• The Italian Government is working on a national draft law on AI, which Politico leaked on 9 April 2024. The draft bill has not yet been presented to the Parliament and it’s likely to be amended during the relevant adoption procedure, but is strongly supported by the majority parties, although with some distinct positions.
• Rumours say that the Italian Government is pushing for having the bill adopted before the entry into force of the AI Act – which may not be the best in terms of ensuring harmonisation, although this would not be the first time Member States want to anticipate EU Law.

Data protection, minors, healthcare, AVMS and deepfakes, copyright and sanctions

• The draft bill is composed of 25 Articles, with the aim of regulating the transparent and responsible use of AI and of laying down the principles on research, experimentation, development, adoption and application of AI systems and models. The definition of "AI system" matches that provided by the latest available version of the AI Act.

• To that end, the draft bill includes provisions on the use of AI in different contexts including in the healthcare sector, in public administration, for audio-visual media service providers and video-sharing platforms (“VSP”). It proposes amendments across numerous legal provisions touching upon data protection, criminal law, civil procedure, and audiovisual media laws. More specifically:
  • With respect to data protection and minors, Article 4 of the draft bill provides that, to access AI systems, minors of 14 shall obtain the consent of those exercising parental liability over them. On the other hand, minors over 14 can lawfully consent to the processing of their personal data in connection with AI systems, provided that the information and communications on the relevant processing are easily available and comprehensive.
  • Under Article 5, the State and public authorities shall promote the creation of an innovative, fair, open, and competitive AI market, among others facilitating the availability and the access to high quality data for the enterprises developing or using AI systems and for the scientific community.
  • On the use of AI systems within the health sector:
    • Articles 8 clarifies that access to healthcare shall not be conditioned by the use of AI systems through discriminatory criteria and that individuals shall be informed on the use of AI technologies and of their advantages. Furthermore, AI systems used in healthcare and all relevant data shall be reliable, regularly reviewed and updated to minimize the risk of error.
    • Article 9 concerns research and scientific experimentation in the implementation of AI systems in the health sector and provides that the relevant data processing carried out by public and non-profit private entities is of public interest, as per Article 9(g) GDPR. Such entities are in particular allowed to carry out secondary use of data (including special categories data as per Art. 9 GDPR) without further consent from the data subject, when originally provided by the law, subject to information obligation, which can be met also by posting a general privacy policy on the controller’s website. The processing activities at stake shall be subject to previous approval from the interested ethical committees and may start only following 30 days from being submitted to the IT DPA via a DPIA, absent any ban from the ITDPA.
  • With respect to AVMS and VSP providers, the draft bill would amend the Italian AVMS Law by providing that AI-generated or modified content included in programmes shall be labelled as such and users of VSP shall be put in the position to use tools to apply that label (Article 23). The IT Communications Authority (AGCOM) shall adopt a regulation on the implementation of Article 23.
  • In relation to copyright, the draft bill:
    • Amends the Italian Copyright Law by introducing a copyright protection for works generated through AI systems, provided that human contribution was creative, relevant and can be demonstrated. This shall be without prejudice to the rights of the creator of the AI system considered.
    • Requires that works generated through AI comply with copyright laws, including by ensuring the identification of the works whose use is not expressly reserved by rights holders. The source of a work generated through the AI shall be identified, unless such identification is impossible.
    • Introduces new sanctions related to the use of AI systems in violation of copyright law or IT law.
  • The draft bill amends both the IT Criminal Code and the IT Civil Code by:
    • Amending existing criminal provisions through references to AI systems – such as for crimes of impersonation, fraud or money laundering – and by introducing the new Article 612-quater of the IT Criminal Code on the unlawful spread of content artificially created or manipulated.
    • Providing for the exclusive jurisdiction of civil Courts for non-criminal proceedings concerning the functioning of AI systems.
  • Finally, the draft bill also includes provisions to make sure the use of AI systems within the public administration, the judiciary system, and individual professions is human-centric.

National Strategy on AI

• The draft bill outlines the national strategy on AI, by delegating, through Article 17, the Government to adopt and update every two years such strategy, in coordination with the Italian Digital Agency ("AGID") and in cooperation with the Italian National Cybersecurity Agency ("ACN").
• Furthermore, Article 18 appoints AGID and ACN as national authorities for AI:
  • AGID is responsible for innovation and development of AI technologies and also issues guidelines and procedures for assessment, registration and monitoring of AI systems conformity.
  • ACN is assigned with monitoring powers. Sand-boxes can be launched by both AGID and ACN, who shall also cooperate with other Italian authorities.
• Article 22 delegates the Government to deploy, within 12 months, further national legislation "implementing" the AI Act, also based on the opinions to be shared by the Parliament and the IT DPA.