TDM) by AI, allowing reproductions and extractions from lawfully accessible works, subject to existing exceptions in Articles 70-ter and 70-quater. Unauthorized TDM, including by AI, is now a criminal offense.
Compliance roles
According to the National AI Law, the development and implementation of AI systems must respect fundamental rights enshrined in the Italian Constitution and EU law, and be based on the principles of transparency, proportionality, safety, protection of personal data, confidentiality, accuracy, non-discrimination, gender equality and sustainability.
Core issues that the AI Regulations seek to address
The Italian government released the National AI Strategy, which identifies three areas of action, namely: (i) to strengthen expertise and attract talent in order to develop an AI ecosystem; (ii) to increase funding for advanced research in AI; (iii) to encourage the adoption and the application of AI, both in public administration (PA) and in productive sectors in general.5
The Italian government has also stressed the need to ensure, inter alia, greater clarity with respect to coordination with sector regulations, in particular banking and insurance. It also proposed a system of self-assessment by the companies of AI systems, through guidelines or a repository of examples, and supported the definition of burdens and obligations along the value chain of AI systems, especially for SMEs.
The Presidency of the Council of Ministers is competent for the enforcement of the National AI Strategy, together with the Agency for Digital Italy (AgID) and other sector-specific authorities.
Risk categorization
The National AI Law does not establish a different risk categorization than that of the EU AI Act. Accordingly, there is currently no risk categorization of AI in Italy, except for those that are introduced by the EU AI Act.
Key compliance requirements
The National AI Law relates to some specific sectors, as outlined above.
Regulators
In compliance with the designation of AI supervisory authorities required by the EU AI Act, the National AI Law designates the national authorities responsible for AI:
- The Agency for Digital Italy (AgID), which will act as the notifying authority with functions related to the accreditation and supervision of entities tasked with assessing AI systems' conformity. AgID will also be responsible for promoting innovation and the development of artificial intelligence.
- The National Cybersecurity Agency (ACN), which is identified as the supervisory authority and the lead authority for the use of AI in cybersecurity. The designation of the authorities is without prejudice to the sectoral competences of other regulatory authorities such as the Bank of Italy, the Italian Security and Exchange Commission (CONSOB) and the Italian Insurance Supervisory Authority (IVASS), as well as the Data Protection Authority (DPA) and the Telecom Authority (AGCOM).
Enforcement powers and penalties
The National AI Law introduces criminal sanctions for AI-related offenses. This includes a new offense under the Italian Penal Code, "Unlawful dissemination of content generated or altered with AI systems" (Article 612-quater), which targets deepfakes; those who publish or distribute AI-altered images, videos or audio recordings that are likely to be misleading and cause unjust harm may face one to five years' imprisonment. Additionally, a new aggravating circumstance applicable to all criminal offenses increases sentences by up to one third if a crime is committed by using AI, or if AI is used to hinder defense or aggravate the consequences of the offense (Article 61 No 11-undecies).
Further criminal penalties apply to offenses such as "attacks on citizens' political rights", "market rigging", and "market manipulation" when committed using AI. The law also extends copyright sanctions under the Italian Copyright Law to unauthorized scraping and abusive text and data mining.
The Government must issue implementing decrees within twelve months, which may introduce new criminal offenses to address AI risks. By October 2026, the Government is expected to adopt implementing decrees to define sanctioning powers for authorities, as required by the EU AI Act. Further implementing decrees are expected to govern the use of data, algorithms, mathematical methods for training AI systems (such as appropriate civil redress mechanisms), and a related system of sanctions.
The National AI Law also amends the Code of Civil Procedure by assigning disputes concerning the functioning of AI systems to specialized business sections of civil courts, thereby updating the procedural rules for AI-related civil claims.
1 See Law No. 132 of September 23, 2025, "Provisions and delegations to the Government on Artificial Intelligence" here.
2 Decision of May 20, 24 of the Italian DPA, available here.
3 For instance, the Italian Supreme Court (Corte di Cassazione) has ruled on the principles governing the lawful use of artificial intelligence systems involving the processing of biometric data: Italian Supreme Court, judgement No. 12967 of May 13, 2024.
4 The Observatory identifies the sectors and professions most affected by AI and proposes practical solutions to manage these changes. It also helps shape national strategies to promote a balanced and responsible adoption of AI in companies and institutions. Moreover, the Observatory focuses on training, identifying the most requested skills on labor markets and promotes targeted initiatives to support reskilling and upskilling for workers and businesses. Please see here for more information.
5 See the National AI Strategy (2022-2024). In terms of AI regulation, the National AI Strategy calls for a radical update in terms of: (i) strengthen the AI research base and associated funding; (ii) promote measures to attract talent; (iii) improve technology transfer process; (iv) increase the adoption of AI among business and PA, fostering the creation of innovative companies. The recent National AI Strategy also aims to align all IA policies related to data processing, aggregation, sharing and exchange, as well as to data security, with the National Cloud Strategy and with ongoing initiatives at the European level, starting with the European Data Strategy and the recent proposals for a Data Governance Act and a regulation on artificial intelligence.
[View source.]
