Artificial Intelligence · Italy
AI regulation in Italy: laws & policy (2026)
Italy shaded by its artificial intelligence status
AI in Italy: comprehensive law.
FrameworkEU AI Act (Regulation (EU) 2024/1689) + Italian Law No. 132 of 23 September 2025 ('Disposizioni e deleghe al Governo in materia di intelligenza artificiale'), in force since 10 October 2025; national competent authorities: AgID (notifying authority) and ACN (market surveillance), with Garante per la protezione dei dati personali for data protection aspects.
Italy applies the EU AI Act as the baseline risk-based framework and became the first EU Member State to adopt a dedicated national AI law — Law No. 132/2025, in force since 10 October 2025 — which complements (rather than duplicates) the EU regulation by setting principles and sector-specific rules for healthcare, labour, public administration, justice, research, intellectual professions and protection of minors. Italy has designated AgID as the notifying authority and the Agenzia per la Cybersicurezza Nazionale (ACN) as the market surveillance authority and single point of contact with the EU, while the Garante Privacy retains GDPR powers over AI processing personal data. The law also delegates the Government to adopt implementing decrees and introduces criminal-law amendments, including a new offence for malicious deepfakes.
The EU AI Act in Italy
In Italy, artificial intelligence is governed by the EU AI Act, the first comprehensive AI law, which applies directly as an EU regulation.
- Framework
- the EU AI Act (Regulation (EU) 2024/1689)
- Approach
- risk-based: unacceptable-risk AI is banned, high-risk AI faces strict duties, limited-risk AI has transparency rules
- General-purpose AI
- transparency duties for all GPAI models; systemic-risk models add safety and evaluation obligations
- Timeline
- phased: prohibitions from Feb 2025, GPAI rules from Aug 2025, most high-risk obligations from Aug 2026
- Maximum fine
- €35 million or 7% of global annual turnover for prohibited-AI breaches
- Oversight
- national market-surveillance authorities, coordinated by the EU AI Office
The AI Act is an EU regulation applied directly in Italy; national market-surveillance authorities handle enforcement.
The EU AI Act in Italy: FAQ
Yes. As an EU member, Italy is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.
It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.
It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.
Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.
Key points
As an EU Member State, Italy applies Regulation (EU) 2024/1689 (AI Act), with its risk-based tiering (prohibited, high-risk, limited/minimal) and GPAI obligations rolling in through 2026-2027. Italian Law 132/2025 explicitly aligns with and supplements the EU framework.
Published in Gazzetta Ufficiale No. 223 of 25 September 2025 and in force since 10 October 2025, the 28-article law sets principles (human-centric, transparency, non-discrimination, cybersecurity) and sector rules for healthcare, labour, public administration, justice, research, and intellectual professions, plus a legislative delegation to the Government for further decrees.
AgID (Agenzia per l'Italia Digitale) is designated as the notifying authority (promotion, notification, accreditation of conformity-assessment bodies); ACN (Agenzia per la Cybersicurezza Nazionale) is the market-surveillance authority with inspection and sanctioning powers, and single national contact point under Article 70 of the AI Act. Bank of Italy, CONSOB and IVASS supervise AI in financial-sector use cases.
The law amends the Penal Code: it introduces a new Article 612-quater criminalising the illicit dissemination of AI-generated or altered audio/visual deepfakes causing unjust harm (1-5 years imprisonment) and adds a general aggravating circumstance for crimes committed with AI assistance.
AI in healthcare must preserve the physician's final decision and inform patients; secondary use of pseudonymised data for research is enabled with safeguards. Employers must inform workers of AI used in the workplace. Minors under 14 require parental consent to use AI services; the law also addresses AI in intellectual professions and in public administration.
The Italian Data Protection Authority (Garante per la protezione dei dati personali) retains its full GDPR powers over AI systems processing personal data, has issued opinions on draft AI implementing legislation, and has actively enforced against AI providers (e.g. ChatGPT, DeepSeek), requiring legal bases for training data, DPIAs and transparency.
Italy's Strategy for Artificial Intelligence 2024-2026, coordinated by AgID and the Department for Digital Transformation, structures non-binding policy actions across four pillars — Research, Public Administration, Businesses and Education — complementing the binding EU/national rules.
Timeline - major decisions & events
Parliament gave final approval to Italy's national AI law (in force 10 October 2025), making Italy the first EU member state to legislate domestically alongside the EU AI Act, with sector rules for healthcare, the workplace, justice, copyright and minors, and designating AgID and the cybersecurity agency (ACN) as national competent authorities.
Government of Italy (programmagoverno.gov.it) ↗The Italian DPA fined Luka Inc., developer of the 'Replika' companion chatbot, €5 million for lacking a legal basis for processing and inadequate age verification, following its 2023 block of the service.
EDPB ↗The Italian DPA imposed an urgent, definitive limitation on processing of Italian users' data by China's DeepSeek after the companies' responses on data collection and legal bases were deemed insufficient, prompting parallel probes across the EU.
Bird & Bird (reporting Garante decision) ↗Concluding its investigation, the Italian DPA fined OpenAI €15 million for lacking a legal basis to train ChatGPT on personal data, transparency failures and weak age verification, the first GDPR fine targeting a generative-AI service, and ordered a six-month public information campaign.
Garante per la protezione dei dati personali ↗Regulation (EU) 2024/1689 (the AI Act) entered into force, establishing the EU-wide risk-based framework directly applicable in Italy and setting the baseline that Italy's later national law complements.
EUR-Lex ↗AgID released the updated Italian Strategy for Artificial Intelligence 2024-2026, refreshing the national framework on research, public administration, business adoption and skills ahead of national legislation.
AgID ↗The Italian government approved a draft AI law (later presented to the Senate on 20 May 2024) intended to complement the EU AI Act, covering public administration, healthcare, the judiciary, professions, data protection and copyright, the bill that became Law 132/2025.
Portolano Cavallo (reporting Council of Ministers) ↗After OpenAI added a privacy disclosure, an age-verification option and a training-data opt-out, the Italian DPA suspended its temporary limitation, restoring ChatGPT access in Italy roughly one month after the block.
Garante per la protezione dei dati personali ↗The Italian DPA ordered an immediate temporary limitation on OpenAI's processing of Italian users' data, citing no legal basis for mass training-data collection, lack of transparency, inaccurate outputs and no age checks, the world's first regulatory block of ChatGPT.
Garante per la protezione dei dati personali ↗The Italian DPA issued an urgent order halting Replika's processing of Italian users' data over risks to minors and vulnerable users and absent age verification, Italy's first enforcement action against a generative-AI chatbot, foreshadowing the ChatGPT case.
TechCrunch (reporting Garante order) ↗Italy's ministries and the digital-transition office launched the National Strategic Programme for Artificial Intelligence, the foundational policy framework for AI research, public-sector adoption, talent and infrastructure that preceded binding regulation.
Italian Government (innovazione.gov.it) ↗Italy - other topics
Artificial Intelligence in other countries
Last verified 10/6/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →